PTV Group

Germany · www.ptvgroup.com · 15 vendors

PTV Group is a global software company that provides solutions, data, and consulting services for traffic planning, simulation, and real-time management. Their software helps cities, municipalities, and companies optimize transport routes, manage traffic flow, and plan for sustainable mobility. The company's products are used by over 2,500 customers in more than 120 countries.

Resilience scores

Technology vendors

Services catalogue

2 services in catalogue across 1 category; runs on 15 sub-vendors.

Insights

Last updated 2026-07-30 · revision 2

15 direct vendors, 186 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

PTV Group demonstrates a good foundation for migration readiness, particularly through its adoption of cloud hosting infrastructure with regional options and the development of a cloud-based SaaS platform, PTV Hub. The presence of a developer-facing REST API (PTV Flows API) indicates a move towards modern, decoupled architectures that are easier to migrate and integrate. The use of SAFe and static code analysis in their SDLC suggests agile development practices and a focus on code quality, which are beneficial for refactoring and re-platforming efforts during migration. Vendor relationships, with 19 services sourced from 7 geographically diverse countries, suggest a moderate level of vendor diversity, which could mitigate some vendor lock-in risks. However, several critical factors remain unknown. The extent to which all PTV products are cloud-native, containerized, or based on microservices is not explicitly stated; some products appear to be traditional software, potentially indicating legacy components that would require significant effort to migrate. Crucially, information regarding the regulatory environment and specific data residency requirements is missing, which are vital considerations for any large-scale migration project. Furthermore, the financial stability and ability to fund a comprehensive migration are unclear due to a lack of revenue concentration and growth data. The overall vendor lock-in risk is also explicitly unknown. Therefore, while PTV Group has made positive strides towards cloud adoption, the significant unknowns regarding legacy systems, regulatory landscape, data residency, and financial capacity place its migration readiness in the upper-medium range.

Compliance

10 in-scope frameworks identified; showing 3.

NIS2 (source) — Assessment Required

NIS2 risk is rated High for the following reasons: (1) PTV Group is a German-headquartered software company providing critical digital infrastructure to the transport sector — NIS2 Annex I lists 'transport' as an Essential Entity sector, and Annex II lists 'digital providers' (including managed service providers and software-as-a-service providers to critical sectors) as Important Entities; (2) PTV's products (PTV Flows, PTV Optima, PTV Visum, PTV Vissim) are used by cities, municipalities, and transport authorities for real-time traffic management and transport planning — these are core functions of transport infrastructure; (3) PTV explicitly lists 'Resilience of Critical Infrastructure' as a research topic and application area, indicating awareness of its role in critical infrastructure; (4) Germany transposed NIS2 into national law via the NIS2UmsuCG (NIS2 Implementation and Cybersecurity Strengthening Act), which entered into force in 2024; (5) Non-compliance penalties under NIS2 can reach €10M or 2% of global annual turnover for Essential Entities, and €7M or 1.4% for Important Entities; (6) No public NIS2 compliance assessment or registration with BSI (Germany's Federal Office for Information Security) has been found. The ISO 27001:2022 certification provides a strong technical foundation but does not automatically satisfy all NIS2 obligations (e.g., incident reporting to BSI within 24/72 hours, supply chain security requirements, management accountability).

Evidence: https://www.ptvgroup.com/en/trust-center, https://www.ptvgroup.com/en/about/locations, https://www.tuvsud.com/ms-zert, https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Kritische-Infrastrukturen/kritische-infrastrukturen_node.html

BDSG — Compliant

Risk is rated Medium because the BDSG supplements and specifies GDPR requirements under German law, including stricter rules for employee data processing (§26 BDSG), works council involvement in data processing decisions, and specific requirements for data protection officers (DPOs). As a German company with employees in Germany, PTV Group must comply with BDSG §26 for employee data, appoint a DPO (mandatory for companies processing personal data as a core activity or with 20+ employees regularly processing personal data using automated means), and comply with German-specific derogations. The company's GDPR compliance programme likely addresses BDSG requirements, but no explicit BDSG compliance disclosure or DPO appointment confirmation has been found publicly.

