bundle.social Trust CenterSecurity, privacy and compliance

Security and trust at bundle.social

We help organisations publish posts, manage private messages and import comments across 15 platforms. Handling this data comes with a responsibility we take seriously. This page explains the policies we follow and the security controls we have in place.

Request our DPASelf-assessed October 2026

Where our compliance work stands

We assess ourselves against the SOC 2 Trust Services Criteria and ISO/IEC 27001:2022 Annex A, control by control, and run GDPR as a working process rather than a page of promises. Open one for what it covers.

26

Policies

An up to date list of policies published internally by bundle.social.

  • Information Security Governance
  • Policy Management & Exceptions
  • Risk Management
  • Compliance & Regulatory Monitoring
  • Access Control & Least Privilege
  • Authentication & Passwords
  • Acceptable Use
  • Devices, Remote Work & BYOD
  • Data Classification & Handling
  • Data Retention & Secure Disposal
  • Encryption & Key Management
  • Privacy & Data Subject Rights
  • Information Sharing & Transfer
  • AI Tools
  • Secure Software Development
  • Change & Release Management
  • Secure Configuration & Hardening
  • Vulnerability & Patch Management
  • Logging, Monitoring & Audit Trail
  • Incident Response & Breach Notification
  • Backup, Business Continuity & Disaster Recovery
  • Vendor & Third-Party Risk
  • Personnel Security & On/Off-boarding
  • Sanctions & Disciplinary
  • Security & Privacy Awareness Training
  • Physical & Environmental Security
24

Controls

Safeguards that are implemented today and can be shown, grouped by area.

Access

  • Named accounts, MFA required
  • The database is not on the internet
  • Two independent gates on the admin panel
  • Revocation is fast, granting is deliberate

Application

  • Typed contracts on every endpoint
  • Authorisation in the service layer
  • Platform credentials encrypted before storage
  • Kill switches on sensitive features

Change

  • Code review on pull requests
  • Migrations cannot be skipped
  • What ships is what was reviewed
  • Environments are separate

Your data

  • Classified stores, enforced retention
  • Erasure is a hard delete
  • Card data never reaches us
  • Third-party data gets the strictest handling

Operations

  • One way in, and it is encrypted
  • Backups leave the blast radius
  • Automated error and uptime monitoring
  • A written incident plan, and a register

Governance

  • An approved policy set
  • Risks are owned, and accepted in writing
  • Every vendor is on the register
  • Reviewed once a year, exercised separately
14

Subprocessors

Every provider that processes customer data on our instruction. Open a row for what it sees and on what basis.

Questions we get asked

The answers our team gives in a vendor review, written down so they do not depend on who replies.

Do you offer a DPA?

Yes. Email [email protected] with your company's legal name, registered address and company number, the person who will sign, and what you use bundle.social for. We send our standard data processing agreement, with the subprocessor list and the transfer safeguards each subprocessor relies on.

Do you have a SOC 2 report?

Not yet. We run an internal assessment against the SOC 2 Trust Services Criteria and ISO/IEC 27001:2022 Annex A, and share an overview of it on request. For a security review we provide that overview together with our DPA.

Where is our data stored?

Application servers and databases are self-hosted behind a firewall in Germany, in the European Economic Area. Files and database backups are held in Cloudflare object storage.

Is our data encrypted?

In transit, yes: TLS for all traffic to our services.

At rest, credentials for your connected social accounts are encrypted at application level before storage, and files and backups sit in object storage that encrypts at rest.

Do you use our data to train AI models?

No. We do not train models on customer data. Our engineers use an AI assistant on our own source code, and when we investigate a report we may share technical details of it, such as an error message. Never anything that can be traced to a specific user, and never credentials, exports of customer data, uploaded files, or private messages between you and your audience.

Will you notify us of a breach?

Yes. Where we act as processor we notify the affected customer without undue delay after becoming aware of a breach that may affect their data, and add detail as the investigation progresses. If your agreement needs a fixed number of hours, that is where we agree it. Where we act as controller and a breach is notifiable, we notify the supervisory authority within 72 hours of becoming aware of it, as the GDPR requires.

What about uptime and SLA?

Our uptime is public on our status page.

When a feature does misbehave, the cause is most often on a platform's side, an API outage or an unannounced change at one of the networks, and it affects that platform's features rather than bundle.social as a whole. Live per-platform health is in our health endpoint documentation.

How do we report a vulnerability?

Write to [email protected] or use the channel in our security.txt. A confirmed live vulnerability is handled as an incident, not as a routine ticket.

Resources

Privacy policyWhat we collect as controller, and why.Terms of serviceThe agreement your account runs under.Service statusLive health of each connected platform.API documentationScopes, webhooks and how auth works.security.txtWhere to report a vulnerability.Brand kitLogos and the seals on this page.

Sending us a security questionnaire?

Send it over. We answer from a prepared sheet rather than improvising, and we tell you plainly when the answer is no.

Email [email protected]Read the FAQ