Security, Compliance & Privacy | commercetools Trust Center
Trust is the foundation of everything we do
Security and trust are at the core of our platform. We are committed to responsibly managing customer data and providing full transparency into how it is stored, processed and used.
SECURITY AT A GLANCE
Security built into every layer
Managing customer data responsibly is fundamental to the commercetools platform. Built on a cloud-native, multi-tenant architecture, it runs on certified infrastructure across Europe, the US and APAC, leveraging leading cloud providers and modern security standards.
Physical security
Our platform is hosted on Google Cloud Platform (GCP) and Amazon Web Services (AWS), both of which operate state-of-the-art, ISO/IEC 27001-certified data centers that are SOC 2 compliant. These environments are designed with security and data protection as core principles. In addition, commercetools offices are access-controlled, monitored and managed through strict visitor and zoning procedures to ensure physical security.
Network security
All traffic is protected using cloud-native Web Application Firewall (WAF) protections and encrypted using modern cipher standards. Access to internal networks is restricted, monitored and secured using encrypted protocols and firewalled infrastructure.
Platform security
All communication with the platform is encrypted via HTTPS using TLS 1.2 or higher. Data at rest is encrypted using AES-256, and passwords are never stored in plain text. The platform is continuously monitored for vulnerabilities, with regular penetration testing to ensure that isolation and data segregation standards are maintained.
Operational security
Security is governed by a formal Information Security Management System (ISMS), overseen by an Information Security Officer. Policies, processes and controls are continuously reviewed and improved to maintain strong security and compliance standards.
Backup & recovery
Data is backed up across geographically separated environments to ensure resilience and availability. Backups are encrypted and stored separately from production systems, enabling reliable recovery and protection against data loss.
Training & awareness
All employees and contractors complete confidentiality agreements and receive regular security and privacy training to ensure awareness and adherence to best practices.
Certificates & standards
Independent certifications that validate our commitment to security, privacy and reliability.
Cyber Essentials
GDPR
SOC II
ISO/IEC 27001
PRIVACY
Compliant with data protection and privacy regulations
Management processes
Our Data Protection Management System is integrated into our Information Security Management System and aligned with ISO/IEC 27001 and ISO/IEC 27701 standards. Both systems are centrally managed and regularly reviewed through internal and external audits.
Security of data processing activities
We implement appropriate technical and organizational measures (TOMs) to ensure secure processing of information across all services and infrastructure.
Data deletion
Deletion requests from data controllers are executed in accordance with applicable instructions. Internal data retention and deletion policies are also defined and enforced.
Data processing agreement
Under GDPR Article 28, data controllers are required to engage only processors that provide sufficient safeguards. commercetools offers a Data Processing Agreement (DPA) upon request via privacy@commercetools.com.
Data protection officer
commercetools has appointed an external Data Protection Officer who works closely with our internal Data Protection Coordinator. They can be contacted at privacy@commercetools.com.
International data transfer
Where data is transferred outside the EU, commercetools uses appropriate legal safeguards, including EU Standard Contractual Clauses, to ensure compliance with GDPR requirements.
Compliant with GDPR, CCPA and Australia Privacy Act
commercetools is committed to compliance with global privacy regulations, including GDPR, CCPA and the Australian Privacy Act, ensuring consistent protection of personal data across regions.
RELIABILITY
Built for scale and always-on commerce
commercetools is a cloud-native, modular platform designed for high availability and consistent performance across all digital touchpoints. It enables seamless customer experiences across devices and channels, while running on a containerized, cloud-agnostic architecture (GCP and AWS) with full auto-scaling for resilient, always-on operations.
Business Continuity Management (BCM)
Our Business Continuity Management ensures that critical services can be restored within defined and agreed timeframes. The business continuity plan identifies potential internal and external risks and combines technical and organizational measures to ensure resilience. It includes procedures for operating under adverse conditions, such as natural disasters, cyber threats or human error, to ensure the continuity of day-to-day business operations.
Performance management
Performance management ensures that our infrastructure, service and supporting processes deliver a consistent, cost-effective level of availability and reliability aligned with customer needs. Built on a cloud-native architecture, the commercetools platform supports automatic scaling as demand increases across customers and workloads.
Change management process
Changes may be initiated by customers via support tickets, our Platform Support Team or internal teams to improve functionality, resolve issues, or enhance performance. All changes are implemented through automated CI/CD pipelines in appropriate development and test environments. Structured review and approval processes before being deployed through staging environments into production.
Enterprise-grade compliance by design
We align with the highest international standards and continuously invest in the infrastructure, certifications and controls that enterprise customers expect. From GDPR to ISO to anti-corruption practices, our approach to compliance is proactive, rigorous and built to scale.