What is BSI C5? Clouds with a C5 attestation in 2026

BSI C5 is the Cloud Computing Compliance Criteria Catalogue from the BSI, Germany's Federal Office for Information Security. It sets a minimum security baseline for cloud services, and an independent auditor checks a service against it and writes a report the customer can read. Clouds that state a C5 attestation on their own pages include AWS, Microsoft Azure, Google Cloud, IONOS, STACKIT, Exoscale, OVHcloud and T Cloud Public from Deutsche Telekom.

Two details trip people up. There's no such thing as a C5 certificate, only an attestation, and it covers named services in named regions rather than a whole company.

C5 in short

The BSI doesn't recommend auditors and doesn't check the reports. Judging a report is the customer's job. Audits are usually repeated every year, so ask for each new report while you use the service.

Type 1 and Type 2

An auditor can report in two ways, and the difference matters when you compare providers:

• Type 1 says the controls were suitably designed and in place on the day of the audit.
• Type 2 adds that the controls actually worked over an audit period. The provider has to keep evidence, such as monitoring logs, for the whole period.

A Type 2 report is the stronger statement. When a provider says "C5", ask which type, which version and which period.

Who needs C5

• German federal authorities. The BSI says compliance with the catalogue is required when they buy cloud services to process official data, under its minimum standard for external cloud services.
• German healthcare. Section 393 of the fifth book of the Social Code, SGB V, came into force on 1 July 2024 and requires a C5 attestation or comparable certificates when cloud services are used in the health sector. The health ministry, not the BSI, interprets that law.
• Private companies. The catalogue is a recommendation for everyone else. A customer can still write it into a contract.

If none of these apply, ISO 27001 or a SOC 2 report may be what your buyer asks for instead. ISO 27001 vs SOC 2 compares those two.

What C5:2026 changes

The BSI has published the final C5:2026. It builds on C5:2020, aligns with the draft European cloud scheme EUCS at level Substantial, and takes ISO/IEC 27001:2022, the CSA Cloud Controls Matrix 4 and NIS2 into account. New topics include container management, supply chain, post-quantum cryptography, confidential computing, tenant separation and how sovereignty is put into practice. Each criterion now has sub-criteria, and the catalogue is also published as YAML files for the first time.

Most reports you'll see in 2026 still use C5:2020. That's expected: the new version applies to Type 1 reports dated after 1 June 2027 and to Type 2 periods that start on or after that date.

Clouds that state a C5 attestation

Each line comes from the provider's own page, checked on 10 November 2026. Hetzner, a German host, is in the table for comparison only. Scope changes with every audit, so ask for the current report before you sign.

The hyperscalers

AWS, Microsoft and Google each publish a C5 attestation that covers a long list of services. AWS also says its new European Sovereign Cloud, generally available since January 2026 and separate from its other regions, has its own C5 report on the design of its controls. An attestation doesn't change who owns the provider: all three are US companies, which matters for the questions covered in EU region vs EU company.

IONOS

IONOS is headquartered in Germany and says its cloud runs all services under German jurisdiction. It received a C5:2020 Type 1 attestation on 28 May 2026 and says it is preparing a Type 2. Its cloud is also certified to ISO 27001 on the basis of IT-Grundschutz.

STACKIT

The cloud of the Schwarz Group shows C5 and ISO 27001 seals on its certificates page. The page doesn't say which C5 version or report type, so ask its sales team.

Exoscale

Exoscale is a Swiss cloud, part of A1 Digital, with zones in Germany, Austria, Switzerland, Bulgaria and Croatia. It states a C5:2020 Type 2 attestation and points to German health data hosting as one use for it.

OVHcloud and T Cloud Public

OVHcloud says it meets every requirement of the catalogue according to its most recent report, and that customers can request its certifications and reports. T Cloud Public, called Open Telekom Cloud until January 2026, is run by T-Systems with data centers in Germany and the Netherlands and says it meets the C5 criteria. Neither page names the version or report type.

Before you rely on a C5 claim

1. Ask for the report itself. A logo isn't evidence, and the BSI says there is no official C5 logo.
2. Match the scope. Check that the exact services and regions you'll use are in the report.
3. Check type, version and period. Type 2 over a recent period is stronger than a Type 1 on a past date.
4. Read the general conditions. C5 reports must disclose data location, jurisdiction, subcontractors and how the provider handles requests from authorities. For a sovereignty review, that section is often the most useful one.
5. Cover your own layer. Microsoft says plainly that you need your own C5 attestation for components built on top of its services. The same holds for any platform or app you run on an attested cloud.

Where Eurobase stands

Eurobase doesn't hold a C5 attestation. Its ISO 27001 and SOC 2 work is in progress, and neither is held yet. If a German authority, a health insurer or a hospital needs C5 for the service you'll use, pick a provider from the table above.

For other teams, Eurobase is a business registered in Warsaw, Poland, that deploys web apps from Git or from coding agents through its MCP server and CLI, on European infrastructure run by Scaleway, a French provider. Plans are free, €10 or €20 a month + VAT per workspace. There are no usage charges today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving. Connecting GitHub or GitLab adds a US subprocessor, GitHub or GitLab Inc., and the subprocessor list names every other one.

Frequently asked questions

Is BSI C5 a certification?

No. The BSI says there is no certification procedure for C5, so there are no C5 certificates. A public accountant audits the service and issues an attestation with a report addressed to the provider's customers.

Is C5 mandatory in Germany?

For federal authorities buying cloud services for official data, yes. In healthcare, Section 393 SGB V requires a C5 attestation or comparable certificates. For other companies it's voluntary unless a customer contract asks for it.

Does the BSI publish a list of C5 attested clouds?

No. Providers decide for themselves whether to publish their attestations, so the BSI says it can't keep a complete list. Ask the provider for its current report.

What's the difference between C5 and ISO 27001?

ISO 27001 certifies a management system for information security. C5 attests that a specific cloud service meets a catalogue of criteria, and its report adds transparency on data location, jurisdiction and subcontractors. The BSI publishes a cross-reference table between the two.

Does hosting on a C5 attested cloud make my app compliant?

No. The attestation covers the provider's services. Anything you or a platform builds on top needs its own controls and, if your buyer asks, its own audit.

Sources

• BSI: C5 criteria catalogue
• BSI: C5 FAQ
• BSI: C5 introduction
• BSI: C5:2026 and C5:2020
• AWS: C5
• Microsoft: C5 compliance offering
• Google Cloud: BSI C5:2020
• IONOS Cloud
• STACKIT: certificates
• Exoscale: BSI C5
• OVHcloud: C5
• T Cloud Public: data security
• Hetzner: certificates
• Eurobase: agents and Eurobase subprocessors