CCapability-led route

Software-Dienstleistungen Mein Bildungsraum, ECA-2026-051

Bundesdruckerei GmbH

Deadline
14 Sept 2026, 10:00
Value
—
Region
Germany; system access and customer toolchain work must normally occur from Germany
Reviewed
16 Aug 2026
Portfolio verdict

Capability-led route

Do not bid as a standalone prime. The application and engineering work is relevant, but mandatory references must collectively prove StackIT operation in a public/education/regulated context, qualified digital signatures or seals with education-system integration and multi-stakeholder piloting, plus a DARP-funded digitisation project. None is evidenced. Delivery also assumes five senior FTE, up to 4,130 person-days, Germany-only access and unusually high insurance. A qualified platform partner is required for any bid.

Recommended actionDo not bid standalone. Pursue only with a StackIT/eIDAS/education-platform partner that can satisfy every mandatory reference condition, provide the five senior roles and carry EUR 10 million bodily/property plus EUR 2.5 million financial-loss insurance; otherwise record a no-bid because the reference gates are exclusionary and the maximum 4,130 person-day commitment exceeds evidenced capacity.

What the opportunity means

Operate, monitor, maintain, patch and selectively extend Bundesdruckerei's CloudPDF application for digitally sealed Abitur certificates, support state field tests and EUDI-wallet integration, and archive the other Mein Bildungsraum components on buyer-provided StackIT infrastructure.

Portfolio thesis

Strong technical overlap with secure PDF/document workflows, TypeScript/Java integration, IAM, CI/CD, observability and regulated public-sector delivery, but the required StackIT, eIDAS seal, XSchule/education, DARP-funded reference, five-FTE team and high-liability insurance evidence are absent from the qualification pack.

Qualification reality

The portfolio demonstrates secure document, evidence, workflow and cloud operations, but Digital David has no existing product that operates Bundesdruckerei's StackIT-hosted CloudPDF/eIDAS remote-seal application; this is a core-competency route requiring highly specific platform, reference, staffing and insurance evidence.

Portfolio evidence

Products and reusable delivery strengths

Products

holz-platformFactify / Claimster / ClaroclaimKURTPerspectify

Competencies

secure document and PDF workflowsregulated case and evidence platformsJava and TypeScript application engineeringcloud operations, CI/CD and observabilityidentity, access and security integration

Decision gates

Eligibility and delivery gates

  • Company matchPartially met
    Company identity and ownership disclosure
    MustRequired

    Digital David AG and its registered office are verified, but the tender-specific disclosure of legal representatives, shareholders, beneficial owners and group structure is not prepared.

  • Company matchPartially met
    Current commercial-register extract
    MustRequired

    Legal identity is verified, but the package does not contain an extract reflecting the bid-date status and no older than three months.

  • Company matchUnknown
    Exclusion and Russia declarations
    MustRequired

    Tender-specific GWB exclusion and Russia-link declarations are required; no executed forms are present.

  • Company matchPartially met
    Three-year total and comparable turnover
    MustRequired

    The tender requests both total and comparable web-service/cloud-native turnover for three completed years and states no minimum. Only 2024 and 2025 total turnover are verified; 2023 and comparable-turnover allocation are missing.

  • Company matchUnknown
    Three-year total and comparable workforce
    MustRequired

    The tender requests total employees and employees delivering comparable services for each of the last three years; no headcount evidence exists and personnel expense is not used as a proxy.

  • Company matchUnknown
    Two qualifying cloud-native references
    MustRequired

    Two recent web-service/cloud-native-operations references are mandatory. Portfolio descriptions do not prove the required buyers, periods, values, contacts and operating attributes.

  • Company matchUnknown
    STACKIT public/education/regulatory reference
    MustRequired

    At least one reference must combine public, education or similarly regulated delivery with operation on STACKIT; none is verified.

  • Company matchUnknown
    Qualified seal/document integration reference
    MustRequired

    At least one reference must cover digital signature or qualified sealing, validation/PDF/e-document output, multiple stakeholders, education-system or comparable integration and successful pilot/production use; none is verified.

  • Company matchUnknown
    DARP-funded digitisation reference
    MustRequired

    At least one reference must concern a DARP-funded digitisation project; no such funding evidence exists in the company pack.

  • Company matchUnknown
    Information security and GDPR management
    MustRequired

    ISO 27001/DSGVO certification or self-declared equivalent measures are accepted, but no tender-ready management-system evidence or completed declaration exists.

  • Company matchUnknown
    Professional liability insurance
    MustRequired

    The contract requires EUR 10 million bodily/property and EUR 2.5 million financial-loss coverage per claim, each twice annual aggregate, through two years after contract end; no insurance evidence exists.

  • Company matchUnknown
    Five-person senior delivery team
    DeliveryNot required

    At least five named Product Manager, Lead Engineer, Infrastructure Lead, Infrastructure Engineer and Senior Engineer profiles with role-relevant degrees, senior experience, German C2 if not native and English are required. Expert-team evidence is deferred.

  • Company matchPartially met
    Germany-based secure access
    DeliveryNot required

    Digital David is Germany-based, but locations and secure-access readiness of the named delivery personnel are not evidenced; foreign access needs exceptional written export-control approval.

