Trust Center
How Dockflow protects customer data today, and what is still in progress. Last reviewed: November 6, 2026
This page states the current position, including what is not in place yet. It changes when the position changes.
Status overview
| Item | Status | Detail |
|---|---|---|
| GDPR | DPA published | Dockflow acts as processor under a public Data Processing Agreement. |
| Sub-processors | Published | See the list below. Customers get 30 days' notice of additions or replacements. |
| External reviews | 2 in 2025 | Two independent technical due diligence reviews by external firms. These are not security certifications. |
| ISO 27001 | In preparation | Dockflow is closing the gaps identified for ISO 27001, starting with two-factor authentication and single sign-on. Dockflow is not certified yet. |
| SOC 2 | In progress | Internal readiness assessment started in November 2026. Audit planned after ISO 27001. Dockflow does not hold a SOC 2 report yet. |
Hosting and data location
- The core platform runs on Google Cloud in Belgium (europe-west1), including the production databases and object storage.
- Cloudflare provides DNS, DDoS protection, a web application firewall and TLS termination at its global edge network.
- Some supporting services process data outside this region. The sub-processor list states the location of each one.
- Dockflow BV is a Belgian company, based in Antwerp.
Encryption
- Data in transit uses TLS 1.2 or later. TLS 1.1 is refused.
- HSTS is active on Dockflow domains, including subdomains.
- Data at rest is encrypted by the cloud infrastructure provider.
- Production databases accept encrypted connections only.
- Object storage blocks public access.
Access
- Customer data is separated per organisation through entity-based access control, with roles inside each organisation.
- Authorised Dockflow staff can access customer accounts to provide support.
- Source code repositories are private.
- Two-factor authentication is required on GitLab and is enabled for all Google Workspace users.
- The dockflow.com mail domain publishes a DMARC policy of reject.
Backups and recovery
- Production databases have automated backups with point-in-time recovery, retained for 7 days.
- Deletion protection is active on production databases.
- The uptime target is 99.9%.
Development
- Changes to the main product repositories must pass an automated CI pipeline before they merge.
- Infrastructure is defined as code and changes are tracked in version control.
- Dependency updates are proposed automatically.
Monitoring and incidents
- Platform status is public at status.dockflow.com.
- Metrics and logs are centralised, with automated alerting.
- Under the DPA, Dockflow notifies customers of a security incident without undue delay and within 72 hours of becoming aware of it.
Privacy and data handling
- After a contract ends, Dockflow provides a full export within 30 days and deletes personal data from active systems within 60 days. Backups expire on their normal schedule.
- Dockflow uses only irreversibly anonymised, aggregated data to improve its tracking and prediction algorithms.
- Customers can audit under the terms in section 14 of the DPA.
- Dockflow holds professional liability insurance.
Sub-processors
These services may process customer data on behalf of Dockflow. Last updated: November 6, 2026.
Infrastructure and hosting
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Google Cloud | Cloud infrastructure: Kubernetes compute, managed databases, Redis, object storage, data warehouse | All customer data | EU (Belgium) |
| Cloudflare | Edge network: DNS, DDoS protection, CDN, TLS termination | All data in transit, IP addresses | Global edge network |
| Microsoft Azure | SFTP file exchange, outbound network proxy, internal automation | Files exchanged over SFTP, support ticket content | EU (Netherlands) |
| GitHub (Microsoft) | Source code hosting, CI/CD, container registry | Deployment artifacts, platform metadata | EU/US |
| Hetzner | Server for internal engineering automation | Platform data read for engineering work, including shipping references | EU (Finland) |
Application services
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Elastic Cloud | Full-text search and analytics | Shipping references, search queries | EU (Belgium) |
| Grafana Labs | Observability: metrics and logs | Platform logs, usage metrics, IP addresses | EU (Sweden) |
| MailerSend | Transactional email delivery | User email addresses, notification content | EU |
| Sentry | Application error monitoring | Error reports, which can contain user identifiers and request data | EU (Germany) |
| OpenRouter | AI model gateway for internal engineering automation | Support ticket content and platform data used in engineering work | US |
Business operations
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Odoo SA | ERP: invoicing, sales and subscription management | Customer company name, billing contact details | EU (Belgium) |
| HubSpot | Customer relationship management | Customer contact details, company information | EU/US |
| Google Workspace | Business email and internal communication | Email correspondence with customers | EU |
Carrier data sources
Dockflow connects to shipping line APIs and data providers to retrieve container tracking information. These connections transmit shipping reference data only (container numbers, bill of lading numbers, booking numbers) and include no personal data of end users, so they are not sub-processors under the DPA.
Dockflow notifies customers at least 30 days in advance of any intended addition or replacement of a sub-processor. To receive these notices, contact [email protected].
In progress
- Two-factor authentication and single sign-on for the Dockflow platform. Today users log in with a password or a magic link.
- Closing the gaps identified for ISO 27001.
Documents and contact
For a completed security questionnaire, further documents or any security question, contact [email protected]. For privacy questions, contact [email protected].
To report a vulnerability, write to [email protected]. Please include enough detail to reproduce the issue.
Dockflow BVThe Beacon
Sint-Pietersvliet 7
2000 Antwerpen, Belgium
Updates
November 6, 2026: first publication of this page. Sub-processor list moved here from the documentation, with Hetzner, Sentry and OpenRouter added.