Trust center
Security, privacy and legal documents in one place.
Security architecture, sub-processor list, legal agreements, and incident history — published in one place. Buyer evaluations and ongoing GDPR / data-processing-agreement (DPA) reviews can start here without an email chain.
Security
Architecture + posture →
Six promises in place today: everything between you and us is encrypted (TLS); each profile can use a SOCKS5 proxy or, on paid plans, a VPN (OpenVPN or WireGuard) you choose — the desktop app launches a profile only through the one you chose for it (never one it picks for you), every agent session names one of your saved proxies, and we do not route your traffic through a shared exit of our own; API keys are stored only as one-way hashes that nobody — including us — can read back; every webhook is signed so you can confirm it came from us; your whole team can view but only admins can change; and the live view of a session is encrypted in transit, never stored, and gives Driftstack staff no built-in way to join it. Two-factor sign-in, an active sign-ins list you can revoke from, and a CSV export of your audit log come with every plan. Our API and main database run in the EU; the live view is streamed to Driftstack's own video relay on the Mac running the session (US or the Netherlands). The current status of each promise is on the security overview (its own card below).
Sub-processors
Live list + regions →
Every outside company that handles customer data for us (our sub-processors), with where it runs, what it does, and the legal basis for any data leaving the EU (the transfer mechanism). This list carries the same sub-processors as Section 7 of our Privacy Policy, the authoritative list, and Annex 3 of our data-processing agreement (DPA) lists them in short. Section 3.4 of the DPA sets the notice for a change to it under GDPR Article 28(2).
Incident history
Past events + post-mortems →
Customer-impacting outages and security incidents, with timestamps, customer impact, root cause, and the remediation we applied. Live status badge above for current platform health.
Legal
DPA · Privacy · Terms · AUP →
Standard agreements, accepted in your dashboard: Data Processing Agreement (GDPR Article 28, including the EU's Standard Contractual Clauses — SCCs — for data sent abroad), Privacy Policy (the GDPR Article 13–15 disclosures: what we collect and your rights over it), Terms of Service, Acceptable Use Policy.
Compliance
Compliance + disclosure →
Where we stand on certification, how to report a security issue privately, our safe-harbour commitment for good-faith research, sub-processor change notice, and current log-retention periods.
Security overview
Evaluator's checklist →
Every security claim in one list, with how it works — two-factor sign-in, revocable sign-ins, device-code sign-in for the desktop app, per-profile proxy and VPN checks, audit-log export, retention.
Device fingerprint
Signal-by-signal methodology →
Every measurable fingerprint signal — the details a website can read about a browser — checked one by one against a real reference iPhone, shown side by side with what a typical disguised-Chromium ("stealth") tool returns.
Quick reference
The questions buyer evaluations always ask.
- Where is data hosted?
- Account data in the EU; sessions in the US or the Netherlands. Servers in Falkenstein, Germany (Hetzner); database in Frankfurt (Neon); file storage on Cloudflare R2, which keeps copies in both the EU and the US. The sessions themselves run on Macs hosted in the US (MacStadium) or the Netherlands (Green Mini host). Full list at /trust/sub-processors.
- Do you see our destination URLs?
- Yes. When you or your agent open a URL, Driftstack processes that URL and keeps a record of the visit for your account. The page traffic itself goes out through your own SOCKS5 proxy or VPN — the desktop app launches a profile only through the one you chose for it (a profile with none chosen does not launch), and every agent session names one of your saved proxies. Driftstack does not route it through a shared exit of its own.
- Are API keys recoverable by staff?
- No. Keys are stored only as one-way hashes (scrypt) — staff, and even a database thief, see scrambled values, not keys. If a key leaks, rotate it in the dashboard; the old key keeps working for 24 hours (the grace window) so nothing breaks mid-switch.
- How do we get a DPA on file?
- The DPA at /legal/dpa is part of our Terms; it applies once your account accepts it in the dashboard. For each transfer of data outside the EU listed in Annex 3 (the vendor list attached to the DPA), we rely on the EU-US Data Privacy Framework where the vendor is certified under it, and otherwise on the EU's Standard Contractual Clauses (SCCs).
- What's the incident-response SLA?
- Most plans come without a contractual uptime guarantee (an SLA) — we publish incidents at /trust/incidents and the live status above. Enterprise includes the uptime commitment and response times set in its contract — see the SLA policy.
- Can we use two-factor sign-in and see who is signed in?
- Yes, on every plan. Two-factor sign-in uses an authenticator app plus recovery codes, and risky actions ask for a fresh code even when you are already signed in. The dashboard lists every active sign-in and lets you revoke one or all of the others; a password change signs out every other session. Every security event is in your audit log, exportable as CSV.
- How do we get a security questionnaire answered?
- Email [email protected] with the document; we'll fill it line-by-line. Standard security-questionnaire formats (CAIQ / VSAQ), custom spreadsheets, and vendor portals all welcome.
Compliance review
Bring the questionnaire. We'll fill it.
Standard security-questionnaire formats (CAIQ, VSAQ) and custom enterprise vendor questionnaires — all welcome. Most answers come from the pages linked above; we answer the remaining items in writing.