  • Company matchPartially met
    Relevant application and platform capability
    DeliveryNot required

    The portfolio demonstrates secure document workflows, cloud operations and regulated software, but not the exact STACKIT, eIDAS qualified-seal, XSchule and five-FTE operating environment.

Interpreted scope

Delivery shape

  • Operate and monitor CloudPDF on buyer-provided STACKIT infrastructure, including Certificate Management, Verifier, Issuance, Keycloak Trust Service, education-institution directory, user interfaces and on-premises service clients.
  • Maintain external qualified timestamp and certificate-authority integrations for eIDAS-compliant remote seals and operate the HashiCorp private-key vault environment.
  • Diagnose and correct incidents, apply security patches, maintain npm/Maven dependencies and preserve conformity after framework and component updates.
  • Maintain GitHub Actions pipelines, code-quality controls, STACKIT/Kubernetes-style infrastructure automation, logging, monitoring and system performance.
  • Integrate school and higher-education administration systems, migrate relevant data and support output of digital education credentials to the EUDI Wallet.
  • Implement selected workflow, interface and API changes on buyer request in the existing TypeScript/Java technology stack.
  • Prepare and support field tests with German states and education institutions, including onboarding, test environments, rapid defect correction, result analysis and approved follow-up changes.
  • Feature-freeze and archive the former Digital Ablage, Schaufenster, Digitale Identitäten and Datenraum components and demonstrate operability only when requested.
  • Provide security, privacy and quality documentation including release notes, test records, per-release SBOM, operating/test concepts, privacy/security-concept contributions and an independent BITV 2.0 accessibility report.
  • Process student and certificate data under the buyer's Article 28 GDPR agreement, disclose subprocessors, complete technical-organisational measures and accept security training and audits.

Bid package

Required submissions

  • Completed and signed offer letter
  • Excel price sheet with hourly rates for the five roles, in EUR excluding VAT
  • Completed bidder self-disclosure and commercial/professional register extract no older than three months
  • Exclusion declaration and, optionally before award, Russia-link declaration
  • Two completed reference forms proving every mandatory reference condition
  • Consortium, subcontractor, reliance and third-party commitment forms where applicable
  • Maximum-10-page personnel/implementation concept; pages after ten are not evaluated
  • Short CVs for every proposed team member with unambiguous role mapping and all scored qualifications/experience
  • Completed Article 28 GDPR agreement, especially subprocessor list and technical-organisational measures
  • Information-security and GDPR certification or equivalent-measures declarations
  • Insurance evidence sufficient for the contractual coverage requirement

Commercial reading

Contract and pricing terms

  • Services are paid on time and materials using the offered hourly rates; the contract states no upper monetary cap.
  • The buyer estimates five FTE and up to 4,130 person-days over the maximum term, but the exact role allocation is bid-defined.
  • Travel, travel time, ancillary costs and material costs are not separately reimbursed; all are included in hourly pricing.
  • No price-adjustment mechanism is selected in the draft contract.
  • Proper invoices are payable within 30 calendar days and must follow electronic-invoice requirements.
  • The buyer may terminate with four weeks' notice if objective circumstances indicate the project's goal is unlikely to be achieved.
  • Security breaches can trigger a contractual penalty set by the buyer under equitable discretion, plus audits and further claims.
  • Contractor liability for foreseeable typical damage from lightly negligent breach of essential duties is contemplated up to three times the contract value, and the contract expressly includes lost profit.
  • The contractor must maintain EUR 10 million bodily/property and EUR 2.5 million financial-loss insurance, each twice annual aggregate, through two years after contract end.
  • Buyer provides StackIT hosting, Jira, Confluence and GitHub access; the supplier remains responsible for controlled application operations, security and all subcontractors.
  • The Article 28 agreement and security terms permit buyer audits and require prior approval and full TOM disclosure for data-processing subprocessors.

Evidence trail

Sources and bidder information

Authoritative DTVP communication area checked 16 August 2026 at 22:29 CEST. No authority messages or bidder-question catalogue existed at that time. Questions may be submitted until 3 September 2026.

Authoritative DTVP notice ↗Official notice, deadlines, scope, qualification gates and contract termAuthoritative DTVP documents ↗Official 21-document procurement packageAuthoritative DTVP communication ↗Official bidder-communication area; no messages when checkedFeedbax discovery record PB-26226-62446 ↗Aggregator used only for discovery; official record resolved to DTVP

Package reviewed 16 Aug 2026, 22:29

Research files

Documents used for this evaluation

ZIPComplete official procurement package ↓Authoritative downloadable packagePDFInvitation and submission checklist ↓Used for mandatory submission checklistPDFProcurement conditions ↓Used for form, exclusions, reference gates, non-curable evaluation documents and scoring methodPDFEvaluation matrix ↓Used for concept, CV and technology/experience scoringPDFEVB-IT services contract ↓Used for term, payment, termination, liability, insurance and security penaltiesPDFService description ↓Used for CloudPDF scope, stack, staffing, documentation and access requirementsPDFArticle 28 GDPR agreement ↓Used for data categories, subprocessors, TOMs, audit and incident obligationsPDFInformation-security agreement ↓Used for training, Germany-only access, secure development, audit and incident requirements