Hosted in the EU
The application, the database, uploaded files, backups and logs are in DigitalOcean's data centre in Frankfurt, Germany. Your data does not leave the EU.
Trust and security
Customs declarations and supplier data are sensitive. This is how CBAM Wise keeps them, stated as it is: no certification we do not hold, no promise we cannot keep.
Encryption
Every connection uses TLS 1.2 or newer. The database and its backups are encrypted at rest by the hosting provider. Uploaded files are kept in a private storage bucket, never publicly reachable.
Two-factor login
Owners and filers must use an authenticator app (time-based codes) with recovery codes. Every person has their own login; passwords are stored only as secure hashes.
Roles and separation
Owner, editor, reviewer and auditor roles per company, with end dates for temporary access. Each company's data is separated in the database itself (row-level security), not only in the application.
Audit log
Every change to compliance data is recorded with who made it and when, in an append-only log whose entries are chained, so a changed entry would show.
Backups
The production database runs with a standby node, daily backups and point-in-time recovery. We restore a backup into a separate database to check it; the first of these drills is on 22 October 2026.
Virus check of uploads
Every uploaded file is scanned before it is stored; an infected file is refused. The scanner runs inside our own application.
Error monitoring in the EU
Errors are reported to Sentry's EU region with the type of error and where it happened in our code only: no messages, addresses, request data or user details.
Data processing agreement
For the personal data in your workspace (for example supplier contacts) you are the controller and we are your processor. Read the data processing agreement and the list of sub-processors.
Retention, export and deletion
You can export your whole workspace at any time. CBAM records must be kept until the end of the fourth year after the declaration year; deletion requests about such records can be held until then. At the end of the contract, the workspace is deleted after your export.
Report a security issue
If you think you have found a security problem, write to [email protected]. Please do not test against other customers' data. We answer within two working days.
Certifications
CBAM Wise does not hold ISO 27001 or SOC 2 certification. Our hosting provider's own certifications cover its data centres, not CBAM Wise.