ISO/IEC 27001
Our information security management system is being certified against ISO/IEC 27001:2022, with the formal commitment of our leadership. More than 60 controls are already monitored continuously on a compliance automation platform.
Security
Your delivery data,
protected by design.
Urbantz runs in the EU on Microsoft Azure, encrypts your data at rest and in transit, and checks every change for vulnerabilities before it ships. This page sets out what we do, and what your security team can ask us to show them.
- EU
- Hosted and processed in the EU
- AES-256 · TLS 1.2+
- Encryption at rest and in transit
- 99.998%
- Platform availability in 2025
- < 2 hours
- Full rebuild in our last disaster-recovery test
01/Standards
Where we stand,
stated plainly.
What is certified, what we follow, and what is under way. Each is labelled as such.
GDPR
Urbantz acts as your processor under a standard data processing agreement (GDPR Art. 28). We have a data protection officer, give you advance notice before adding a subprocessor, and notify you of a personal data breach without undue delay.
Certified infrastructure
The platform runs on Microsoft Azure and MongoDB Atlas, both ISO/IEC 27001 certified. Azure also holds ISO/IEC 27017 and 27018 and SOC 1, 2 and 3 reports, published on the Microsoft Service Trust Portal.
02/How we protect the platform
Security in every layer,
from the network to the people.
Infrastructure and hosting
Microsoft Azure, West Europe region (Netherlands).
Highly available, in the EU
Production runs across availability zones in the Netherlands and scales automatically with load. Backups and recovery sit in a second Azure region, in France.
A private network behind a firewall
Application servers and databases sit in a private network with no direct exposure to the internet. Traffic comes in through a web application firewall that also absorbs DDoS attacks.
Infrastructure as code
Every change to infrastructure and applications is made in code, reviewed, and deployed through a single pipeline that keeps a complete audit trail.
Tenant separation
Each customer's data is logically separated from every other customer's, and customers reach it through the API, never the database directly. Isolation between tenants is the first thing our security testing targets.
Data protection
Encrypted at rest
All data at rest, backups included, is encrypted with AES-256.
Encrypted in transit
Every connection uses TLS 1.2 or higher, typically TLS 1.3, including traffic between our own services. Older protocols are refused.
Keys kept in a vault
Encryption keys and secrets live in Azure Key Vault, backed by hardware security modules and rotated automatically. Services authenticate with managed identities, not static credentials.
Production data stays in production
Personal and confidential data is never copied to test environments or to another tenant.
Retention you control
Set the platform to anonymise recipient and user data a chosen number of months after delivery or inactivity. When a contract ends, you have a month to export your data through the API before it is archived, then permanently deleted or anonymised. A certificate of destruction is available on request.
Access and identity
Single sign-on for your teams
Connect your identity provider over OpenID Connect and OAuth 2.0, Microsoft Entra ID included, and enforce multi-factor authentication there.
Roles and permissions
Granular role-based access for every user. Password rules can be adapted to your policy, and accounts lock after ten failed attempts.
Scoped API access
API keys and OAuth 2.0 clients are scoped to a single platform, and OAuth tokens expire after five minutes. Sandbox and production have separate credentials, and outgoing webhooks can authenticate with OAuth 2.0 or a shared secret.
Least privilege for our own staff
Phishing-resistant multi-factor authentication is mandatory for administrators and production access. Only a small group of platform engineers can reach the cloud accounts, access is reviewed regularly, and every access is logged.
Secure development
Checks on every commit
Every change is peer-reviewed and runs through automated tests, static analysis, and dependency and secret scanning before it can ship.
Scanned while running
Container images are scanned continuously in production, and the cluster is checked every day against the CIS benchmark.
Patches without downtime
Small releases ship almost daily, security fixes included, with no maintenance window and only once quality managers have approved them.
Independently tested
An independent firm penetration-tests the platform. The latest test, at the end of 2025, found no severe issues and rated overall risk as low.
Monitoring and incident response
Watched around the clock
Metrics, logs and traces are centralised and kept for a year. Automated alerts reach our own on-call engineers, 24 hours a day.
Audit logs you can see
Logins, configuration changes and other sensitive events are recorded and visible to your administrators in the platform.
A formal incident procedure
Every incident is contained, investigated, remediated and reviewed afterwards. If your data is affected, you are told without undue delay, in time to meet your own GDPR obligations.
A public status page
Live platform status and incident history, with email updates for anyone who subscribes.
Availability and recovery
Availability you can check
Availability is committed in your service level agreement. In 2025 the platform was available 99.998% of the time.
Layered backups in a second region
Frequent database snapshots, with daily, weekly and monthly copies kept for up to twelve months, encrypted and stored in a separate Azure region.
Recovery we rehearse
Every year we fail the platform over to our recovery region. The last exercise rebuilt it in under two hours.
Support from our own team
An in-house support team based in Europe, with 24/7/365 cover and an emergency line on Premium support.
People and policies
A security policy we keep current
Our information system security policy and the policies under it are reviewed at least once a year.
Trained from day one
Every employee completes a mandatory security programme, starting at onboarding, and data protection and security training each year.
Vetted and bound to confidentiality
Background checks for everyone with production access, where local law allows, and confidentiality clauses in every employment contract.
One identity, protected
Every employee signs in to every tool through single sign-on with multi-factor authentication, and keeps credentials in a company password manager. Access is revoked the day someone leaves.
03/Milo and AI
AI that works
inside your rules.
Milo, the AI layer of the platform, is held to the same standard as everything else, and to a few more of its own.
EU-only inference
Milo uses Anthropic Claude models served by Google Cloud from EU regions only. The provider keeps no log of requests or responses, and only the fields a task needs are sent: never payment data, GPS positions, signatures or photos.
Never used for training
Your data is never used to train or fine-tune a model, and never shared with another customer. Conversations stay in our own EU database and are deleted 30 days after the last activity.
Your permissions, your approval
Milo acts with the signed-in user's rights and nothing more. It writes nothing without explicit approval, and a change to a delivery asks for it every time.
Logged, and switchable
Every action is in the audit log next to manual changes. Milo can be switched off for your platform at any time.
04/Due diligence
Don't take a web page's word for it.
Ask us to show you.
Your security and procurement teams can request the documents behind this page, under NDA where needed.
Security and disaster recovery overview
Architecture, access control, backup and recovery, in one document.
Technical and organisational measures
The measures we apply as your processor, as annexed to the data processing agreement.
Data processing agreement
Our standard GDPR Art. 28 agreement, with the current list of subprocessors and where each one operates.
Penetration test summary
The summary of our latest independent penetration test.
Your security questionnaire
We complete customer and RFP security questionnaires, including standard formats such as SIG.
Service level agreement
Availability commitments, support hours and response times. Live status and incident history are public.
Platform statusBring your security team
to the demo.
We will walk them through the architecture and answer their questions directly.