Security and trust are at the core of our platform. We are committed to responsibly managing customer data and providing full transparency into how it is stored, processed and used.
Managing customer data responsibly is fundamental to the commercetools platform. Built on a cloud-native, multi-tenant architecture, it runs on certified infrastructure across Europe, the US and APAC, leveraging leading cloud providers and modern security standards.
Our platform is hosted on Google Cloud Platform (GCP) and Amazon Web Services (AWS), both of which operate state-of-the-art, ISO/IEC 27001-certified data centers that are SOC 2 compliant. These environments are designed with security and data protection as core principles. In addition, commercetools offices are access-controlled, monitored and managed through strict visitor and zoning procedures to ensure physical security.
All traffic is protected using cloud-native Web Application Firewall (WAF) protections and encrypted using modern cipher standards. Access to internal networks is restricted, monitored and secured using encrypted protocols and firewalled infrastructure.
All communication with the platform is encrypted via HTTPS using TLS 1.2 or higher. Data at rest is encrypted using AES-256, and passwords are never stored in plain text. The platform is continuously monitored for vulnerabilities, with regular penetration testing to ensure that isolation and data segregation standards are maintained.
Security is governed by a formal Information Security Management System (ISMS), overseen by an Information Security Officer. Policies, processes and controls are continuously reviewed and improved to maintain strong security and compliance standards.
Data is backed up across geographically separated environments to ensure resilience and availability. Backups are encrypted and stored separately from production systems, enabling reliable recovery and protection against data loss.
All employees and contractors complete confidentiality agreements and receive regular security and privacy training to ensure awareness and adherence to best practices.
Independent certifications that validate our commitment to security, privacy and reliability.
Managing customer data responsibly is fundamental to the commercetools platform. Built on a cloud-native, multi-tenant architecture, it runs on certified infrastructure across Europe, the US and APAC, leveraging leading cloud providers and modern security standards.
Our Data Protection Management System is integrated into our Information Security Management System and aligned with ISO/IEC 27001 and ISO/IEC 27701 standards. Both systems are centrally managed and regularly reviewed through internal and external audits.
We implement appropriate technical and organizational measures (TOMs) to ensure secure processing of information across all services and infrastructure.
Deletion requests from data controllers are executed in accordance with applicable instructions. Internal data retention and deletion policies are also defined and enforced.
Under GDPR Article 28, data controllers are required to engage only processors that provide sufficient safeguards. commercetools offers a Data Processing Agreement (DPA) upon request via privacy@commercetools.com.
commercetools has appointed an external Data Protection Officer who works closely with our internal Data Protection Coordinator. They can be contacted at privacy@commercetools.com.
Where data is transferred outside the EU, commercetools uses appropriate legal safeguards, including EU Standard Contractual Clauses, to ensure compliance with GDPR requirements.
commercetools is committed to compliance with global privacy regulations, including GDPR, CCPA and the Australian Privacy Act, ensuring consistent
protection of personal data across regions.
commercetools is a cloud-native, modular platform designed for high availability and consistent performance across all digital touchpoints. It enables seamless customer experiences across devices and channels, while running on a containerized, cloud-agnostic architecture (GCP and AWS) with full auto-scaling for resilient, always-on operations.
Our Business Continuity Management ensures that critical services can be restored within defined and agreed timeframes. The business continuity plan identifies potential internal and external risks and combines technical and organizational measures to ensure resilience. It includes procedures for operating under adverse conditions, such as natural disasters, cyber threats or human error, to ensure the continuity of day-to-day business operations.
Performance management ensures that our infrastructure, service and supporting processes deliver a consistent, cost-effective level of availability and reliability aligned with customer needs. Built on a cloud-native architecture, the commercetools platform supports automatic scaling as demand increases across customers and workloads.
Changes may be initiated by customers via support tickets, our Platform Support Team or internal teams to improve functionality, resolve issues, or enhance performance. All changes are implemented through automated CI/CD pipelines in appropriate development and test environments. Structured review and approval processes before being deployed through staging environments into production.
We align with the highest international standards and continuously invest in the infrastructure, certifications and controls that enterprise customers expect. From GDPR to ISO to anti-corruption practices, our approach to compliance is proactive, rigorous and built to scale.
This statement is made in accordance with the UK Modern Slavery Act 2015 and applies to commercetools GmbH, commercetools Limited UK and commercetools AU Pty Ltd.
It outlines our ongoing commitment to preventing slavery and human trafficking across our operations and supply chains, and reflects our broader commitment to ethical business practices, transparency and respect for human rights.
Employees, partners and third parties can report suspected legal or policy violations through our secure, external incident reporting system. This includes concerns related to misconduct, safety or security.
The system ensures confidentiality, transparency and protection from retaliation for anyone reporting genuine concerns.
Before onboarding new suppliers, we assess their security and data protection measures to ensure an appropriate level of protection. Our primary subcontractors are cloud service providers.
These providers are regularly independently audited and certified against global security, privacy and compliance standards, including recognized international frameworks.
commercetools continuously undergoes independent verification of platform security, privacy and compliance controls. Our strong and growing focus on compliance will help you meet your regulatory and policy objectives.
The audit reports can be requested upon receipt of a signed NDA. Please contact your sales contact or send your request to see the audit reports to security@commercetools.com.
Join 550+ enterprises already running on commercetools.
.svg){kind=icon}