Evidence: https://www.ptvgroup.com/en/trust-center, https://www.ptvgroup.com/en/terms-privacy, https://www.ptvgroup.com/en/legal-documents/data-privacy-statement, https://www.lfd.niedersachsen.de/startseite/

GDPR (source) — Compliant

PTV Group is headquartered in Germany (EU) and explicitly self-declares full GDPR compliance on its Trust Center. The company processes personal data of EU/EEA residents as both a data controller (employee, customer, supplier data) and data processor (cloud services). Documented controls include a published Data Processing Agreement (DPA), Technical and Organisational Measures (TOMs) per Art. 32 GDPR, Privacy by Design and by Default principles, data minimisation, consent management, and a Data Privacy Statement for cloud services. Risk is rated Medium rather than Low because: (1) PTV operates globally across 18+ countries with complex cross-border data flows; (2) cloud services involve data processing for customers in the EEA and US, requiring ongoing transfer mechanism compliance (SCCs/adequacy decisions); (3) Germany's supervisory authority (LfDI Baden-Württemberg) is an active enforcer; and (4) no independent third-party GDPR audit report is publicly available to confirm the self-declared compliance posture.

Evidence: https://www.ptvgroup.com/en/trust-center, https://www.ptvgroup.com/en/terms-privacy, https://www.ptvgroup.com/en/legal-documents/data-processing-agreement, https://www.ptvgroup.com/en/legal-documents/data-processing-agreement-annex, https://legaldocs.ptvgroup.tech/en/data_privacy_statement_cloud_services_mobility__en_.pdf

Financials

Three-year financials

Financial Resilience Score: 6/10

PTV Group demonstrates solid qualitative financial resilience underpinned by market leadership in transport-planning software (PTV Visum and Vissim are de-facto industry standards used in 120+ countries) and a sticky, mission-critical customer base of public transport authorities and consultancies with high switching costs due to model calibration and staff training. The combined Umovity entity (PTV + Econolite) reported €307M revenue in 2024 across ~1,500 employees and 45 locations, providing meaningful scale and diversification across software, hardware and services. Ownership by Bridgepoint (private equity) alongside Porsche Automobil Holding SE provides access to capital for M&A and geographic expansion, as evidenced by the Econolite combination. The ongoing transition from perpetual licenses to SaaS (PTV Hub, Flows, Lines) should improve revenue visibility and recurring revenue quality over time. However, the score is constrained by significant risks: heavy dependence on politically-driven public-sector budgets, likely LBO-related debt from the 2022 Bridgepoint transaction with refinancing risk in a higher-rate environment, limited financial transparency as a private GmbH, carve-out complexity from the 2022 Logistics division separation, and competitive pressure from Aimsun (Siemens), Bentley Cube, and cloud-native entrants. Standalone PTV financials (EBIT, equity, debt) are not publicly disclosed, limiting external assessment.

Key strengths: Market leadership with PTV Visum and Vissim as industry-standard tools in 120+ countries, Sticky, mission-critical public-sector customer base with high switching costs, Umovity combined revenue of €307M in 2024 with ~1,500 employees across 45 locations, Strong ownership backdrop: Bridgepoint PE plus Porsche SE providing M&A capital, Transition to SaaS improving recurring revenue visibility, Diversification across software, hardware (via Econolite) and consulting services

Risk factors: Heavy dependence on politically-driven municipal/national transport agency budgets, Likely LBO debt burden from 2022 Bridgepoint acquisition with refinancing risk, Limited financial transparency as private GmbH, Carve-out complexity from 2022 Logistics division separation and Econolite integration, Competition from Aimsun (Siemens), Bentley Cube, Anylogic, Kapsch, Yunex, Miovision, Significant non-euro currency exposure across US, UK, and Asia

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report