Demo Cloud d.o.o.
Trust Center
OverviewCertificatesRegulationsSecurity controlsPrivacySubprocessorsDocumentsFAQAsk your AIAI assistant (MCP)Contact
Questionnaire
© Demo Cloud d.o.o.
Powered byIVERIOS
Demo Cloud d.o.o.
Trust Center
Demo trust center with sample content.Create your free trust center

Demo Cloud d.o.o. · Trust Center

Secure, resilient e-invoicing and document workflows — built and run in the EU

Demo Cloud d.o.o. (Zagreb, Croatia) provides a SaaS platform for e-invoicing (Croatian Fiscalization 2.0, EN 16931, Peppol), a compliant document archive and approval workflows to more than 1,200 business customers in Croatia, Slovenia and Austria.

Security and resilience are managed through an integrated management system certified to ISO/IEC 27001:2022, ISO 22301:2019 and ISO 9001:2015. All customer data is hosted and processed exclusively in the European Union, encrypted in transit and at rest, and protected by 24/7 monitoring. Platform availability over the last 12 months was 99.98 %.

Every year we commission an independent penetration test (2026: no critical or high findings), run weekly vulnerability scans, and test disaster recovery and business continuity. Approved visitors can download the redacted reports, test records and evidence of control implementation.

Demo Cloud d.o.o. is a fictional company. All information on this page is illustrative sample data showing what an IVERIOS Trust Center can contain.

  • ✓ ISO/IEC 27001:2022
  • ✓ ISO 22301:2019
  • ✓ ISO 9001:2015

Last updated: November 8, 2026

At a glance

Certificates

  • ISO/IEC 27001:2022Certified
  • ISO 22301:2019Certified
  • ISO 9001:2015Certified
View details →

Regulations

GDPRNIS2DORAEU AI ActEU Data ActeIDAS 2ePrivacyCyber Resilience ActCroatian Fiscalization Act (Fiscalization 2.0)
View details →

Security controls

40 security controls in place

  • Organisation and governance7
  • Infrastructure security7
  • Data protection7
  • Application security6
  • Access management6
  • Incident response4
  • Business continuity3
View details →

Infrastructure

🔒 The infrastructure overview is available to approved visitors after sign-in.

Privacy

Data location:
European Union — AWS Frankfurt (Germany), disaster recovery in AWS Stockholm (Sweden)
✓ Personal data is not transferred outside the EU/EEA.
View details →

Subprocessors

6 subprocessors

Amazon Web Services EMEA SARL · Cloudflare Germany GmbH · Mistral AI SAS · Brevo SAS · Infobip d.o.o. …

View details →

Documents

5 public documents · 5 available after sign-in

View details →

FAQ

  • › Where is our data stored?
  • › Which certifications do you hold?
  • › When was the last penetration test and what were the results?
View details →

Contact

security@demo-cloud.exampleView details →

🔒 Available after sign-in and approval

Approved customers and partners get access to:

  • 📄 Additional security and compliance documents (e.g. audit reports, policies)
  • 🗺 Infrastructure overview
  • 💬 AI assistant for questions about security and compliance
  • 📋 Automatic completion of your security questionnaires
Request accessAlready approved? Sign in

Certificates

ISO/IEC 27001:2022
CertifiedValid until February 9, 2028
Issued by:
Certa Assurance d.o.o.
Accreditation:
HAA (Croatian Accreditation Agency)
Issued:
February 10, 2025
Scope

Information security management system for the design, development, operation and support of the Demo Cloud e-invoicing, document archive and workflow SaaS platform, including the Peppol access point, delivered from the Zagreb office and EU cloud infrastructure. Statement of Applicability v4.2.

↓ Certificate (PDF)
ISO 22301:2019
CertifiedValid until June 1, 2028
Issued by:
Certa Assurance d.o.o.
Accreditation:
HAA (Croatian Accreditation Agency)
Issued:
June 2, 2025
Scope

Business continuity management system for the provision of the Demo Cloud SaaS platform and customer support, including disaster recovery of the production environment between two EU cloud regions.

↓ Certificate (PDF)

Regulations

GDPRApplies

Demo Cloud acts as a processor for customer data and as a controller for its own business data. Processing is governed by a data processing agreement (Art. 28) with audit rights and a published list of subprocessors; records of processing activities are maintained; a data protection officer is appointed; DPIAs are performed for new high-risk processing. Data subject requests are supported in the platform and handled within 30 days.

NIS2Applies

Demo Cloud is an important entity under the Croatian Cybersecurity Act implementing NIS2 (cloud computing service provider). Risk-management measures under Art. 21 are covered by the ISO/IEC 27001 ISMS; significant incidents are notified to the national CSIRT within 24 hours (early warning) and 72 hours (notification); management completes annual cybersecurity training.

