Österreichische Post AG

Austria · www.post.at · 17 vendors

Österreichische Post AG is Austria's leading logistics and postal service provider, offering comprehensive mail, parcel, and logistics services. The company also has an international presence and provides financial services through its bank99 brand.

Resilience scores

Disruption prediction

Österreichische Post AG has an estimated 40% probability of disruption in the next 6 months.

8 of Österreichische Post AG's 17 vendors monitored for disruptions.

Technology vendors

Services catalogue

2 services in catalogue across 2 categories; runs on 17 sub-vendors.

Insights

Last updated 2026-07-30 · revision 2

17 direct vendors, 188 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Österreichische Post AG exhibits a moderate to high level of migration readiness, largely due to its existing adoption of Microsoft Azure as a cloud platform and a clear strategy towards API-driven integration (REST APIs / API Gateway). The company's investment in modern technologies such as AI/ML, OCR, RPA, and electronic signature platforms, along with its portfolio of inherently digital services (e.g., ELLA Business Portal, E-Brief, AllesPost), suggests a capability and willingness to embrace cloud-native and agile architectures. The ISO 27001 certification also indicates a structured approach to security, which is crucial for managing risks during a migration. However, significant challenges exist. The presence of SAP for ERP and enterprise systems represents a substantial hurdle, as migrating such deeply integrated and often monolithic legacy systems can be complex, costly, and time-consuming, potentially requiring extensive re-platforming or refactoring. A major gap in the provided data is the absence of information regarding the regulatory environment and data residency requirements. For a company operating banking services (bank99) and handling sensitive postal data across multiple countries, these factors are paramount and can heavily influence the feasibility and strategy of cloud migration, potentially imposing strict geographical constraints on data storage and processing. While 'Vendor Lock-in Risk' is unknown, reliance on major enterprise platforms like SAP and Microsoft Dynamics 365 inherently introduces some level of platform-specific lock-in. The geographic diversity of vendors (5 countries) could also imply a complex vendor landscape, which might add complexity to contract renegotiations or transitions during a large-scale migration. The lack of a specific number of vendors (due to the 'Total Vendors: 0' anomaly) prevents a direct assessment of vendor concentration-based lock-in.

Compliance

12 in-scope frameworks identified; showing 3.

GDPR (source) — Partially Compliant

Österreichische Post AG is headquartered in Austria (EU member state) and processes vast volumes of personal data including customer delivery addresses, tracking data, employee records, banking data (via bank99 subsidiary), and marketing/advertising data. The company has a documented history of GDPR enforcement: in 2019, the Austrian Data Protection Authority (DSB) issued a €18 million fine against Österreichische Post for unlawfully processing and selling political affinity data of approximately 3 million Austrians. This fine was later reduced on appeal but demonstrates active regulatory enforcement. The company operates digital services (Post App, AllesPost, ELLA Business Portal), e-commerce, and financial services (bank99), all of which involve significant personal data processing. Austria's DSB is an active enforcement authority. The combination of prior enforcement action, large-scale personal data processing, and complex multi-subsidiary operations elevates this to High risk.

Evidence: https://www.post.at/i/c/datenschutz, https://www.post.at, https://edpb.europa.eu/news/national-news/2019/austrian-dpa-fines-austrian-post-18-million-euros_en, https://www.dsb.gv.at/

EU Whistleblowing Directive — Compliant

Österreichische Post AG has publicly implemented a whistleblowing system (accessible via https://app.loupe.link/whistleblowing/61372439-d6ee-4edf-a460-409689fb0af1) as required by the EU Whistleblowing Directive and its Austrian implementation (HSchG, BGBl. I Nr. 6/2023). The system is publicly linked from the company's website footer, indicating active compliance. Risk is Low as the company has demonstrably implemented the required internal reporting channel.

Evidence: https://app.loupe.link/whistleblowing/61372439-d6ee-4edf-a460-409689fb0af1, https://www.post.at, https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20012028

SOC 2 (source) — Assessment Required

Österreichische Post AG operates significant digital platforms and cloud-based services including the ELLA Business Portal, Post App, AllesPost, and e-commerce infrastructure. The company also provides business process outsourcing and fulfillment solutions to enterprise customers. Enterprise customers increasingly require SOC 2 reports from service providers as part of vendor due diligence. While SOC 2 is not legally mandated in Austria, the company's role as a B2B service provider and its digital infrastructure operations create commercial pressure for SOC 2 compliance. Risk is Medium because non-compliance does not carry regulatory penalties but may impact enterprise customer acquisition and retention.

Evidence: https://www.post.at/g/c/businesssolutions, https://ella.post.at/

Financials

Three-year financials

Financial Resilience Score: 8/10

Österreichische Post AG demonstrates strong financial resilience underpinned by its status as Austria's incumbent postal operator with a universal service mandate, majority state ownership (~52.85% via ÖBAG), and a stable, regulated cash-flow profile. The company generates operating cash flow of EUR 250-300m per year, supports a high dividend payout ratio (~75% of net income), and has traditionally been net-cash on its industrial (non-banking) balance sheet. Equity ratio is historically in the 30-40% range, though diluted by banking activities inflating total assets. Credit standing is considered investment-grade quality given state backing and stable cash flows. Diversification into parcels (a growth engine at ~45% of revenue) and Turkey via Aras Kargo provides growth optionality, while the mail business, though structurally declining, remains resilient through price increases and direct mail. However, resilience is tempered by multi-year drag from bank99 start-up losses, Turkish hyperinflation accounting (IAS 29) distortions, wage inflation from Austrian collective bargaining (high single-digit increases in 2022-2023), and customer concentration risk with large e-commerce clients like Amazon. Overall, the combination of regulated essential-service business, de facto state backstop, and diversified growth avenues supports a strong resilience profile.

Key strengths: Majority state ownership (~52.85%) via ÖBAG providing de facto backstop, Regulated, essential-service business with universal service mandate, Strong operating cash flow (EUR 250-300m p.a.) supporting high dividend payout, Net-cash position on industrial (non-banking) balance sheet, Investment-grade quality credit standing, Diversification across Mail, Parcel & Logistics, and Retail & Bank, Growth engine in Parcel & Logistics with 180m+ domestic parcels p.a., One of Europe's largest e-vehicle fleets in logistics (>4,000 e-vehicles)

Risk factors: Structural letter mail decline (~5% p.a. in mature markets), bank99 has been a multi-year drag on group EBIT with repeatedly delayed breakeven, Turkish hyperinflation accounting (IAS 29) distortions from Aras Kargo consolidation, Wage cost inflation from Austrian collective bargaining agreements, Diesel/energy cost pass-through lag, E-commerce customer concentration (Amazon and other large pure-play retailers), FX volatility from Turkey exposure, Regulatory risk on postal tariffs (RTR/BMK oversight)

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report