Security for your supply chain.
If your company falls under NIS-2, you also have to keep an eye on the security of your direct service providers. This page explains what we measurably do, which documents you receive from us and whom you reach in case of a security incident.
What NIS-2 requires of you.
In Germany the NIS-2 directive has applied since 6 December 2025 through the amended BSI Act. Entities in scope must implement risk management measures – explicitly including supply chain security, i.e. the security-related aspects of their relationships with their direct suppliers and service providers (section 30 (2) no. 4 BSIG).
If your website, mailbox or server runs with us, we are such a service provider. You then need answers to three questions: what does the provider do for security? What is agreed in the contract? Who gets in touch when something happens? This page answers all three.
Whether your company itself falls under NIS-2 is clarified by the BSI applicability check (in German). This page is no substitute for legal advice.
Measures that a machine checks.
Not "we take security seriously", but what runs in operation and is measured again every day. Anything that could not be measured counts as unchecked with us – never as fine.
What you receive for your documentation.
Everything you have to show your auditor or client is included at no extra charge.
| Document | Where you get it |
|---|---|
| Data processing agreement (DPA, Art. 28 GDPR) | Conclude it in the customer centre under "DPA" and save it as PDF. Version and fingerprint of the text are stored with your acceptance. |
| List of technical and organisational measures | Part of the DPA as an annex – the same measures as above, in contract wording. |
| List of sub-processors | In the DPA and in the privacy policy. If one is added, we inform you in advance and you can object. |
| Contact for security incidents | Directly with the owner – contact details below, machine-readable at /.well-known/security.txt. |
| Availability commitment and incident notices | 99.9 % availability as an annual average according to our terms; current incidents on the status page, by e-mail on request. |
| Your supplier questionnaire | Send it to us – we answer it with the information from this page and from the DPA. |
You hear it from us.
We report a personal data breach that has come to our knowledge without undue delay, with the information you need for your own notification (DPA, section 9). For NIS-2 entities the deadline for the first report to the BSI is 24 hours from awareness – which is why we do not wait for the full picture before letting you know.
The same applies the other way round: if you notice something suspicious about a service with us, reach us via the channels below. Abuse reports from third parties are recorded as a separate case and decided by a human.
kontakt@promedia24.de · Security incidents by e-mail
+49 (0) 541 – 93 93 90 19 · Mon–Fri 9 am–6 pm
An honest assessment.
- ProMedia24 is an owner-managed business and not ISO 27001 certified itself – the data centre operator is.
- We do not call ourselves "NIS-2 compliant": you remain responsible for meeting your obligations. We provide the information and documents you need from a service provider for that.
- Whatever you install on your web space or server yourself (WordPress plugins, for example) is your responsibility. With managed hosting we take care of the updates for you.
Questions about NIS-2 and the supply chain.
Do I have to list ProMedia24 as a supplier in my risk management?
Do I get the DPA even if I am not subject to NIS-2?
How quickly do you report a security incident?
Will you fill in our supplier questionnaire?
Where are the servers located?
Do you need something for your audit?
DPA in the customer centre, everything else on request – personally from the owner.
No extra charge