The C5 atte­sta­tion confirms the con­ti­nuously audited operation of Insiders‘ cloud services. Customers save on audit effort, acce­le­rate approval processes, and sus­tain­ably reduce their com­pli­ance costs.

Insiders now holds the C5 Type 2 atte­sta­tion for our  cloud services for the use of inno­va­tive AI tech­no­lo­gies in automated document pro­ces­sing (IDP). This confirms that defined security measures have been effec­tively imple­mented over an extended period of time. For customers, this signi­fi­cantly reduces the effort required for their own audits and internal review processes.

C5 Atte­sta­tion as a Reco­g­nised Audit Standard for Cloud Services

The C5 atte­sta­tion is based on the Cloud Computing Com­pli­ance Controls Catalogue — C5 for short — developed by the German Federal Office for Infor­ma­tion Security (BSI). It defines binding minimum requi­re­ments for secure cloud computing and serves as a reco­g­nised benchmark for companies and public sector clients when assessing the security of cloud services.

The audit evaluates more than 120 criteria by inde­pen­dent auditors. These include robust access controls, role-based per­mis­sion concepts, encrypted data trans­mis­sion and storage, GDPR-compliant pro­ces­sing of personal data, docu­mented emergency and recovery plans, redundant system archi­tec­tures to ensure avai­la­bi­lity, and struc­tured processes for incident manage­ment and security reporting. Trans­pa­rency obli­ga­tions towards customers and clear rules on data loca­li­sa­tion are also part of the audit. For users, this means a security level in line with the highest German standards.

The Type 2 audit is con­sidered par­ti­cu­larly rigorous because it does not merely describe the design of security measures — it verifies their con­ti­nuous operation. This makes it a credible form of evidence for regu­la­tory aut­ho­ri­ties, data pro­tec­tion bodies, and internal audits.

Since 1 July 2025, a C5 Type 2 atte­sta­tion has been mandatory when cloud services in Germany process social or health data. In regulated sectors such as financial services, public admi­nis­tra­tion, or critical infra­struc­ture operators, the atte­sta­tion is incre­asingly required as a pre­re­qui­site.

Less Audit Effort, Lower Costs, Faster Approvals

For Insiders customers, the C5 atte­sta­tion has an immediate economic impact. In regulated envi­ron­ments, companies are obliged to regularly audit and document the security of their service providers. Without a stan­dar­dised proof, this generates sub­stan­tial internal workload for risk analyses, supplier assess­ments, audit inter­views, and docu­men­ta­tion requi­re­ments.

The C5 Type 2 atte­sta­tion for Insiders‘ AI cloud services signi­fi­cantly reduces this burden. Customers can rely on a reco­g­nised, audited security cre­den­tial instead of con­duc­ting their own time- and cost-intensive indi­vi­dual audits.

„Regu­la­tory requi­re­ments generate con­siderable indirect costs in many orga­ni­sa­tions,“ says Dr. Alexander Swienty, Head of Channel Manage­ment at Insiders. „With the C5 Type 2 atte­sta­tion, we take on a large share of that audit effort. Our customers benefit from clear proof of com­pli­ance, shorter coor­di­na­tion cycles with regu­la­tory aut­ho­ri­ties, and a signi­fi­cantly reduced burden on internal resources.“

A Com­ple­ment to ISO 27001 Cer­ti­fi­ca­tion

Insiders already holds ISO 27001 cer­ti­fi­ca­tion for its infor­ma­tion security manage­ment system. While this confirms the struc­tured manage­ment of infor­ma­tion security, the C5 atte­sta­tion addi­tio­nally verifies the secure operation of the specific cloud services. Together, they provide customers with a robust security and com­pli­ance foun­da­tion.

Read more about the diffe­rences between the C5 atte­sta­tion and ISO 27001 cer­ti­fi­ca­tion.

Inte­grated Com­pli­ance Proof Without Addi­tional Effort

Insiders inte­grates the C5 atte­sta­tion into its business model through a trans­pa­rent assurance fee. This means customers do not need to initiate a separate audit project — they receive a ready-made, audited security cre­den­tial that can be used directly to meet their own com­pli­ance requi­re­ments.

The atte­sta­tion is renewed annually, ensuring con­ti­nuously veri­fiable security standards. For customers, this means regu­la­tory stability, pre­dic­table costs, and signi­fi­cantly less admi­nis­tra­tive overhead in day-to-day ope­ra­tions.