DORAApplies

For customers in the financial sector Demo Cloud is an ICT third-party service provider. Contracts include the Art. 30 provisions (service levels, data location, audit and access rights, incident support, exit strategy and termination assistance). We support customers' threat-led and resilience testing and provide our DR and BC test results.

EU AI ActApplies

The platform uses AI only for data extraction from incoming invoices (a limited-risk use). Users are informed when content is AI-generated, every extracted value can be reviewed before posting, models are hosted in the EU and customer data is not used to train models. An AI use policy and inventory of AI systems are maintained.

Security controls

Organisation and governance

  • ✓Information security management system and policiesISMS certified to ISO/IEC 27001:2022; 24 policies approved by the Management Board and reviewed annually; a CISO reports directly to the CEO; the security committee meets monthly.
  • ✓Information security risk assessmentRisk assessment of all assets and suppliers at least yearly and on major changes; risks above appetite require a treatment plan owned by a board member; the risk register is reviewed quarterly.
  • ✓Security awareness training for employeesTraining at onboarding and annually (100 % completion in 2026), monthly phishing simulations (click rate 1.8 % in Q3 2026) and role-specific secure coding training for developers.
  • ✓Background checks and confidentiality agreements for staffBackground checks before hiring for all roles, confidentiality agreements for employees and contractors, and a documented disciplinary process.
  • ✓Supplier and third-party risk managementSuppliers with access to customer data are assessed before onboarding (security questionnaire, certifications, DPA) and reviewed annually; all are located in or contractually restricted to the EU/EEA.
  • ✓Internal audits and management reviewAnnual internal audit programme across ISO/IEC 27001, ISO 22301 and ISO 9001; management review twice a year; external certification and surveillance audits without nonconformities in 2025 and 2026.
  • ✓AI use policyAn AI use policy defines approved AI systems, EU hosting, no training on customer data, human review of extracted values and an inventory of AI systems.

Privacy

Demo Cloud processes personal data contained in invoices and documents on behalf of its customers (as a processor) under a data processing agreement. We process only what is needed to provide the service, never sell data and do not use customer data to train AI models.

Categories of data: contact and identification data of customer users; business contact data of invoice issuers and recipients; content of documents uploaded by customers. Security measures are described in the security controls section and in the DPA annex.

Data location
European Union — AWS Frankfurt (Germany), disaster recovery in AWS Stockholm (Sweden)
Data protection officer
dpo@demo-cloud.example
Privacy policy
demo-cloud.example/privacy ↗

International data transfers

✓ Personal data is not transferred outside the EU/EEA.

Subprocessors

NamePurposeLocationTransfer
Amazon Web Services EMEA SARLCloud hosting, storage and backupsGermany (Frankfurt), Sweden (Stockholm)EU/EEA – no transfer
Cloudflare Germany GmbHCDN, DDoS protection and web application firewall (EU data localisation)EUEU/EEA – no transfer
Mistral AI SASAI extraction of invoice data (hosted in the EU, no training on customer data)FranceEU/EEA – no transfer
Brevo SASTransactional e-mail notificationsFranceEU/EEA – no transfer
Infobip d.o.o.SMS notifications and one-time codesCroatiaEU/EEA – no transfer
Datadog France SASApplication and infrastructure monitoring (EU site)GermanyEU/EEA – no transfer

Documents

Certificates

  • PDF
    ISO 22301:2019 certificate
    67 kB · Valid until June 1, 2028
    ↓ Download
  • PDF
    ISO 9001:2015 certificate
    67 kB · Valid until October 14, 2027
    ↓ Download
  • PDF
    ISO/IEC 27001:2022 certificate
    68 kB · Valid until February 9, 2028
    ↓ Download

Security overview

  • PDF
    Security and Compliance Overview 2026
    71 kB
    ↓ Download

Policies

FAQ

›Where is our data stored?

Exclusively in the European Union: production in AWS Frankfurt (Germany) and disaster recovery copies in AWS Stockholm (Sweden). No customer data is transferred outside the EU/EEA.

›Which certifications do you hold?

ISO/IEC 27001:2022 (information security), ISO 22301:2019 (business continuity) and ISO 9001:2015 (quality), issued by an accredited certification body. The certificates can be downloaded in the Documents section.

›When was the last penetration test and what were the results?

In March 2026 by an independent CREST-accredited company: 0 critical, 0 high, 2 medium and 4 low findings. All findings were remediated and verified by a retest in April 2026. The redacted report is available to approved visitors.

›What are your RPO and RTO?

RPO 15 minutes and RTO 4 hours. In the full regional failover test in May 2026 we achieved an RTO of 1 hour 47 minutes and an RPO of 6 minutes.

›How quickly will we be informed about a security incident?

