Cumulocity
Cumulocity is an enterprise industrial AIoT platform for equipment manufacturers, utilities, logistics and telecom operators. It connects and manages device fleets, turns raw machine data into AI-ready data, and deploys from cloud to fully air-gapped edge.
What is Cumulocity?
Cumulocity presents itself as an industrial AIoT platform: the site title reads Cumulocity | Industrial AIoT Platform and the homepage promise is to connect your products and innovate. In the vendor's own words, it is an end-to-end platform that connects and manages assets, transforms raw device data into AI-ready data, and orchestrates innovation from cloud to edge.
The product is organised around six named applications. Device Integration onboards any device through the open-source thin-edge.io framework, ready-made protocol adapters or an SDK. Device Management runs fleets across their full lifecycle, from enrolment to decommissioning. Digital Twin Manager models assets and their interdependencies in business context. DataHub offloads IoT data to a data lake and exposes open interfaces towards analytics and machine-learning tools. Streaming Analytics analyses live streams and triggers alarms and actions automatically. Cockpit covers visualisation, dashboards and custom views. Around them sit cross-cutting capabilities: edge deployment, application enablement, AIoT innovation, security and professional services.
Openness is a core argument: MQTT, REST, OPC UA, LWM2M, LoRaWAN and SMARTRest are all supported, and the REST API is documented with public OpenAPI specifications. Deployment spans cloud SaaS with a choice of EU, US or APJ region, single-node on-premises Edge on an appliance VM or Kubernetes, and a fully offline Air-Gapped edition. On the AI side, the FAQ defines AIoT as combining IoT connectivity with AI decision-making, and describes two routes: Actionable Analytics, meaning machine learning on IoT data for predictive maintenance and anomaly detection, and Intelligent Agents, meaning generative and agentic AI, chatbots and assistants.
The scale figures are vendor claims rather than audited facts. Cumulocity states its platform is validated for 100 million devices, one million messages per second, more than 500,000 datapoints per second and 170+ pre-integrated devices; the pricing page advertises 500+ enterprise customers, 50M+ connected devices and a 99.9% availability SLA. The company also claims leadership in the 2025 Gartner Magic Quadrant for Global Industrial IoT Platforms and in the Forrester Wave for Industrial IoT.
Published use cases include AI/ML operationalisation, remote monitoring, predictive maintenance, smart field services, Vision AI and asset optimisation, across industrial equipment, medical devices, manufacturing, utilities and energy, transport and logistics, retail and telco. Named partners include Microsoft, AWS, Google and SAP; named customers include WIKA, Flexco, Hitachi Construction Machinery, ABB Robotics, Deutsche Telekom, Panasonic and Sony.
What it does
- Connect and manage industrial device fleets across their entire lifecycle
- Turn raw machine data into AI-ready data
- Detect anomalies and trigger alarms and actions in real time
- Run predictive maintenance and smart field service
- Model assets as digital twins and visualise them in dashboards
- Offload IoT data to a data lake and exploit it with your own analytics and ML tools
- Deploy from cloud to edge, including on fully isolated networks
When to use Cumulocity / When not to
A quick filter to help you decide if Cumulocity is the right fit.
When to use Cumulocity
- Industrial equipment manufacturers that want to connect their products and sell digital services around them
- Engineering teams that prefer a Buy and Build approach, with roughly 80% of the functionality available out of the box and the rest built with microservices and web extensions
- Operators of very large fleets, with up to 250M messages per month on Business and no message cap on Enterprise
- Regulated or isolated environments that need an on-premises Air-Gapped edge running completely offline
- Organisations with data residency requirements, choosing an EU, US or APJ region and an AWS, Azure or Alibaba hyperscaler
When not to use Cumulocity
- Anyone looking for a permanently free tier: the cheapest entry point is €215/month billed annually
- Buyers who need a published price for every plan, since Business, Enterprise and both Edge editions are quote-only
- Projects that would immediately outgrow the Starter limits: a single tenant, 2.5M messages per month, 30-day retention, three analytics models, community-only support and a 95% availability commitment
- Mobile-first users, as no iOS or Android application is published
- Consumer audiences, or anyone after a general-purpose AI assistant: the product is built around industrial equipment and OT data
How to use Cumulocity
A typical end-to-end flow, from setup to results.
