Security

Logo.dev serves public brand data: logos, colors and company details. The personal data we handle is small: your account details, the IP address and lookup of each API request, and billing details that Stripe processes for us. This page describes how we protect it.

Compliance

• SOC 2 Type I: an independent CPA firm examined our security controls as of August 16, 2026, and issued an unqualified opinion.
• GDPR: our DPA is part of our Terms and applies to every customer automatically, with the EU Standard Contractual Clauses, the UK Addendum and Swiss terms.
• Sub-processors: we list every third party that processes data for us, and we announce changes 14 days in advance.

Documents

Sign in and open Billing in the dashboard to download our SOC 2 Type I report, a PDF copy of our DPA and our W-9. Every plan has access, including free accounts.

Infrastructure

• Our infrastructure runs on AWS in the United States, mainly in the us-west-2 (Oregon) region.
• All API and web traffic uses TLS 1.2 or higher. Stored data is encrypted with AES-256, and our primary database uses keys we manage in AWS KMS.
• Our primary database keeps automated backups for 7 days, and our API key store keeps point-in-time backups for 35 days.

Access control

• Staff sign in to our systems through Google Workspace, with multi-factor authentication required.
• Access follows least privilege, and we review it every year.

Monitoring

• AWS CloudTrail records infrastructure activity to write-once storage that we keep for a year.
• Amazon GuardDuty watches our AWS accounts for threats.
• Dependabot flags vulnerable dependencies in our code.

People and devices

• Everyone with access completes security training when they join and every year after.
• Work laptops use full-disk encryption, lock the screen automatically and install updates automatically.

Incident response

We have a written incident response plan and test it every year. If a breach affects your personal data, we tell you without undue delay, as our DPA requires.

Report a vulnerability

Email security@logo.dev. See responsible disclosure for what to include.

More detail

Our security and data handling docs page has retention periods and technical detail for a security review. For security questionnaires, email security@logo.dev.