# Your data is safe with us

Protecting your customer data is our highest priority. Reflag keeps data in the EU on our secure infrastructure based on industry-standard systems.

Trusted by the top tech companies

## How Reflag ensures data security and privacy

### No PIl required

We’ve designed Reflag not to require any Personal Identifiable Information (PII) to function, so it’s easy to get started.

### Hosted in the EU

You can optionally choose to have all your customer data hosted on servers located in the European Union to ensure compliance with the EU’s strict data privacy laws, present and future.

### Certified infrastructure

Our servers run on industry-standard infrastructure at Amazon Web Services and use best-in-class data storage systems like Postgres and Clickhouse.

### User data never leaves our servers

We ensure that any data about your users is never shared with any external provider and never leaves our servers.

### Encrypting data in transit and at rest

We use HSTS and HSTS preload to ensure that requests are never made over non-encrypted connections.

### Regular penetration testing

We conduct periodic third-party manual penetration testing of both our application and infrastructure.

## Compliance and certifications

### EU GDPR Compliant

### SOC II

PENDING

### ISO 27001

PENDING

### Security policy

Our security consists of multiple backups, secure hosting, rate limiting, code changes that are thoroughly tested through our Continuous Integration software, and more. Discover all our security measures.

[Security policy](https://reflag.com/legal/security-policy)

### Privacy policy

All data Reflag collects is subject to GDPR privacy regulations. These laws allow us to enforce strict security policies that ensure it remains private and secure while also giving you more control of your data and how it’s used.

[Privacy policy](https://reflag.com/legal/privacy-policy)

### Data processing agreement

We process all data under strict European Union privacy and security requirements. This includes implementing industry-standard security measures, storing data within the EU, and restricting data subprocessing.

[Data processing agreement](https://reflag.com/legal/dpa)