- Start from the homepage with Try for free for a trial, or Get a demo to book a guided session
- Sign up for the 30-day free trial, governed by the Cloud Trial Service Agreement and limited to evaluation and internal testing
- Register your first industrial devices, which the vendor says takes under five minutes, using zero-touch onboarding, open payload support and built-in data mapping
- Connect the rest of the fleet through thin-edge.io, ready-made protocol adapters, the MQTT Service, the OPC UA gateway, LWM2M, LoRaWAN via Actility or Loriot, or the SDK
- Model your assets in Digital Twin Manager, then build dashboards and custom views in Cockpit
- Add real-time logic with Streaming Analytics, and offload data to a data lake with DataHub for your own analytics and machine learning
- Extend the platform with microservices and web applications through the Integration Toolkit and the developer portal
- Switch the interface to one of the 11 available languages through the user settings, browser preferences or system language, English being the default
- Learn and get help through the documentation, the learning portal, the Tech Community, trainings and the platform status page; support runs through the support portal rather than email
- Move to production by contacting sales or buying through your own cloud marketplace, then pick the plan, region and deployment mode (cloud, Edge Connected or Edge Air-Gapped); the vendor targets a first commercial solution in under 90 days
Pros & Cons
Pros
- A published, quantified entry price of €215/month billed annually, which is rare on this market
- Public and complete REST/OpenAPI documentation
- Independent, verifiable certifications: ISO/IEC 27001:2022, 27017:2015 and 27018:2019, ISO 9001, plus SOC reports and a HIPAA attestation
- A subprocessor list published by name in a PDF
- Genuine edge-to-cloud continuity, including a completely isolated Air-Gapped deployment
- A choice of data residency region (EU, US, APJ) and of hyperscaler (AWS, Azure, Alibaba)
- A European vendor with the controller established in Germany, a named and reachable DPO, open protocols, the open-source thin-edge.io framework and 11 documented interface languages
Cons
- No permanently free plan
- Only the Starter plan carries a public price; Business, Enterprise and both Edge editions are quote-only
- No published position on whether customer data is used to train AI models, and no documented opt-out
- Structural capabilities are billed as separate add-ons: Protocol Gateway, multi-tenancy on Business, geo-redundant backup and hyperscaler choice
- The trial agreement is governed by the law of the State of New York even though the vendor is German
- No support or legal email address is published, and support runs through a portal only
- No mobile application, and no minimum age stated in the terms
Pricing & Plans
There is no permanently free plan. A 30-day free trial is offered under the Cloud Trial Service Agreement, restricted to evaluation and internal testing. The lowest paid entry point is the Starter plan at €215/month billed annually, the only amount published on the pricing page, quoted in euros and stated per month. The four remaining plans, Business, Enterprise, Edge Connected and Edge Air-Gapped, are listed as Custom pricing and require a conversation with the sales team. Purchase is also possible through the customer's own cloud marketplace, and professional services are sold separately with no public rate.
- unlimited users
- up to 2.5M messages per month
- 95% availability
- community support
- a single tenant
- 30-day retention and up to three analytics models
- unlimited users
- up to 250M messages per month
- 99.0% availability
- 24/7 crisis phone support
- multiple tenants in a chosen region (EU
- US or APJ)
- SSO
- configurable retention
- unlimited users
- unlimited messages
- 99.9% availability
- 24/7 support on all incidents
- a fully customisable platform
- multiple tenants in any region and isolated infrastructure
- internet access required
- no high availability
- no multi-tenancy
- self-service operations
- no internet access required
- no high availability
- no multi-tenancy
- self-service operations
Data, GDPR & hosting
A consolidated view of how Cumulocity handles your data.
GDPR overview
GDPR implementation is concrete rather than declarative. Cumulocity GmbH, Marc-Chagall-Straße 2, 40477 Düsseldorf, is named as data controller under Article 4 of Regulation (EU) 2016/679, and a data protection officer is reachable at dataprotection@cumulocity.com or by post. A Data Processing Agreement governs the processor relationship and prevails over the services agreement on data protection; technical and organisational measures are published in three PDFs (maintenance and support, cloud services, professional services). Transfers outside the EEA rely on standard contractual clauses for India, the United States and China, while Microsoft, Amazon Web Services and Cloudflare are covered by the EU-US Data Privacy Framework. Named subprocessors sit in the EU/EEA or in adequacy countries: Germany, Japan, the United Kingdom, Poland. No Article 27 representative applies, the controller being established in Germany. Earlier versions of the privacy notice stay accessible, and a separate US State Privacy Notice is published.
Who owns the data?
Two regimes coexist. For everything processed inside the Online Services, the customer is the data controller and Cumulocity acts as a processor: the contract states that the customer remains the controller at all times for the Cloud Services, the Cloud Services Agreement and the Data Processing Agreement. For data collected through the website and the commercial relationship, such as contact details, browsing behaviour and job applications, Cumulocity GmbH, Marc-Chagall-Straße 2, 40477 Düsseldorf, is itself the controller under Article 4 of the GDPR. The privacy notice explicitly does not cover the processing carried out on behalf of a customer under the Cloud Services.
Reuse rights
The personal data categories named in the privacy notice are contact and business-relationship data, website usage data describing visitor behaviour, and recruitment data (CV, cover letters, identity documents, date of birth). Special categories such as health, trade union membership or religion are processed only where the law requires it. Google Analytics is used under a processing contract signed with Google and aligned with the requirements of the German data protection authorities, with an opt-out available through Google's browser plug-in; cookie consent is handled by Cookiebot. Platform data stays under the customer's control: the customer remains the controller, and the platform documents ways to get that data out, offloading it to a data lake through DataHub or consuming it through the REST API. No clause setting out reuse rights over that data is published. On the question that matters most to an AI buyer, the site says nothing at all: across every page collected, no statement indicates whether customer data is used to train AI models, and no opt-out mechanism is documented. That silence is neither a commitment nor its opposite.
