it-sa 2026: the questions IT decision-makers asked at our booth

From 27 to 29 October we were at the it-sa IT security trade fair in Nuremberg, in hall 7A at booth 7A-216. Most conversations were about the conditions for using a service: where data is processed, who stays in control and what evidence an internal review needs.

it-sa kept growing. According to the organiser Nürnberg Messe, more than 33,000 trade visitors from over 70 countries came to Nuremberg this year, around 20 percent more than the year before. For the first time, more than 1,000 companies exhibited, 1,005 in total. According to trade press reports, two topics dominated the halls: security for AI and digital sovereignty. Both came up again and again at our booth too.

We collected the questions from our conversation notes. They came from IT managers, information security officers, public administrations and IT service providers; we leave out names and companies. At the end we add four questions that belong in every choice of cloud provider, and answer them for ourselves.

With AI, the place of processing comes first

At it-sa we showed SecureCloud kAI in public for the first time, the AI assistant for your whole team. Almost every conversation about kAI started with the question of where the model runs and who operates it.

SecureCloud operates the platform in Germany. In each chat you choose between models from Anthropic, OpenAI, Alibaba, Z.ai and DeepSeek, and for every model kAI shows who operates it and where it runs. The open models run with European operators in the EU, one of them, according to the provider, at IONOS in Berlin. Claude and GPT run in EU regions of AWS and Microsoft Azure and carry the label "EU region, US company" in the product.

One visitor from manufacturing told us that AI is barely allowed in their company because engineering know-how must not leave the house. For this case your IT decides per group which models are available and can switch off the models of US companies. kAI also only searches what the signed-in person may open themselves, and every answer from your documents names its source. More in our article on the launch of SecureCloud kAI.

kAI connects further systems only after your IT approves them

IT service providers and software vendors asked which systems kAI can connect to. As a tool, kAI works in SecureCloud, Microsoft 365, Slack and Atlassian with Jira and Confluence, always with the personal account of the person using it.

Your IT approves further integrations such as HubSpot or GitLab, and new source types stay locked until then. This way your IT decides which data kAI may access.

NIS2 requires evidence, from cloud providers too

Several visitors came with questions about NIS2, the EU directive on cybersecurity for essential and important entities. Germany's implementing act has applied since December 2025 and rewrote the German BSI Act (BSIG). Entities in scope must manage risks, report security incidents and register with the Federal Office for Information Security (BSI).

The measures listed in section 30 BSIG explicitly include supply chain security, which covers service providers such as a cloud provider. The duties stay with the entity itself. A cloud service supports them with evidence for their own documentation.

SecureCloud GmbH is ISO/IEC 27001 certified (TÜV Rheinland) and BSI C5 attested (C5 is the German government's cloud security catalogue). This evidence applies to our existing cloud services. kAI, as a new service, does not have an attestation of its own yet. Our compliance page shows what evidence you get from us.

The virus scan checks files on the server

A visitor from public administration asked how stored files are checked for malware. In the Enterprise edition, SecureCloud scans stored files on the server at regular intervals, using the G DATA scan engine. On request, the scan also checks files at upload through the web interface and through file requests; our support team enables this.

Every finding is logged. Designated administrators can receive an email and decide whether the file is removed or released. Details are in our help article on virus protection (in German).

Sign-in runs through Microsoft Entra ID

Teams that manage many accounts asked about single sign-on with Microsoft Entra ID. SecureCloud supports sign-in through Entra ID via SAML. Your IT creates an enterprise application and assigns the permitted users and groups to it.

On request, SecureCloud creates users from a chosen Entra ID group automatically. Anyone who leaves the group is deactivated. Setup is described in our help article on Entra ID (in German).

Two desktop apps lead from the file server to the cloud

Several teams still work with their own file server and folders that have grown over the years. They wanted to know what daily work at the desk looks like after the move to the cloud.

There are two desktop apps for this. The sync client keeps selected folders as a local copy on the computer, so the files stay available without an internet connection. The drive client mounts SecureCloud as a network drive and stores no files on the computer, but it needs a permanent connection. Both can run side by side; our help article on the clients (in German) explains the differences.

