Certifications
CodeTwo Trust Center
Security and compliance are core to our business. We are certified by Microsoft and we comply with ISO 27001, ISO 27018, GDPR, and other applicable privacy and security standards.
Security & compliance certifications
Browse and download CodeTwo’s security certifications and badges to see how we comply with industry‑leading data protection standards.
ISO/IEC 27001,
ISO/IEC 27018
ISO/IEC 27018
ISO 27001 & 27018 certifications confirm that we maintain an audited management system for information security and personal data protection.
GDPR
CodeTwo’s GDPR approach is built on documented data protection measures, giving you a clear way to review how we meet EU privacy requirements.
U.S. State Data
Privacy Laws
Privacy Laws
We address key U.S. state privacy laws, including CCPA, VCDPA and CPA, with documented safeguards you can review in detail.
HIPAA
Our HIPAA safeguards support secure handling of protected health information, with controls and practices you can verify.
PCI DSS
Our PCI DSS compliance ensures secure payment processing through verified security controls designed to protect cardholder data.
Microsoft 365
Certified
Certified
CodeTwo’s cloud app infrastructure is regularly reviewed and pen‑tested by Microsoft experts for security, compliance & data handling.
SecurityScorecard
CodeTwo services are continuously monitored by SecurityScorecard to ensure compliance with the latest security standards & practices.
Cyber Essentials
CodeTwo is certified by Cyber Essentials, a scheme overseen by UK’s National Cyber Security Centre, proving commitment to cybersecurity.
Business Ethics
Our business ethics framework is backed by formal policies and oversight, so you can review how we uphold responsible business conduct.
If you want to contact our Data Protection Officer, click here.
Security checklist
Mobile Device Management (MDM) program 
Disaster Recovery Plans
Cyber insurance coverage
The most secure signature solution on the market
CodeTwo Email Signatures 365 is the only email signature service with all components certified, reviewed, and pen‑tested by Microsoft as part of the Microsoft 365 App Compliance program. Built with enterprise‑grade security in mind, it ensures your data stays protected while meeting the highest compliance standards.
See what makes CodeTwo the safest choice for email signatures
CodeTwo security & compliance FAQ
Security Overview
- Does CodeTwo maintain a formal Information Security Management System (ISMS)?
Yes, CodeTwo’s Information Security Management System (ISMS), certified as compliant with the requirements of ISO/IEC 27001 and ISO/IEC 27018, guarantees maximum information security and personal data protection both in the cloud and on-premises.
Please see: Information Security Management System Policy, ISO Compliance Center.
- Is the information security program at CodeTwo aligned with recognized standards (e.g. ISO/IEC 27001)?
Yes, PCI DSS, GDPR, ISO/IEC 27001 and ISO/IEC 27018, CCPA, HIPAA.
For detailed information, see Information Security Management System Policy, ISO Compliance Center, GDPR Information Center, US Data Protection Laws Addendum, PCI DSS Compliance and HIPAA Information Center.
- Who is responsible for overseeing CodeTwo’s information security program?
CodeTwo’s information security program is managed by a dedicated team consisting of Information Security Officers, Compliance Officers, the Data Protection Officer (DPO), penetration testers, and internal auditors. The overall supervision of the Information Security Management System (ISMS) is performed by the ISMS Representative.
- How often are information security policies reviewed and updated at CodeTwo?
Our information security policies are maintained on an ongoing basis and updated as needed. In addition, they undergo a formal review, in accordance with ISO/IEC 27001.
- Does CodeTwo conduct regular internal or external security audits?
Yes, CodeTwo conducts:
- ISO/IEC 27001 and ISO/IEC 27018, certified by BSI.
- PCI DSS (Payment Card Industry Data Security Standard), SecurityMetrics® scans our infrastructure once a quarter.
- Cyber Essentials, a UK government-backed certification scheme overseen by National Cyber Security Centre (NCSC). All endpoints are scanned and constantly test for vulnerabilities by third party solutions.
- Microsoft 365 App Compliance Program.
- Internal Audits by selected employees, appointed and trained as auditors.
Please see: ISO Compliance Center, PCI DSS Compliance, Cyber Essentials Certificate, Microsoft 365 Certification.
