Skip to main content

Trust center · Compliance

Compliance posture & disclosure

Where Driftstack stands on certification, plus the private disclosure channel for security findings.

Certification and data processing

Driftstack is not currently SOC 2 or ISO 27001 certified.

We offer a GDPR data-processing agreement: Data Processing Agreement.

Vulnerability disclosure policy

Report security issues privately to [email protected]. If a report contains customer data or exploit material, use the initial email to arrange an encrypted transfer channel.

Response commitments
  • Acknowledge receipt within one business day.
  • Send a severity assessment and a rough fix timeline within 7 days.
  • Credit the reporter publicly after remediation, with consent.
Safe harbour
We will not pursue legal action against good-faith research that follows our Vulnerability Disclosure Policy.

Sub-processor change notice

Section 3.4 of our DPA, under GDPR Article 28(2), sets when a material addition or replacement on the sub-processor list takes effect and the notice customers get. Customers can object by emailing [email protected].

Log retention

  • Your account's audit log is available in the Driftstack dashboard. Entries are kept for as long as your account exists, on every plan.
  • Marketing-site access logs are kept for 30 days.