Operations and assurance
Where does it run?
For requests from Germany, the server side of the map runs in Frankfurt am Main. For us, ‘sovereign’ means that map and building data is held in our data store in Frankfurt am Main, in open formats, and that we agree with you in advance what will be handed over when the contract ends. Rendering, viewshed, shadows and fire spread are computed in the browser.
How is security handled?
Certification
rooom AG, the maker of SovAtlas, is certified to ISO/IEC 27001:2022. Scope as stated in the certificate: development, maintenance and operation of rooom AG’s web-based SaaS platform, including the associated cloud infrastructure and data centres, and all supporting business processes at the registered office and at employees’ remote workplaces.
- ISO/IEC 27001:2022, certificate held by rooom AG
- DE-IS-20260205
- rooom AG, Löbstedter Straße 47a, 07749 Jena
- Proks Certification GmbH, Düsseldorf, accredited by DAkkS
- 23 January 2026 to 22 January 2029
Sensitive layers
Our critical infrastructure layers and the power grid appear only on maps with a password or a personal access link; the database rejects everything else, with no exceptions for any role. Such maps cannot be embedded on third-party sites. For password-protected maps, a session lasts eight hours; after ten failed attempts within five minutes, the map locks out the sender.
Roles, second factor, logging
Two roles at rooom AG as the platform operator, three at the level of your organisation, including a read-only role. Write access requires a second factor; every change in the administration is logged with person, action, target and time.
How is privacy (GDPR) handled?
Map and building data is held in our data store in Frankfurt am Main, in open formats (see Where does it run?).
The data processing agreement under Article 28 GDPR, the list of sub-processors, technical and organisational measures, deadlines and the reporting channel belong in the first agreement.
The privacy policy applies to visits to this website.
How is the platform structured?
Sources
State data, regional
Aerial imagery · Laser scan · Cadastre · DGM1 elevation model (via terrain tiles)
Nationwide services, nationwide
Warnings via the BBK · DWD · BfS · GFZ · DFS · BKG
Nationwide data, set up regionally, regional
Census grid · Motorway status
Open networks, nationwide
OpenStreetMap · Air traffic (open receiver network)
Other sources
Thermal hotspots (NASA) · Terrain tiles · Flight routes on click
Data space · SovAtlas 3D GIS
Building model, regional
Height · Footprint · Solar suitability · Roof pitch
Air traffic checks, nationwide
Aircraft in drone zone · GPS interference
Current situation, nationwide
Warnings · Radiation · Weather · Earthquakes
Play it through
Viewshed · Sun and shadow · Fire (Demonstrator)
Water level, regional
Scenario as a horizontal surface
Labels, nationwide
our own map labels
Applications
One map per organisation
Layers and tools as configured
Access
Password · personal link · open
Embedding
on approved web addresses
Protected layers
KRITIS and power grid on protected maps only
From the same company
Crisis plans modelled on BSI Standard 200-4
Training worlds for autonomous systems
- regional: set up with the state’s data
- nationwide
- today
- Outlook
Many publishers, one picture.
State aerial imagery, laser scan, cadastre, protected areas. Warnings from five warning systems via the BBK, DWD weather, BfS radiation monitoring network, GFZ earthquakes, DFS drone zones. OpenStreetMap, air traffic from an open receiver network.
State data: regional. Nationwide services and open networks: nationwide.
What no single source shows.
We generate the buildings from footprints, laser scan and aerial imagery. Accuracy reports from aircraft produce a picture of where satellite positioning is disrupted.
Buildings: regional. · Air traffic and GPS interference: nationwide.
Three applications from one company.
Which layers a map shows, who sees it and where it is embedded: configured, not developed. KRITISplan records what follows from a situational picture. WorldCrafter turns the same state and map data into training worlds.
53 layers and tools that can be enabled
Which formats?
GeoJSON, JSON tiles, 3D Tiles, PMTiles, PostgreSQL with PostGIS. The schema of the administration database is available as migration files.
What happens if a source fails?
For weather, radiation or motorway status, the map shows the last data received, with its timestamp, and says that the source cannot be reached. A warning from yesterday never appears as today’s.
Recently added
- Our own map labels for the whole of Germany
- Solar suitability per roof, colour-coded
- UAS geographical zones with their legal basis at a click, nationwide
- GPS interference with an equipment filter, nationwide