Trust
Security and privacy, without the badges we have not earned.
Who handles your data, what we do to protect it, and how far our audits are. Where something is planned we say planned, and we update this page before we say anything else.
Updated 2026-11-09
Compliance programmes
A programme is shown as met only when it is. SOC 2 and ISO 27001 are not, and there is no badge for them.
GDPR
Met
Part of how we run the service today.
CCPA
Met
Part of how we run the service today.
SOC 2 Type II
In preparation
We are preparing for a SOC 2 Type II audit now and will book the auditor later. Until a report exists, we do not call Dotwick SOC 2 compliant.
ISO/IEC 27001
Planned
We will look at ISO/IEC 27001 after SOC 2.
What is in place
Only practices that run today. Planned ones are not listed here.
- Traffic to every Dotwick host is encrypted with TLS
- Databases, backups and files are encrypted at rest by our hosts
- Scanner IP addresses are never stored, only a hash with a daily salt
- Two-factor sign-in for everyone; required for Dotwick staff
- SAML single sign-on and SCIM provisioning on Enterprise
- An append-only audit log of account and staff actions
- Daily database backups
- Every destination is checked against unsafe-site lists
Sub-processors
These companies process personal data for Dotwick when you use the service. We tell a workspace’s owners by email 30 days before one is added, removed or changed.
| Provider | What it does | Data | Where | Status |
|---|---|---|---|---|
| Cloudflare | DNS, CDN and firewall, TLS for custom domains, R2 file and backup storage, the status page, approximate scan location | scan requests (IP in transit only), uploaded files, database backups | Global edge; R2 storage in the EUStandard Contractual Clauses | In use |
| Railway | Hosting for the API, background workers, Postgres, Redis and ClickHouse | account data, workspace data, scan analytics | EU (Amsterdam)Standard Contractual Clauses | In use |
| Vercel | Hosting for the website and the web app | page requests (IP in transit only), account and workspace data shown in the app (in transit only) | EU (Frankfurt); global edgeStandard Contractual Clauses | In use |
| Resend | Sending email: sign-in links and codes, invitations, exports, reports | email addresses, email content | EUStandard Contractual Clauses | In use |
| Sign in with Google (only if you choose it) | name, email address | United StatesStandard Contractual Clauses | In use | |
| Stripe | Payments and invoices for paid plans | billing contact, payment details (held by Stripe) | United States, EUStandard Contractual Clauses | In use |
| Google Web Risk | Checking code destinations against lists of unsafe sites | destination URLs | United StatesStandard Contractual Clauses | In use |
| Anthropic | AI features: brand from a website, design suggestions, the analytics assistant and page drafts. No personal data is sent | public website text, design choices, aggregated scan counts | United StatesStandard Contractual Clauses | In use |
| Sentry | Error reports from the app and the API | technical error data, account ids, IP addresses (in transit only, never stored) | EUStandard Contractual Clauses | In use |
| Better Stack | Uptime monitoring and alerts, and the uptime figures on the status page | service health checks (no customer personal data) | EUNo transfer outside the EEA | In use |
| GitHub | Runs the daily backup jobs: database backups and copies of uploaded files pass through its machines on the way to storage and are not kept there | account data, workspace data, uploaded files | United StatesStandard Contractual Clauses | In use |
Tags and destinations you set up yourself, such as Google Analytics, Meta, TikTok, LinkedIn, Zapier, Make or HubSpot, are not our sub-processors. You send your data there and they act for you.
Policies
The policies a SOC 2 audit asks for. They are being written, and we publish each one here once it is approved.
- Information security policyIn preparation
- Access control policyIn preparation
- Change management policyIn preparation
- Incident response planIn preparation
- Vendor management policyIn preparation
- Business continuity and disaster recovery planIn preparation
- Data classification and handling policyIn preparation
- Data retention and deletion policyIn preparation
- Acceptable use policy (staff)In preparation
- Secure development policyIn preparation
- Risk assessment policyIn preparation
Report a vulnerability
If you find a weakness in Dotwick, write to us first. We read every report and answer it.
- Security reports
- security@dotwick.com
- Privacy questions
- privacy@dotwick.com
Our /.well-known/security.txt lists this contact in the standard format.