--- title: "Certifications | Digital Cuisine" description: "ISO/IEC 27001:2022 and ISO 9001:2015, certified by TÜV SÜD: what is assessed, how digital cuisine puts the management system into daily practice and how we support you." url: "https://cuisine.digital/en/certifications" lang: en generated: cuisines-markdown-v1 --- Certifications # Certified. And put into practice. Our management system for information security and quality is certified by TÜV SÜD to ISO/IEC 27001:2022 and DIN EN ISO 9001:2015. Read what has been assessed, how we work with it and what it means for you. [Discuss a project](https://cuisine.digital/en/contact)[View our work](https://cuisine.digital/en/references.md) ## What is certified Our management system is certified for the scope of consulting, development and sales of content management solutions, apps and web applications. This is deliberately precise: a certificate confirms that we work according to defined rules and have this checked regularly by an external body. It is not a quality seal for an individual project. Both certificates were issued by TÜV SÜD Management Service GmbH. ISO/IEC 27001:2022 for the information security management system, registration number 12 310 67230 TMS, valid from 29 February 2024 to 27 February 2027. DIN EN ISO 9001:2015 for the quality management system, registration number 12 100 51760 TMS, valid from 6 April 2025 to 5 April 2028. Both can be verified through the TÜV SÜD certificate validity check. ## How we put the management system into practice An ISMS is not a folder opened once a year for the audit. For us, it is a working process: risks are recorded in a register with fixed identifiers, measures are tickets in Azure DevOps with owners and evidence, and policies have a version history and exactly one authoritative source. Senior management reviews the system annually in the management review, with metrics, outstanding measures and new risks. Internal audits and TÜV SÜD's annual surveillance audits check whether intentions match everyday practice. All employees complete mandatory annual training on information security, roles and permissions, and incident management, supplemented by awareness activities on topics such as phishing. New topics enter the register as soon as they become relevant: in 2026, these include regulatory requirements in the supply chain, data governance and reporting obligations. ## What we have learnt Four rules that have proved their worth over several audit cycles and that we also recommend to our customers. **One source of truth** Each controlled document is stored in exactly one place with a version history. Copies in mailboxes, local folders or AI agents' working directories are not evidence. **Evidence rather than assertions** A measure is complete when the document proving it is linked. A comment saying something is done is not enough for us or the auditor. **Risks keep their numbers** Identifiers in the risk register are never reassigned. Otherwise, the management review, action plan and tickets refer to different things. **Training is a routine, not an event** Mandatory annual training with attendance records, plus short sessions on current attack patterns. This keeps security part of daily work. ## Excellence is built in the pipeline, not in the audit A certificate says we have rules. Whether we put them into practice shows in what is delivered every day. This website is our own test bed: every release passes through a quality gate in the CI/CD pipeline before going live. The PageSpeed Insights API measures a sample across all page types on staging. The median performance score must be at least 95 on desktop and at least 90 on mobile; accessibility, best practices and SEO must score 100. If a value misses its target, there is no approval without a documented decision. We remain honest about what such a score means: Lighthouse is a lab measurement, not proof of real visitors' experience. Read how we implement visibility in search and AI answers, real loading times and measurement without cookie banners under [Visibility in search and AI answers](https://cuisine.digital/en/services/seo-geo.md), [Web performance](https://cuisine.digital/en/services/web-performance.md) and [Server-side tracking](https://cuisine.digital/en/services/server-side-tracking.md). ## What goes into every release The rules this website and our customer projects follow in daily practice. **Visible to people and machines** Structured data according to schema.org, clean landmarks, a curated llms.txt and every page also available as Markdown, so search engines and AI assistants can quote what we actually say. **Delivered at the edge** This website runs as a Next.js application on Cloudflare Workers, close to visitors worldwide, with image optimisation and bot protection at the same edge. No server of our own to go down at night. **Measurement without cookie banners** We measure reach and campaigns on the server side: server-side tracking with Google server containers or Matomo, delivered via Azure Front Door or Cloudflare Workers, with Consent Mode instead of scripts that fire before consent. This website needs no cookie dialogue at all. **Third-party systems with a budget** Every external script costs loading time and trust. We integrate third-party systems asynchronously, with caching and fallbacks, and give them a performance budget checked at the gate. ## Genedar: our own product under the same rules With Genedar, we develop and run our own platform for customers, projects, proposals and knowledge. It is built under the same ISMS as our customer projects, and this shows in the product: access by role and business area, logging of every change, defined retention periods, audit-proof storage of emails and documents, and backups with tested recovery. For us, security requirements belong in the requirements, not an addendum. This makes Genedar our best evidence that an ISMS improves products rather than holding them back. ## Measuring maturity rather than estimating it To assess the current position, we use our own maturity agent: an AI-supported questionnaire based on the MITO methodology that classifies the maturity of processes, information security and knowledge management in stages and derives concrete next steps. We use it internally to compare our ISMS over the years, and with customers at the start of an implementation or AI initiative. ## Supporting implementation, building regulated environments We advise companies on introducing an ISMS in accordance with ISO/IEC 27001: scope, risk analysis, statement of applicability, policies, training and preparation for the certification audit. We draw on the templates, processes and mistakes we have experienced ourselves, rather than theory alone. Drawing on the same experience, we develop software for regulated environments, such as applications with sensitive health data for pharmaceutical and medical technology customers: access control in accordance with BSI IT-Grundschutz, interfaces in accordance with ISO/IEC 27001 and Section 203 of the German Criminal Code (StGB), and penetration tests before go-live. One example is the LISA app for Linde. ## Certificates and tools The originals as PDFs, verification at TÜV SÜD and access to the maturity agent. [ISO/IEC 27001:2022](https://cuisine.digital/documents/iso-27001-certificate.pdf) Information security management system certificate, TÜV SÜD, PDF. [ISO 9001:2015](https://cuisine.digital/documents/iso-9001-certificate.pdf) Quality management system certificate, TÜV SÜD, PDF. [TÜV SÜD certificate validity check](https://www.tuvsud.com/de-certificate-validity-check) Check the validity of both certificates directly with the certifying body. [Maturity agent](https://reifegrad.ai-cuisine.digital/login) Sign in to the maturity agent based on the MITO methodology. ## Security is part of your project [Discuss a project](https://cuisine.digital/en/contact) Tell us about your requirements for security and evidence. [AI governance & data protection](https://cuisine.digital/en/services/ai-governance.md) Rules, inventory and evidence for AI in the enterprise. --- [Original page](https://cuisine.digital/en/certifications) · [Contact and project enquiry](https://cuisine.digital/en/contact)