- Does CodeTwo have an established code of ethics that is publicly available to customers?
Yes, the organization maintains a formal Business Ethics, forming the basis of its core values and standards of conduct, along with a comprehensive anti-corruption code. Both documents are publicly accessible on the company’s website.
Please see: Business Ethics, Anti-corruption Code.
Compliance & Certifications
- Is CodeTwo compliant with the EU General Data Protection Regulation (GDPR)?
Yes, as a company established in Poland, we are subject to European Union legislation and adhere to the requirements of the General Data Protection Regulation (GDPR).
Please see: GDPR Information Center.
- Is CodeTwo compliant with California Consumer Privacy Act (CCPA)?
Yes, for customers subject to the CCPA, we have included relevant provisions in our DPA.
Please see: Data Processing Agreement.
- Is CodeTwo compliant with the Health Insurance Portability and Accountability Act (HIPAA) for customers subject to its requirements?
Yes, if you wish to enter into BAA with CodeTwo, contact us using this form.
Please see: HIPAA Information Center.
- Is CodeTwo certified in any recognized security standards (e.g., ISO 27001, PCI DSS)? Are any relevant certificates available on your website?
Yes, we are certified to ISO/IEC 27001, ISO/IEC 27018, PCI DSS and Cyber Essentials. The certificates are available on our website.
Please see: ISO Compliance Center, PCI DSS Compliance, Cyber Essentials Certificate.
Data Protection & Privacy
- Does CodeTwo comply with applicable data protection regulations (e.g. GDPR)?
Yes, GDPR, CCPA, HIPAA.
Please see: GDPR Information Center, US Data Protection Laws Addendum, HIPAA Information Center.
- Does CodeTwo act as a data processor or data controller for customer data?
Yes, we are a processor for the data entrusted by a customer as required to provide our service. We are a controller for the data provided in the CodeTwo Admin Panel account.
Please see point 2. General in our Data Processing Agreement.
- Are Data Processing Agreements (DPA) available to CodeTwo customers?
Yes, the Data Processing Agreement (DPA) must be signed between us and a customer.
Please see: Data Processing Agreement.
- How are data subject rights handled by CodeTwo (e.g. access, deletion, correction)?
Data subject rights are handled in accordance with GDPR requirements. All relevant information regarding these rights is provided in our Privacy Policy.
See What are your rights? section in CodeTwo Privacy Policy.
- Are personal data processing activities documented and reviewed at CodeTwo?
Yes, in accordance with the GDPR, CodeTwo maintains a Record of Processing Activities, which is regularly reviewed and kept up to date.
Subprocessors
- Does CodeTwo maintain a publicly available list of its subprocessors?
Yes, Microsoft is our only subprocessor. The list is available in the Data Processing Agreement (DPA).
Please see point 3. Subprocessing and Appendix 2 – List of subprocessors in our Data Processing Agreement.
- Where are CodeTwo subcontractors physically located?
The product operates in Microsoft Azure datacenters. The customer chooses the most convenient region of the datacenter during tenant registration. The list of all current regions used by our product can be found on our website.
Please see: List of regions where the CodeTwo cloud service is available.
Supplier & Third-Party Risk Management
- Does CodeTwo assess the security posture of suppliers/third-party services providers?
Yes, the organization has procedures in place for verifying new suppliers/third-party, as well as for conducting periodic reviews of existing suppliers in terms of security.
- Are CodeTwo suppliers required to meet defined security requirements?
Yes, the organization requires its suppliers to meet defined security requirements and, in accordance with ISO/IEC 27001, performs due diligence to assess and monitor their compliance with high security standards.
- Are CodeTwo contracts with suppliers reviewed for security and data protection obligations?
Yes, contracts with suppliers are reviewed for security and data protection obligations. For key suppliers, they are also subject to periodic reviews and/or reassessed when contracts are updated by the supplier.
- How are supplier risks monitored throughout the relationship with CodeTwo?
Supplier risks are continuously monitored throughout the relationship via regular risk assessments and performance reviews. This includes tracking and evaluating any suppliers-related incidents, as well as periodic reviews of contractual terms and conditions to ensure continued compliance and risk mitigation.