We recommend cleaning up the folder structure before the move and deciding which group should see which library. The permissions then carry over to the cloud cleanly.

External partners work with you through a protected link

Many teams exchange files with contractors, assessors or clients who have no account of their own. For them you create a download link, an upload link or, for folders, both in one link in SecureCloud. You can protect every link with a password and give it an expiry date. If you only want to show documents, allow preview only. Our help article on sharing with external people (in German) explains how.

If your team still sends files as email attachments, the Outlook add-in helps. It inserts a share link directly into the email and, if you want, turns attachments above a set size into links automatically. Which liability questions arise when confidential files travel by email is the subject of our article on liability for sending files by email.

Qualified e-signatures run directly in SecureCloud

Several conversations were about electronic signatures, from requests for qualified signatures to fitting them into existing workflows. With the SecureSign add-on you sign documents directly in SecureCloud, at the advanced or qualified level under the EU eIDAS Regulation.

For the qualified electronic signature (QES), SecureSign works with a qualified trust service provider from the EU trusted list. You prove your identity remotely by video, with an ID document and a one-time code, and qualified timestamps are available. Under Article 25 of the eIDAS Regulation, a QES has the same legal effect as a handwritten signature. Where German law still requires paper is covered in our article on SES, AdES and QES in Germany. The full feature set is on our SecureSign page.

We name customers only with their consent

Public administrations also asked whether authorities already work with SecureCloud. We name customers only when they have agreed to it. In a conversation we are happy to go through the requirements of public-sector clients.

Why cloud projects in public authorities fail and what helps is the subject of our article on how public authorities introduce secure cloud storage.

Four questions belong in every choice of cloud provider

We add these questions ourselves. At the booth they came up only in passing, yet they matter for a decision. Here we answer them for SecureCloud.

1. Which law is the provider subject to? SecureCloud GmbH is a German company without a US parent, and your files in SecureCloud are stored in German data centers. What recent case law means for data transfers to the US is covered in our article on the EU-US Data Privacy Framework.
2. Who holds which certificate, and for what? SecureCloud GmbH holds its ISO/IEC 27001 certificate itself, audited by TÜV Rheinland. BSI C5 is an attestation issued by independent auditors. The certificates of our data centers belong to their operators.
3. Is there a data processing agreement? For SecureCloud, the data processing agreement (DPA, in German AVV) is included. For kAI, the template is in preparation.
4. Can you trace and undo what happens to files? In the Advanced and Enterprise editions, roles and an audit log record who did what. You can restore deleted or changed files for 90 days, for 365 days in Advanced and Enterprise, earlier versions included.

A demo answers the questions that are still open

If you had no time at the booth or a question stayed open, we show you kAI and SecureCloud on a workflow from your own organisation. Request a demo.

Already a SecureCloud customer? Book your kAI demo directly in our calendar for existing customers.

FAQ on the questions from it-sa 2026

Where does SecureCloud kAI process my data?

SecureCloud operates the platform in Germany. The models run in the EU, one in Berlin according to the provider. Claude and GPT run in EU regions of AWS and Azure and can be switched off per group.

Does SecureCloud help with NIS2 obligations?

The duties stay with the company. SecureCloud provides supply chain evidence: ISO/IEC 27001 certified (TÜV Rheinland) and BSI C5 attested, for the existing cloud services.

Does SecureCloud include a virus scan?

Yes, in the Enterprise edition. SecureCloud scans stored files regularly with the G DATA engine and, on request, already at upload through the web interface.

Can I sign with a qualified electronic signature in SecureCloud?

Yes, with the SecureSign add-on. It supports advanced and qualified signatures under eIDAS, the QES through a qualified trust service provider with video identification.

How do I share files with external people who have no SecureCloud account?

With a download link, an upload link or, for folders, both in one link, optionally with a password and expiry date, or as preview only.

How much does SecureCloud kAI cost?

We quote the price by scope. A monthly AI allowance per person is included, additional use is billed, and your IT sets limits.