Customers are informed of personal data breaches without undue delay, at the latest within 24 hours of confirmation, with regular updates until resolution.

›Do you use our data to train AI models?

No. AI is used only to extract data from incoming invoices, models run in the EU, and customer data is never used for training.

Ask your AI assistant about us

Copy this message into ChatGPT, Claude, Gemini or another AI assistant — it will read our published security information and answer your questions.

Read https://trust.iverios.eu/demo/llms.txt and summarise the security and compliance of Demo Cloud d.o.o.: certifications, regulations, security controls, data location and sub-processors. Then answer my questions using only that information.

Connect your AI assistant

Let your AI assistant (Claude, ChatGPT or another MCP client) look up information from this trust center directly. Access is read-only and every request is logged.

With sign-in (approved visitors)

Everything you can see after signing in. Your assistant will ask you to sign in and allow access.

https://trust.iverios.eu/demo/mcp
Sign in for access to everything available to approved visitors.

Without sign-in

Public information only.

https://trust.iverios.eu/demo/mcp/public
  • Claude: Settings → Connectors → Add custom connector → paste the address, then enable the connector in your chat.
  • ChatGPT: Settings → Connectors → Advanced → Developer mode, then Create → paste the address (for the public address choose no authentication).
  • Claude Code: claude mcp add --transport http demo https://trust.iverios.eu/demo/mcp/public

Contact

Questions about security or a possible vulnerability? Contact us.

Security contact: security@demo-cloud.exampleReport a vulnerability ↗
© Demo Cloud d.o.o.
Powered byIVERIOS
ISO 9001:2015
CertifiedValid until October 14, 2027
Issued by:
Certa Assurance d.o.o.
Accreditation:
HAA (Croatian Accreditation Agency)
Issued:
October 15, 2024
Scope

Quality management system for software development, implementation services and customer support of the Demo Cloud platform.

↓ Certificate (PDF)
EU Data ActApplies

Customers can export all their data at any time in open formats (UBL/XML, PDF, CSV) via the interface and API; switching assistance and a 30-day transition period are part of the contract; no switching charges apply.

eIDAS 2Applies

Qualified electronic seals and time stamps for archived documents are obtained from qualified trust service providers listed on the EU Trusted List; the platform validates qualified signatures on incoming documents.

ePrivacyApplies

The website and application use only strictly necessary cookies by default; analytics cookies are set only after consent; no marketing trackers are used in the application.

Cyber Resilience ActDoes not apply

Demo Cloud provides a remote data processing service (SaaS) and does not place products with digital elements on the market; secure development practices nevertheless follow the CRA essential requirements.

Croatian Fiscalization Act (Fiscalization 2.0)Applies

The platform is a registered information intermediary for e-invoice exchange and fiscalization reporting to the Croatian Tax Administration, using EN 16931 and Peppol BIS Billing 3.0; reporting is monitored and failures are retried automatically.

Infrastructure security

  • ✓Certified data centres and physical securityProduction runs on AWS in Frankfurt (Germany) with disaster recovery in Stockholm (Sweden); data centres are ISO/IEC 27001 and SOC 2 certified. The Zagreb office uses badge access, CCTV and visitor logs; no customer data is stored in the office.
  • ✓Network segmentation and firewallsSeparate cloud accounts and private networks for production, staging and corporate IT; deny-by-default security groups; databases have no internet exposure; administrative access only through a zero-trust access gateway.
  • ✓DDoS protection and web application firewallAll public endpoints are behind a CDN with always-on DDoS protection and a managed web application firewall (OWASP rule set, bot protection and rate limiting).
  • ✓Vulnerability and patch managementWeekly authenticated internal and external vulnerability scans; remediation SLAs of 72 hours (critical), 7 days (high) and 30 days (medium) — 100 % within SLA in 2026; operating system patches applied within 14 days; container images rebuilt weekly.
  • ✓Endpoint protection (EDR / anti-malware)Managed EDR on all company laptops and servers (100 % coverage), full-disk encryption, automatic OS updates and mobile device management; unmanaged devices cannot access company systems.
  • ✓Centralised logging and security monitoringApplication, infrastructure, identity and cloud audit logs are centralised in a SIEM with 24/7 monitoring by a managed SOC; security logs are retained for 13 months and are tamper-protected.
  • ✓Secure configuration and hardeningInfrastructure is defined as code and reviewed; CIS benchmarks are applied to images; cloud configuration is continuously checked by a CSPM tool and deviations are fixed within 7 days.

