Trust Center
Our security commitment to protect your compliance data.
EU Hosting
Data residency
The ConformITly platform and its data are hosted by DigitalOcean in the Frankfurt region (FRA1), within the European Union. This presentation website is also hosted by DigitalOcean (App Platform) and delivered through its content delivery network (CDN); it handles no platform data.
Infrastructure provider
The platform runs on DigitalOcean (servers, managed database, file storage), in ISO 27001 and SOC 2 certified data centers in Frankfurt, Germany.
Data Protection
Encryption at rest
All data is encrypted at rest using AES-256 encryption. Database backups are also encrypted.
Encryption in transit
All communications are encrypted with TLS 1.2 or later (TLS 1.3 when the client supports it). HTTPS is enforced on all endpoints with HSTS headers.
Data isolation
Each organization's data is isolated: every query is filtered by organization at the application layer, and access is checked against the user's role on each entity.
Backups
Encrypted daily backups with 30-day retention, and a documented, tested disaster recovery plan.
Application Security
Authentication
JWT authentication with token rotation, optional two-factor authentication (TOTP), and role-based access control (RBAC) per entity.
Security testing
Automated security tests run in the CI/CD pipeline before every deployment.
Audit logging
A complete audit trail records user actions.
Security by design
Security is built into every step of the development cycle.
Certifications
ConformITly does not hold a certification yet. The two below are planned to strengthen our customers' trust.
ISO 27001
Planned: certification of the information security management system, scheduled for 2027.
SOC 2 Type II
Planned: audit of the security, availability and confidentiality controls.
Subprocessors
We work with a limited number of carefully selected subprocessors. Platform data stays within the European Union; only payments (Stripe) may involve a safeguarded transfer outside the EU.
| Subprocessor | Purpose | Location |
|---|---|---|
| DigitalOcean | Platform hosting (servers, database, file storage) and this presentation website | EU (Frankfurt, FRA1 region); presentation website delivered through a CDN |
| Brevo | Platform emails | EU (France) |
| Stripe | Payment and billing | EU (Ireland), safeguarded transfers to the United States |