GDPR-compliant monitoring & availability evidence for health tech

Why monitoring is a compliance topic in healthcare

Legal groundwork & sources: NIS2 Directive (EU) 2022/2555 and, for Germany, the BSIG 2025 (national transposition, in force since 6 Dec 2025 — availability and reporting duties in § 30).

Does NIS2 require software vendors to monitor availability?

NIS2 does not mandate a specific tool, but it does demand demonstrable continuity of operations (in Germany: § 30 Abs. 2 Nr. 3 BSIG). This is exactly where classic compliance tooling ends: GRC and ISMS platforms document policies and measures — they do not measure whether your service was actually reachable. Continuous monitoring supplies that availability evidence.

Am I in NIS2 scope as a software vendor?

You are directly in scope if you not only ship software but also operate it — as a SaaS, cloud, or managed-service provider — and you reach the size thresholds (in Germany: at least 50 employees or more than €10M revenue and balance-sheet total, § 28 BSIG). "Software manufacturer" alone is not a NIS2 sector. The more common case is the second one: you are not directly in scope, but your NIS2-regulated clinic and practice customers must secure their supply chain and pass the duty down to you contractually — through security requirements, audits, and availability evidence. NIS2 then reaches you through the market, not the regulator. The exact classification must be assessed case by case.

The availability pressure healthcare generates

Germany's telematics infrastructure (TI) shows where regulated healthcare is heading: gematik defines binding service levels with availability targets for TI services, measured monthly through central TI monitoring — with contractual penalties for missing them. Through the NIS2 supply-chain duty, that availability pressure propagates down to supplying software vendors across the EU. Continuous monitoring provides the evidence that your systems hold up to that standard.

Source: gematik — TI operations guideline (service levels).

What FoundersDeck brings

• 100% German infrastructure. All monitoring data exclusively in Nuremberg (Netcup), never outside the EU.
• Instant DPA. Data Processing Agreement under Art. 28 GDPR for direct download — no sales call.
• NIS2 support (§ 30 BSIG). Availability monitoring and automatic incident detection as the basis for your reporting and evidence duties.
• BSI-Grundschutz mapping. Availability and incident data that maps onto BSI-Grundschutz requirements.
• Sub-processor transparency. Openly documented, EU-centred supply chain — auditable.
• Cookie-free status pages. Public availability evidence without tracking that you can show your clinic customers.

For health-tech vendors

You operate software for practices or clinics?

Your clinic and practice customers expect availability — and increasingly, proof of it. With FoundersDeck you monitor your own platform (web app, API, workers, nightly backups), publish a cookie-free status page, and keep a complete incident history that supports your NIS2 and DPA evidence toward those customers — all on German infrastructure.

For clinics & practices

Keep the availability of patient-facing systems in view

Monitor practice and clinic applications, portals, and interfaces from German infrastructure and get alerted the moment a system becomes unreachable. No cookies, no US cloud service, no CLOUD Act — monitoring that fits the requirements for handling patient data.

What regulated buyers check

From our own survey (EU Jurisdiction Database, 57 developer tools checked): only 7 of 57 offer a Data Processing Agreement for instant download — FoundersDeck is one of them.

FoundersDeck vs. US monitoring tools for regulated buyers

For healthcare buyers the decisive axis is not the feature list but legal control over the monitoring data:

Full jurisdiction analysis of 57 tools: EU Jurisdiction Database.

Compliance engagement

For vendors and organizations with real evidence obligations. Priced by need, not by monitor count.

Reports, NIS2 incident support, and BSI mapping are provided as part of the engagement — not as self-service modules.

Further resources

Deeper analyses of the legal and technical questions regulated healthcare buyers examine:

• Why your monitoring data shouldn't leave the EU — Schrems II, CLOUD Act, and GDPR scope
• US CLOUD Act & FISA 702: why US-hosted monitoring tools are a risk for health data
• The 5-minute GDPR check EU buyers run on SaaS vendors
• Best GDPR-compliant uptime monitoring tools 2026 — EU-hosted, jurisdiction-checked
• NIS2 for medical-software vendors — availability and reporting duties (German)
• Availability evidence for DiGA — what ISMS and GRC tools don't cover (German)
• EU Jurisdiction Database — 57 tools by jurisdiction & CLOUD Act exposure

Frequently asked questions

Does FoundersDeck help with NIS2 implementation in healthcare?

FoundersDeck supports your NIS2 obligations by continuously monitoring the availability of your services, automatically detecting and classifying incidents, and keeping a complete incident history. That data is a foundation for your availability and incident-reporting duties under the NIS2 Directive (EU) 2022/2555 — in Germany transposed as § 30 BSIG. Organizational NIS2 compliance remains your company’s responsibility; FoundersDeck supplies the technical evidence.

Do I get a Data Processing Agreement (DPA)?

Yes. The DPA under Art. 28 GDPR is available for immediate download — no sales call required. That lets you embed FoundersDeck cleanly as a sub-processor in your own data-processing chain toward clinics and practices.

Where is the monitoring data stored?

Exclusively in Nuremberg, Germany, on infrastructure operated by Netcup GmbH. No monitoring data leaves the EU. FoundersDeck is a German company and is not subject to the US CLOUD Act or FISA 702.

Is this suitable for patient data?

FoundersDeck monitors the reachability and availability of your systems — it does not access or store patient data. What is observed: endpoints, response times, and status codes. The cookie-free status pages contain no tracking. Monitoring therefore fits the requirements for handling sensitive systems without becoming an additional data source itself.

How does this differ from the regular FoundersDeck tiers?

The product is the same; the Compliance engagement additionally bundles the artifacts regulated buyers need for audits: DPA, availability and incident evidence as reports, support with NIS2 incident reporting, BSI-Grundschutz mapping, and direct founder support. These deliverables are provided as part of the engagement, not as self-service modules.