Skip to content
Book a demo
Trust Center

Security, GDPR and data residency: what we claim, and when.

WidinX handles product data that companies consider sensitive. This page states plainly how we protect it, where it lives (EU data residency is available), how we handle GDPR, and which independent proofs are in progress.

Last updated 2026-09-05

At a glance
  • HostingEU region, single cloud
  • EncryptionIn transit & at rest
  • Personal data on-chainNever
  • Independent pentestDec 2026
  • ISO/IEC 27001Target H1 2027
  • DPAAvailable on request
Commitments

Five things you can hold us to.

Privacy & security by design

Threat modelling, data minimisation and security review are part of how features are built, not a phase after.

EU data residency available

Production runs in the EU on a single cloud provider. Each tenant carries a primary and backup region as a business setting.

Encryption in transit and at rest

TLS for all traffic, encrypted databases, object storage and backups, keys managed by the cloud KMS.

Role-based access

Least-privilege roles, MFA for privileged accounts, periodic access reviews and SSO/SAML planned for enterprise tenants.

Auditability

Tamper-evident logs for sensitive actions, versioned passports and signatures checkable against published keys.

Architecture principles

Designed so the answer to “where is my data?” is short.

No personal data in public passports

Public passports carry product data only. Personal data and restricted documents stay behind sign-in, in your authorised data plane.

Tenant isolation

Customers are logically isolated and isolation is covered by automated tests. Dedicated deployments are available for specific requirements.

Backups you can restore

Encrypted backups with defined RPO/RTO objectives and scheduled restore drills before onboarding production customers.

Transparent AI usage

Every model, provider, data category, region and retention setting is inventoried. No customer data is used to train third-party models.

Secure development

Static analysis, dependency and secret scanning in CI, reviewed changes and a documented patch and vulnerability process.

Incident response

A documented response process with customer notification commitments and a dedicated security contact.

Assurance roadmap

Independent proof, on a public schedule.

We publish the plan rather than a badge we have not earned. Dates are targets and will be updated here as milestones are reached.

What we don’t claim

  • We are not yet ISO/IEC 27001 certified. Certification is targeted for H1 2027 (see roadmap).
  • We do not describe ourselves as “GDPR certified”. GDPR compliance is an ongoing obligation we operate, not a badge.
  • We have not completed a SOC 2 examination. We will consider one if customers require it.
  1. Sep 2026Done

    Trust Center v0 & privacy notices

    This page, our privacy policy and website data practices published.

  2. Oct 2026In progress

    Security baseline

    MFA and privileged access controls, incident response process and security contact in place.

  3. Nov 2026Planned

    Sales-ready security pack

    Data Processing Agreement v1, subprocessor list and a security questionnaire pack available to prospects.

  4. Dec 2026Planned

    Independent penetration test

    Web, API, authentication and tenant isolation tested by an independent firm; critical and high findings remediated.

  5. Jan 2027Planned

    First-client production review

    Residency, restore, monitoring and onboarding controls reviewed before the first production customer.

  6. H1 2027Planned

    ISO/IEC 27001:2022 certification

    Information security management system audited on a defined scope covering the platform, cloud, development and support.

Data processing

Roles, agreements and subprocessors.

Controller / processor

For product and supply-chain data you upload, WidinX acts as processor on your instructions. For website and account data, WidinX is the controller — see the privacy policy.

Data Processing Agreement

A DPA with standard contractual clauses where required is available to customers on request.

Subprocessors

Cloud hosting (EU region), transactional email, CRM, monitoring, and an AI model provider (used only when you switch the assistant on). The named list is provided with the DPA and kept current.

International transfers

Customer data is hosted in the EU. Where a subprocessor operates outside the EEA, transfers rely on approved mechanisms and are documented.

Need our DPA, subprocessor list or a security questionnaire answered?

Request the security pack
Responsible disclosure

Found something? Tell us.

If you believe you have found a security vulnerability in WidinX, email our security team. We acknowledge reports within three business days, keep you informed, and do not pursue researchers acting in good faith.

[email protected]