Security, compliance & data protection
The baseline: your application complies with applicable law, reflects the state of the art at the time of delivery, and follows recognised secure-development practice, in particular protection against the OWASP Top 10 risks. This page covers what that means concretely: what gets tested, how fast you patch, and what data protection requires.
Security testing
By applying for the platform, you consent to automated and manual security testing of your application, performed by GovTech or parties it authorises:
- Image scanning
- SAST (static application security testing)
- DAST (dynamic application security testing)
- Penetration testing
Findings must be remediated according to priority. The bar for admission and operation: no open critical or high findings. Exceptions require a risk acceptance documented by GovTech.
All of these checks can be rehearsed in your own pipeline before the platform runs them, for example with an image scanner such as trivy and a SAST tool.
Patch and remediation deadlines
Deadlines by finding severity and SLA profile:
| Finding severity | Standard profile | KRITIS profile |
|---|---|---|
| Critical | ≤ 15 days | ≤ 7 days, or workaround ≤ 72 h |
| High | ≤ 30 days | ≤ 15 days |
| Medium | ≤ 90 days | ≤ 60 days |
| Low | ≤ 180 days / next release | ≤ 90–180 days |
Meeting these deadlines is part of the service credit model.
Secrets and transport security
- No secrets in the container image or source code. Secrets are provided exclusively through the platform's Vault service and drawn at runtime.
- No application-own transport security. The platform provides the domain, the certificates and the TLS termination; your application must not require its own certificates, trust stores or unencrypted endpoints.
Data protection
Where your application processes personal data:
- The Auftragsverarbeitungsvereinbarung (data processing agreement, AVV) is part of the contract.
- Sub-processors may only be used as the contract provides, with full contractual flow-down.
- Statutory notification and deletion duties, GDPR above all, are met on time and in close coordination with GovTech.
Security incidents
- Report security incidents to GovTech without undue delay. A security incident is always classified S1.
- You support analysis, containment, remediation and documentation.
General guidance. The binding requirements, including all deadlines on this page, are in the contract documents of your procedure, which may contain further or more specific requirements.