ISO/IEC 27002:20222022
Information Security Controls
Coverage100%
Trust center
Security and privacy,
on the record.
Where your data lives, who can touch it, and what our AI does with it, in plain language. Swiss-hosted, encrypted, and yours to export any time.
Maps toISO/IEC 27001SOC 2GDPRFADPNIS2
How we protect your data
The facts, before the fine print.
The things a security team actually needs to know: where your data lives, who can reach it, and what leaves your control.
Hosted in Switzerland
Customer data is hosted in Switzerland only. AI features run in the EU (AWS eu-central-1, Frankfurt), and only when you use them.
Encrypted and secure
Everything is encrypted in transit and at rest, behind strict access controls and audit logs over who can reach your data.
AI you can switch off
AI features are on by default, EU-hosted, and switchable off for the whole workspace in your settings. Nothing is sent to an AI service unless you trigger it, and we never train models on your data.
No lock-in
Export everything you put in, any time, in standard formats. Your compliance data is yours to take with you.
Data we collect
We are transparent about the data we collect and how we use it. We only collect data necessary to provide and improve our services.
What we collect
We collect Customer personally identifiable information.
These include standard personal data necessary for providing our services.
We collect Employee personally identifiable information.
These include employment-related data necessary for HR, payroll, and operational purposes.
What we never collect
We do not collect credit card information.
Payment details are handled exclusively by certified third-party payment providers.
We do not collect sensitive personal information.
These include also particularly sensitive personal data according to swiss law.
For more information about our data collection practices, please refer to our Privacy Policy.
AI in devguard
AI is not the core of our product but can be used to enhance your workflows. All AI features can be disabled at any time.
Easy to opt out
AI features are enabled by default but can be disabled at any time in your settings. No data is sent to AI services unless you explicitly trigger an AI-powered action.
Not the core of the product
devguard is a compliance platform first. AI serves as an optional enhancement to help with tasks like drafting policies or suggesting control mappings. The platform is fully functional without any AI features enabled.
EU-hosted AI processing
When AI features are used, processing is handled through AWS Bedrock in the EU (eu-central-1, Frankfurt) using closed-source foundation models. We do not train or fine-tune any models on customer data.
Frequently asked questions
Find answers to common questions about our security practices and data handling.
How does devguard protect my data?
We protect your data with multiple layers of security: encryption at rest and in transit, strict access controls, and continuous monitoring. Customer data is hosted in Switzerland only, under Swiss data protection law.
What certifications does devguard have?
We hold no formal certification yet. We're working toward one, and we publish our own coverage against ISO 27001, GDPR and the Swiss nFADP as we go, measured against our control set rather than an external audit. Our infrastructure providers hold their own ISO 27001 certifications and SOC 2 reports, which you can check on the compliance page we link for each subprocessor.
Where is my data stored?
Customer data is hosted in Switzerland only. AI features run in the EU, on AWS Bedrock in eu-central-1 (Frankfurt), and only when you trigger them. Payment details are handled by our payment provider, listed with the other subprocessors below.
Who has access to my data?
Access to customer data is strictly limited to authorized personnel who need it to provide and improve our services. All employees sign confidentiality agreements and undergo security training. We maintain detailed audit logs of all data access.
How do you keep the platform secure?
Security is part of how we build, not a separate event. Every change goes through code review, our dependencies and infrastructure are automatically scanned for known vulnerabilities, and we monitor our systems continuously. As devguard grows, we're working toward formal third-party penetration testing and audits.
How can I request deletion of my data?
You can request data deletion at any time by contacting our support team or through your account settings. We will process your request within 30 days in accordance with GDPR requirements, except where we are legally required to retain certain information.
What happens in case of a data breach?
In the unlikely event of a data breach, we have an incident response plan that includes immediate containment, investigation, and notification procedures. We will notify affected customers within 72 hours as required by GDPR, along with detailed information about the incident and mitigation steps.
Can I export my data?
Yes. You can export your data yourself at any time: every list view, from risks and assets to vendors and actions, exports to CSV, and all ten report types export to PDF. For a full export or anything the in-app tools don’t cover, our support team can help.
Report a vulnerability
Found a security issue? Contact us at the email below. We welcome and appreciate your contribution to safety.
[email protected]
No bounty program yet,
but we welcome responsible disclosure.
Swiss made software
Swiss precision. Global compliance.
Built with the precision and reliability Switzerland is known for, and hosted here too. A strong fit for teams meeting strict European standards like ISO 27001 and GDPR, where data privacy isn't a nice-to-have.
Secure
Private
Ownership
Help shape the future of compliance.
We're early, and the teams using devguard now help shape what it becomes. Tell us what's missing, and there's a real chance you'll see it ship.