Logo.dev security: DPA, subprocessors, data retention

This page summarizes how Logo.dev handles data, for a security or procurement review. The binding terms are in our privacy policy, DPA, and subprocessor list. In a contract, refer to those documents, not to this summary.

​

What we process

Logo.dev turns company identifiers into public brand assets, so most data in the API is not personal data. We process this personal data:

• Account details: your name, email, and organization.
• API request metadata: the IP address that sends the request, the domain or query you look up, and a timestamp.
• Billing: Stripe collects and processes payment details. We don’t store full card numbers.
• Website analytics: page and product usage, through Fathom and PostHog.

See the privacy policy for the full list and the legal bases.

​

Data processing agreement

A DPA is available and incorporates the EU Standard Contractual Clauses for international transfers. It applies once both parties sign it. Read the DPA, or email team@logo.dev to execute one.

​

Subprocessors

We publish the list of third parties that process data for us, and we update it when they change. See the current subprocessor list.

​

Data retention

We keep request logs and account data only while we need them to run the service, meet billing and legal obligations, and investigate abuse. The privacy policy covers retention by data type.

​

Where data is processed

Logo.dev processes data mainly in the United States. The subprocessor list gives each provider’s location. For users in the EEA, UK, and Switzerland, transfers rely on the EU Standard Contractual Clauses in our DPA.

​

GDPR

We process only the personal data listed above, and we never sell it. We support these data-subject requests: access, correction, deletion, restriction, objection, and portability. The privacy policy covers the legal bases and how to make a request. To delete your account and its data, see Delete your account.

​

Certifications and encryption

Logo.dev does not yet hold SOC 2 or another formal security certification. We are working toward SOC 2 and run automated vulnerability scanning. Our infrastructure providers, including AWS, Vercel, and Cloudflare, maintain their own SOC 2 and ISO 27001 certifications. Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Access to infrastructure requires multi-factor authentication and follows least-privilege controls.

​

Enterprise flat file delivery

Tell us which logo data you need, and we deliver it as a flat file on a schedule. You don’t integrate an API.

​

Security reporting

Found a security issue? Email security@logo.dev. For privacy or DPA questions, email team@logo.dev.