Compliance

Where your data is hosted

All customer data is stored and processed in the EU (Netherlands), in ISO 27001-certified Google Cloud data centers. See all subprocessors and their locations on our Trust Center.

GDPR

At Caplena, we are committed to protecting personal data and ensuring compliance with the General Data Protection Regulation (GDPR). This regulation, which applies to businesses operating within the European Union (EU) and those handling data of EU citizens, sets stringent standards for data protection and privacy. Caplena is dedicated to maintaining the highest standards of data protection. We have implemented comprehensive measures to ensure that personal data is processed in compliance with GDPR principles.

Key GDPR principles

  1. Lawfulness, fairness, and transparency
    We process your personal data lawfully, fairly, and in a transparent manner. Our data processing activities are clearly outlined, and we provide transparent information about how your data is used.

  2. Purpose limitation
    We collect and use your personal data only for specific, legitimate purposes. Your data is not processed in a way that is incompatible with these purposes.

  3. Data minimization
    We ensure that the personal data we collect is adequate, relevant, and limited to what is necessary for our purposes. We do not collect more data than required.

  4. Accuracy
    We take reasonable steps to ensure that the personal data we hold is accurate and up to date. You can request corrections to any inaccuracies in your data.

  5. Storage limitation
    We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. Data that is no longer needed is securely deleted or anonymized.

  6. Integrity and confidentiality
    We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction.

  7. Accountability
    We maintain records of our data processing activities and ensure compliance with GDPR requirements. Our data protection practices are regularly reviewed and updated.

Caplena signs a data processing agreement (DPA), including the EU Standard Contractual Clauses, with every customer. You can request the DPA template and our Technical and Organizational Measures on our Trust Center.

If you have any questions or concerns about our GDPR compliance or how we handle personal data, please contact us at info@caplena.com.

SOC 2 Type II report

What is a SOC 2 report?

SOC 2 (System and Organization Controls 2) is an auditing standard for companies that handle sensitive customer data. A SOC 2 report can cover up to five criteria: security, availability, processing integrity, confidentiality and privacy.

Caplena holds a SOC 2 Type II report, issued by an independent auditor under the AICPA's Trust Services Criteria. Type II means the auditor tested that our controls worked as intended over a period of time, not just on a single day. We're re-audited every year.

Caplena’s commitment to data security

At Caplena, we prioritize the security and privacy of your data. Our SOC 2 report reflects our dedication to maintaining robust controls and processes designed to safeguard your information. We ensure that our feedback analysis services meet the rigorous standards necessary for data protection.

What our SOC 2 report covers

Our latest SOC 2 Type II report covers three Trust Services Criteria:

  • Security: your data is protected against unauthorized access, with controls for access management, encryption, monitoring and incident response.

  • Availability: our platform is designed and monitored to stay available, with tested backup and recovery.

  • Confidentiality: confidential information is protected throughout its lifecycle, including secure deletion.

Caplena holds a SOC 2 Type II report rather than an ISO 27001 certification. Our data is hosted on Google Cloud in the Netherlands, whose data centers are ISO 27001, 27017 and 27018 certified.


To learn more about how Caplena’s SOC 2 Type II report enhances our feedback analysis services or to request the full report and the Letter of Attestation, visit our Trust Center.