SAP Cloud Platform is a Business Application Platform-as-a-Service (PaaS) offering. It enables SAP, its partners and customers to develop, deploy, run, operate, and use applications in a cloud environment.

Additionally, SAP provides and operates Software-as-a-Service (SaaS) solutions on SAP Cloud Platform. Those also leverage the SAP Cloud Platform management system and operational controls. Therefore, everywhere in this system description where referred to SAP Cloud Platform, all services, tools, applications, SaaS solutions, part of or running on SAP Cloud Platform, are included as described in the chapter Service Overview.

SAP Cloud Platform is a product implemented by SAP, and as such, it follows SAP’s Secure Development Lifecycle framework for product and solution creation, certified with ISO 9001:2015 and ISO 27001:2013.

SOC1 reports specifically address service organizations internal control over financial reporting and controls specified by the service provider. The SOC1 reports are intended solely for the information and use of existing user entities (for ex. Existing customers of the service organization), their financial statement auditors and management of the service organization. SOC 1 reports are prepared in accordance with Statement on Standards for Attestation Engagements (SSAE) No.18, a new guidance that the auditors use to conduct a SOC1 engagement. SOC1 Type 1 covers management’s description of a service organization’s system and the suitability of the design of controls at a specific point in time, whereas a SOC1 Type 2 also includes the operating effectiveness of controls for a dedicated period of time.

SAP Cloud Platform has regularly prepared SOC2 Type 2 audit reports by an independent 3rd party accountant. This version of the report covers the audit period 1. November 2019 to 30. April 2020, the location St. Leon–Rot (Germany) and Colorado Springs (Colorado, USA) as well as in the co-location data centers:

The use of these reports is restricted. A copy of this report is available for all SAP Cloud Platform customers who had productive and had financially-relevant systems during the audit period covered by the report.

SAP Cloud Platform SOC1 Type 2 report covers within audit period the following services: