QuoVadis (a DigiCert company)

United States · www.digicert.com/quovadis · 30 vendors

QuoVadis, a DigiCert company, is a Qualified Trust Service Provider (QTSP) offering digital certificates, Public Key Infrastructure (PKI) services, and electronic signature solutions. It provides eIDAS-compliant certificates for legally binding e-signatures and e-seals, along with cloud-based signing platforms, primarily serving the European market. Additionally, QuoVadis offers disaster recovery services in Bermuda.

Resilience scores

Technology vendors

Services catalogue

19 services in catalogue across 3 categories; runs on 30 sub-vendors.

Insights

Last updated 2026-05-04 · revision 3

30 direct vendors, 290 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 4/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

QuoVadis's migration readiness is assessed as medium-low (40). The primary challenge in this assessment is the significant absence of data concerning the company's internal technology stack (e.g., cloud-native vs. legacy, containerization, microservices), which is a fundamental determinant of migration complexity, effort, and cost. Similarly, the regulatory environment and specific compliance requirements are not detailed, which are critical factors for planning and executing a compliant migration. Financial stability, essential for funding a migration initiative, cannot be assessed due to missing revenue and growth history data. While 'Data Residency Requirements: Not specified' could imply fewer explicit constraints, it is an absence of information rather than a confirmed opportunity. Regarding vendor relationships, the data presents a contradiction with 'Total Vendors: 0' alongside geographic details for vendors. Assuming vendors exist based on the geographic data, the exact number of vendors and the associated vendor lock-in risk remain unknown, making it difficult to assess the complexity of disentangling from existing vendor contracts. The score reflects the substantial unknowns that would need to be addressed before a comprehensive migration strategy could be developed.

Compliance

5 in-scope frameworks identified; showing 3.

ISO 27001 (source) — Assessment Required

ISO 27001 is fundamental for cybersecurity companies as it demonstrates systematic information security management. For a company providing digital certificates and trust services, ISO 27001 certification is often required by customers and regulatory frameworks. Lack of certification could result in loss of business opportunities and reduced customer trust in a security-focused industry.

NIS2 (source) — Assessment Required

NIS2 applies to digital infrastructure providers and ICT service management entities in the EU. As a cybersecurity company providing digital certificates, QuoVadis may qualify as a digital service provider if they have EU operations and meet size thresholds (50+ employees or €10M+ turnover). Non-compliance can result in fines up to €10 million or 2% of annual turnover. Risk is medium as applicability depends on specific EU operations and entity classification.

ISAE 3000 (source) — Assessment Required

ISAE 3000 provides assurance framework for non-financial information, which may be relevant for QuoVadis's trust services and security assertions. While not mandatory, it can provide additional credibility for security and compliance claims. Risk is medium as it's more about competitive advantage and customer assurance than regulatory compliance.

Financials

Three-year financials

Financial Resilience Score: 5/10

QuoVadis is a private subsidiary of DigiCert, which itself is a private equity-backed company (Thoma Bravo and others). As a result, no standalone audited financial statements for QuoVadis are publicly disclosed, making it impossible to assess revenue, EBIT, equity, or cash flow with any precision. The absence of public financial data is typical for subsidiaries of this type but represents a significant transparency gap for third-party analysis. QuoVadis operates in the digital trust and PKI (Public Key Infrastructure) market, providing SSL/TLS certificates, qualified electronic signatures (eIDAS-compliant), and managed PKI services. This is a recurring-revenue, subscription-oriented business model, which generally supports financial stability. The integration into DigiCert's broader platform following the 2019 acquisition provides access to a larger sales force, infrastructure, and cross-selling opportunities, which likely supports revenue retention and modest growth. However, the competitive landscape is intense, with major players such as Sectigo, Entrust, GlobalSign, and DigiCert's own core brand competing directly. Pricing pressure on commodity SSL certificates is ongoing. QuoVadis differentiates through its eIDAS-qualified trust services and strong European regulatory compliance positioning, particularly in Switzerland, the Netherlands, and Bermuda, which provides some defensible niche revenue. Overall, the financial resilience score reflects the structural stability of a subscription/PKI business model and the backing of a well-capitalized parent (DigiCert), offset by complete lack of disclosed financials, the leveraged nature of DigiCert's PE-backed ownership, and uncertainty about QuoVadis's standalone profitability or scale.

Key strengths: Recurring subscription and managed PKI revenue model provides revenue predictability, Backed by DigiCert (Thoma Bravo PE-backed), providing financial and operational support, eIDAS-qualified trust service provider status in EU/Switzerland creates regulatory moat, Long-standing enterprise and government client relationships in Europe, Integration into DigiCert global platform enables cross-sell and upsell opportunities

Risk factors: No public financial disclosures — revenue, profitability, and equity are entirely unknown, DigiCert parent carries significant leveraged buyout debt from PE ownership, Intense price competition in commodity SSL/TLS certificate market, Dependency on parent company strategic priorities post-acquisition, Regulatory changes to eIDAS or EU trust frameworks could impact qualified service revenues, Small geographic footprint relative to global competitors

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report