Data retention & training
Hosting summary
Cumulocity publishes regions, not countries. SaaS customers pick an EU, US or APJ region for data residency on Starter and Business, and any region on Enterprise, running on AWS, Azure or Alibaba, the hyperscaler choice being an add-on on Enterprise. No country is ever named as the hosting location of customer data, and the cloud services technical and organisational measures describe secure data centres without saying where they are. The subprocessor PDF names the third-party cloud providers Microsoft Corporation, Amazon Web Services Inc. and Cloudflare Inc., all three under the EU-US Data Privacy Framework, plus the EU third parties Inetum Polska Sp. z o.o. and Jaroslaw Herod in Poland. Group entities delivering Cloud Services are Cumulocity GmbH (Germany), Cumulocity Ltd. (United Kingdom), C8Y Solutions Private Limited (India), Cumulocity Inc. (United States) and Cumulocity Software (Beijing) Co., Ltd. (China). Isolation options include isolated VPC/VNET infrastructure, VPN or private link, and multi-tenant architecture. Organisations that cannot accept vendor hosting can run Cumulocity Edge on-premises, including a completely offline Air-Gapped edition.
Where Cumulocity works
Country-level availability.
Not available in
Things to keep in mind
Risks and trade-offs to weigh before adopting Cumulocity.
- The vendor publishes no position at all on whether customer data is used to train AI models, and documents no opt-out: this silence is neither a commitment nor its opposite, and it deserves to be raised before signing
- The Cloud Trial Service Agreement is signed with Cumulocity Inc. (Delaware) and governed by the law of the State of New York, while the entity named in the imprint and the privacy notice is the German Cumulocity GmbH; a European buyer should check which entity it is actually contracting with
- The trial is contractually limited to evaluation and internal testing, so it cannot be used for production workloads
- An export control clause requires the customer to declare that it is not a citizen, national or resident of Cuba, Iran, North Korea, Sudan or Syria, nor of any country under EU or US export prohibition, and that it does not appear on EU or US sanctions lists
- Structural capabilities are chargeable add-ons: Protocol Gateway, hyperscaler choice, geo-redundant backup, and multi-tenancy on the Business plan
- Four of the five plans carry no public price, and no minimum age is stated anywhere in the terms
- Headline figures such as 500+ enterprise customers, 50M+ connected devices and 100 million validated devices are unaudited vendor claims, and the customer footprint moves: the FAQ says more than 40 countries where the January 2025 buyout release announced around thirty
Setup & Integrations
Technical difficulty
Implementation is technical but deliberately shortened. Cumulocity promises device registration in under five minutes and a first commercial solution within 90 days, using zero-touch onboarding, open payload support and built-in data mapping. Its Buy and Build approach claims about 80% of the functionality out of the box, with ready-made protocol adapters, the open-source thin-edge.io framework for Linux devices and a Protocol Gateway covering 320+ device types. Deeper customisation needs microservices, web extensions, SDKs and the Integration Toolkit, and Edge runs on an appliance VM or Kubernetes in self-service. It targets IoT engineers, integration architects and OT teams.
Deployment
Integrations
Supported languages
Behind Cumulocity
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
What is Cumulocity?
Where does the company operate?
Is there a free trial, and is there a free plan?
How much does it cost, and how do I buy it?
Can Cumulocity run on-premises or at the edge?
What API does the platform expose?
How is cybersecurity handled?
What does AIoT mean for Cumulocity?
Where is the data hosted?
Which interface languages are available?
Should you pick Cumulocity?
Cumulocity is a mature industrial AIoT platform published by Cumulocity GmbH in Düsseldorf, independent again since its management bought the company back from Software AG on 20 January 2025. It sits at the serious end of the IoT market: six coherent applications covering device integration and management, digital twins, streaming analytics, data lake offload and dashboards, wrapped in open protocols and a documented REST API.
What stands out for a buyer is transparency. The entry price is published and quantified, which is unusual in this segment; certifications are claimed with specific standards and versions; the subprocessor list is published by name in a PDF; data residency region and hyperscaler are a customer choice; and edge-to-cloud continuity is genuine, up to a completely offline Air-Gapped edition for regulated or isolated environments.
The weak points are just as clear. There is no permanently free plan, and only one plan out of five carries a public price, so any realistic budget still requires a sales conversation. More importantly for anyone weighing the AI dimension, the vendor says nothing at all about whether customer data is used to train AI models, and documents no opt-out; that silence is neither a promise nor a refusal, and it belongs on the contract agenda. Add the add-ons billed separately on structural features, a trial contract signed with a Delaware entity under New York law, and headline figures such as 500+ enterprise customers or 50M+ connected devices that remain unaudited vendor claims.
The natural audience is industrial equipment manufacturers and operators of connected assets, with technical teams able to exploit microservices, SDKs and edge deployments. It is not a consumer product.
- Choosing a selection results in a full page refresh.
- Opens in a new window.