Documentation & evidence
The platform operates your application without your admin access; documentation is what makes that possible. The set is small: six documents you keep current, plus two artefacts per release. All of it must be available in text form on request.
Keep current at all times
| Document | What it answers |
|---|---|
| External connections & dependencies | What does the application talk to, and why? |
| Role and permission concept | Who may do what, including how platform claims map to roles |
| Health checks | Which endpoints, what logic, how to read the responses |
| Runbooks | How to operate it, and what to do when it misbehaves |
| Migration and exit mechanisms | How schemas migrate, how data leaves, how it shuts down cleanly |
| Backup & restore procedures | How backups run, how often, and how a restore works |
Ship with every release
- Release notes: what changed, what was fixed, what is known to be open
- Vulnerability analysis: the security picture of exactly this version
Both refer to the specific version being released.
What does not belong here
Functional and application-specific evidence is deliberately separate. It belongs to the Leistungsbeschreibung (Anlage 1) of your procedure, not to the platform's operating documentation.
Guidance, not contract
General guidance. The binding requirements are in the contract documents of your procedure, which may contain further or more specific requirements.