Security that keeps your SAP transformation under control.

Clear responsibility strengthens protection.

CUTO protects the platform and its operation. Customers manage identities, roles, approvals and the appropriate handling of exported data within their area of responsibility.

CUTO responsibility

CUTO operates the platform safeguards, restricts administrative access and manages security-relevant operating processes.

Customer responsibility

Customers assign roles deliberately, remove access that is no longer needed and protect data they export from CUTO or move into connected processes.

Identity and access stay under control.

Access follows defined roles and organisation or project boundaries. Permissions are assigned deliberately and revoked when circumstances change.

Roles and permissions

CUTO enforces roles and organisational and project boundaries so people receive only the access they need for their work.

Sign-in and identity

Authentication protects access to CUTO. Enterprise identities can be connected through single sign-on.

Single sign-on connects CUTO to the organisation's central identity provider. The supported connection depends on the agreed service scope.

Data remains protected.

CUTO encrypts data in transit and at rest. The methods used and their scope are defined for the relevant data paths.

Encryption by data path

Transport, storage and operational access are assessed separately so protection matches each data path.

Activity stays traceable.

CUTO records security-relevant activity with actor, time, action and result. Authorised roles can use the history for oversight and traceability.

Operational signals

Technical signals feed into the detection and handling of security-relevant events.

Prepared for disruption.

Backups, recovery and incident processes are part of the operating model. Responsibilities and escalation paths are defined so teams can act deliberately during disruption.

Backup and recovery

CUTO backs up data through defined procedures and tests recovery for the covered service scope.

CUTO uses documented recovery objectives for the relevant service scope. Binding values are stated in the applicable service documents.

Incident handling

CUTO detects, assesses and handles security-relevant events through defined responsibilities, escalation paths and communication processes.

Information matched to the review.

The public Security page explains the protection principles. Contract documents define binding commitments. CUTO provides detailed security and architecture materials to eligible recipients through controlled access.

Public overview

This page explains the protection principles in a form Security, Enterprise Architecture and Procurement can assess together.

Controlled access

Detailed materials are provided for a defined purpose, version and eligible audience.

Address your security questions directly.

Describe the scope of your review. CUTO will route your question to the relevant public information, contract document or controlled evidence.