> For the complete documentation index, see [llms.txt](https://learn.doubletick.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://learn.doubletick.io/get-started-with-doubletick/security-and-compliance.md). # Security and Compliance See how DoubleTick's EU GDPR compliance, ISO 27001 certification, and SOC 2 compliance work together to keep your business and customer data secure. At DoubleTick, your data security and privacy are foundational to how we build, operate, and deliver our platform. We understand that modern businesses demand trust, transparency, and global compliance when handling customer information. These certifications are globally recognized benchmarks for data privacy and information security — bringing real protections and assurances for you and your customers. To meet these expectations, DoubleTick is proud to be:\ **EU GDPR Compliant**\ **ISO 27001 Certified**\ **SOC 2 Compliant** #### What's covered * [What GDPR compliance means for DoubleTick](/get-started-with-doubletick/security-and-compliance.md#what-is-gdpr-compliance) * [What ISO 27001 certification means for DoubleTick](/get-started-with-doubletick/security-and-compliance.md#what-is-iso-27001-certification) * [What SOC 2 compliance means for DoubleTick](/get-started-with-doubletick/security-and-compliance.md#what-is-soc-2-compliance) * [What these certifications mean for your data](/get-started-with-doubletick/security-and-compliance.md#what-this-means-for-your-data) * [Key takeaways](/get-started-with-doubletick/security-and-compliance.md#key-takeaways) * [Frequently asked questions](/get-started-with-doubletick/security-and-compliance.md#frequently-asked-questions) #### What Is GDPR Compliance? GDPR (General Data Protection Regulation) is the EU's data protection law that gives individuals strict control over how their personal data is collected, processed, and stored. Even companies outside the EU must comply if they process data of EU residents. Being GDPR compliant means DoubleTick upholds: * **Purpose Limitation:** Data is collected only for defined, legitimate business purposes. * **Data Minimization:** Only essential personal data is processed. * **Consent:** Users must explicitly opt-in before being messaged or having their data processed. * **Rights to Access & Erasure:** Individuals can request access to or removal of their data. * **Data Security:** Measures are in place to prevent unauthorized access, loss, or misuse. * **Transparency:** Data practices are openly disclosed through clear privacy policies. * **Purpose Limitation:** Data is collected only for defined, legitimate business purposes. #### What Is ISO 27001 Certification? ISO 27001 is a globally respected standard for Information Security Management Systems (ISMS). It provides a structured framework for identifying, managing, and reducing risks to sensitive data. This certification confirms that DoubleTick systematically assesses security risks, implements controls, monitors effectiveness, and trains teams on information security — on an ongoing basis, not just at a point in time. It is built around three core principles: * **Confidentiality:** Data is accessible only to authorized users. * **Integrity:** Data remains accurate and untampered. * **Availability:** Data is accessible when needed by authorized users. #### What Is SOC 2 Compliance? SOC 2 (System and Organization Controls 2) is an independent audit standard developed by the AICPA, specifically for technology and cloud-based service providers. Unlike ISO 27001, SOC 2 is a third-party verified audit — meaning compliance is independently assessed, not self-declared. It evaluates DoubleTick against five Trust Service Criteria: * **Security:** Systems are protected against unauthorized access. * **Availability:** Systems are operational and accessible as committed. * **Processing Integrity:** Data processing is complete, accurate, and timely. **Confidentiality:** Confidential data is protected as agreed. **Privacy:** Personal information is handled in line with privacy commitments. #### What This Means for Your Data Across all three certifications, your data is: * Collected and stored with clear legal purpose * Access-controlled, role-based, and monitored * Protected against unauthorized access and security risks * Subject to regular audits and continual improvement Together, these standards ensure DoubleTick adheres to internationally recognized security and privacy requirements — whether you operate in the EU, UK, APAC, or globally. Your data is in safe hands — because we follow the highest standards recognized worldwide for privacy and security. #### Key takeaways * DoubleTick is **EU GDPR compliant**, **ISO 27001 certified**, and **SOC 2 compliant** — three globally recognized benchmarks for data privacy and security. * GDPR ensures your data is collected with a legitimate purpose, minimized, consented to, and accessible or erasable on request. * ISO 27001 certification confirms DoubleTick runs an ongoing Information Security Management System built on confidentiality, integrity, and availability. * SOC 2 is an independently audited standard — not self-declared — evaluating DoubleTick against five Trust Service Criteria. * Together, these certifications mean your data stays access-controlled, monitored, and regularly audited, wherever your business operates. #### Frequently asked questions **Do I need to take any extra steps to benefit from these certifications?**\ No. GDPR compliance, ISO 27001 certification, and SOC 2 compliance are all managed at the platform level — your data is protected by default across all three standards. **Does GDPR compliance apply if my business is outside the EU?**\ Yes. GDPR applies to any company that processes personal data belonging to EU residents, regardless of where the business itself is located. **What's the difference between ISO 27001 and SOC 2?**\ ISO 27001 is a certification confirming DoubleTick's Information Security Management System meets a global standard. SOC 2 is an independent, third-party audited report — meaning compliance is verified externally rather than self-declared. **Can I request access to or deletion of my data?**\ Yes. Under GDPR's rights to access and erasure, you can request to view or remove your personal data at any time. **Where can I learn more about how DoubleTick secures customer data?**\ Reach out to your **Account Manager** or DoubleTick Support for details on our security practices, audit reports, or compliance documentation. #### Related topics * [Prerequisites for Onboarding](/get-started-with-doubletick/prerequisites-for-onboarding.md) * [How to verify your META business](/meta-business-setup/meta-business-verification/how-to-verify-your-meta-business.md) * [Onboarding](/get-started-with-doubletick/onboarding.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://learn.doubletick.io/get-started-with-doubletick/security-and-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.