Data protection

  • ✓Encryption of data at restDatabases, file storage and backups are encrypted with AES-256; each customer's archive uses a separate data key.
  • ✓Encryption of data in transitTLS 1.2+ (TLS 1.3 preferred) for all external connections with HSTS; internal service-to-service traffic uses mutual TLS; A+ rating on public TLS endpoints.
  • ✓Cryptographic key managementKeys are managed in a cloud key management service backed by hardware security modules; automatic yearly rotation; access to keys is limited to services and logged.
  • ✓Backups and restore testingContinuous database backups with point-in-time recovery (15-minute RPO), daily encrypted copies to a second EU region retained for 35 days, immutable monthly copies retained for 12 months; restore tests every month.
  • ✓Data classification and handlingFour classification levels (public, internal, confidential, restricted) with handling rules; customer data is always classified as restricted.
  • ✓Data retention and secure deletionRetention follows the customer's settings and legal archiving periods; after contract termination data is exported to the customer and deleted within 30 days, including backups by rotation; deletion is confirmed in writing.
  • ✓Logical separation of customer dataStrict tenant isolation enforced by row-level security in the database and per-tenant encryption keys; isolation is covered by automated tests and the annual penetration test.

Application security

  • ✓Secure software development lifecycleSecurity requirements and threat modelling for new features, secure coding guidelines based on OWASP ASVS level 2, and a security champion in every development team.
  • ✓Code review and automated security testing (SAST/DAST)Every change requires peer review and passes SAST, secret scanning and dependency checks in the CI pipeline; DAST runs against staging before each release.
  • ✓Independent penetration testingAnnual penetration test by an independent CREST-accredited company covering the web application, API, Peppol access point and cloud configuration; 2026 test: 0 critical, 0 high, 2 medium and 4 low findings, all remediated and verified by retest.
  • ✓Dependency and software supply chain securitySoftware bill of materials for every release, automated dependency updates, pinned and signed container images, and vulnerability alerts on all repositories.
  • ✓Change management and separate environmentsSeparate development, staging and production environments; deployments only through the CI/CD pipeline after approval; production data is never used in test environments.
  • ✓Peppol access point securityThe certified Peppol access point uses PKI certificates issued by OpenPeppol, mutual TLS and message-level signing; certificate expiry is monitored.

Access management

  • ✓Single sign-on and multi-factor authenticationAll employees use single sign-on with phishing-resistant MFA (FIDO2 security keys); customers can enforce SSO (SAML/OIDC) and MFA for their users.
  • ✓Least privilege and role-based accessRole-based access with least privilege; no standing access to production data — access is granted just in time for a limited period with a ticket and approval.
  • ✓Periodic access reviewsAccess to all systems is reviewed quarterly by system owners; the Q3 2026 review covered 100 % of accounts and removed 7 unnecessary permissions.
  • ✓Privileged access managementAdministrative actions go through a privileged access gateway with session recording; break-glass accounts are sealed, monitored and tested twice a year.
  • ✓Password policyPasswords of at least 14 characters checked against known breached passwords; no forced periodic changes; MFA mandatory for all employee accounts.
  • ✓Timely removal of access on leavingAccess is removed automatically from the HR system on the last working day (median 2 hours in 2026); offboarding is verified in the quarterly access review.

Incident response

  • ✓Incident response planDocumented incident response plan with roles, severity levels and playbooks (ransomware, data leak, account compromise); tested at least twice a year.
  • ✓Customer notification of breaches (timeframe)Customers are notified of personal data breaches without undue delay and at the latest within 24 hours of confirmation; significant incidents are reported to the national CSIRT under NIS2.
  • ✓Vulnerability disclosure / bug bounty programmePublic vulnerability disclosure policy with safe harbour and security.txt; reports are acknowledged within 2 business days.
  • ✓Post-incident reviewBlameless post-incident reviews within 10 business days with tracked corrective actions; summaries of customer-impacting incidents are shared with affected customers.

Business continuity

  • ✓Business continuity plan and testingBusiness continuity management certified to ISO 22301; business impact analysis updated yearly; continuity exercises twice a year (2026: tabletop and live exercise, both successful).
  • ✓Disaster recovery with defined RPO/RTODocumented DR plan with RPO 15 minutes and RTO 4 hours; full regional failover test in May 2026 achieved RTO 1 h 47 min and RPO 6 min.
  • ✓Redundancy and high availabilityAll production components run across three availability zones with automatic failover; 99.98 % measured availability over the last 12 months (SLA 99.9 %).
  • PDF
    Information Security Policy (summary)
    71 kB
    ↓ Download
›Can we export our data and leave?

Yes. All data can be exported at any time in open formats (UBL/XML, PDF, CSV). On termination we provide a 30-day transition period and delete all data within 30 days, confirmed in writing.

›Are you subject to NIS2 and DORA?

Yes. We are an important entity under the Croatian Cybersecurity Act (NIS2) and support financial-sector customers as an ICT third-party service provider under DORA, including the required contractual provisions and test results.