Supplier Risk Management is an integral part of the organization’s overall risk management framework, and the process is based on the ISO/IEC 27005:2022 standard.
Incident Management
- Does CodeTwo maintain a formal incident response process?
Yes, the organization has Incident Management Procedure that includes handling data security breaches. It sets out the response time to an incident and a formal pathway for dealing with it. We have an internal security team comprised of security experts and engineers who are responsible for incident management and conducting further actions resulting from the incidents.
Please see 6. Incident management section in the Data Processing Agreement.
- Are security incidents documented and tracked in a centralized system at CodeTwo?
Yes, all security incidents are properly documented and tracked within a centralized system, in accordance with ISO/IEC 27001 requirements and internal security policies.
- How are CodeTwo customers notified if a security incident affects their data or services?
In accordance with GDPR, in the event of an information security incident or a data breach affecting customer data, the organization will notify the relevant supervisory and authority and affected individuals without undue delay after becoming aware of the breach.
Please see 7. Data Breaches section in the Data Processing Agreement.
- Are incident response procedures regularly tested or reviewed at CodeTwo?
Yes, the incident response procedures are regularly tested and reviewed. They are formally updated and at least once during scheduled reviews, and additionally whenever changes to relevant processes take place.
- Are lessons learned from incidents used to improve security controls at CodeTwo?
Yes, lessons learned from incidents are systematically used to improve security controls. The organization follows a continuous improvement approach in line with ISO/IEC 27001, where incident analysis and post-incident reviews are key elements in enhancing the overall security posture.
Availability & Business Continuity
- Are backup procedures implemented for CodeTwo critical systems and data?
Yes, backup procedures are in place for all critical systems and data. Regular backups are conducted in line with ISO/IEC 27001 standards to support business continuity and data integrity.
Please see point 5. Asset and operations management in Appendix 3 – Summary of security measures implemented by CodeTwo in the Data Processing Agreement.
- Does CodeTwo maintain a Business Continuity Plan (BCP)?
Yes, the organization maintains a Business Continuity Plan (BCP), which is documented, approved by management, and periodically tested in accordance with ISO/IEC 27001.
Please see: ISO Compliance Center.
- Are disaster recovery procedures documented and tested at CodeTwo?
Yes, the Disaster Recovery Plan (DRP) is documented and regularly tested in accordance with ISO/IEC 27001.
- Is CodeTwo service availability and performance monitored?
Yes, CodeTwo has a continuous automated monitoring and alerting platform to detect and alert on suspicious/malicious activity, as well as any degraded performance issues, bottlenecks, overloads in the service and all our infrastructure.
What is more, CodeTwo has a 24/7 Monitoring Team who proactively monitor the service in order to override any automated procedures in case they fail.
Please see: ISO Compliance Center.
- Has CodeTwo conducted a Business Impact Analysis (BIA)?
Yes, the organization conducts Business Impact Analyses (BIA) for the key processes related to customer service delivery. The BIA process is performed in accordance with the requirements of the ISO/IEC 27001 standard. The results of these analyses are confidential and not shared externally.
Secure Development
- Does CodeTwo follow a Secure Software Development Lifecycle?
Yes, the organization follows a Secure Software Development Lifecycle aligned with recognized security standards and internal policies.
- Are security reviews conducted during the development process at CodeTwo?
Yes, security reviews are conducted throughout the development process as part of our Development Lifecycle (DLC), ensuring that security considerations are addressed at each stage.
- Is source code reviewed before deployment to production environments at CodeTwo?
Yes, source code is reviewed internally prior to deployment to production environments, as part of our Development Lifecycle (DLC).
- Are automated tools used to detect vulnerabilities in code at CodeTwo?
Yes, automated tools are used to detect vulnerabilities in the code.
- How are security issues identified during the development of CodeTwo products tracked and resolved?
Security issues identified during development are tracked and managed using OWASP guidelines and best practices. Each issue is documented, assessed for severity, and assigned for remediation. Progress is continuously monitored until the issue is resolved and properly verified.
Please see: OWASP Top 10:2025.
Vulnerability & Patch Management
- Are CodeTwo systems regularly scanned for security vulnerabilities?
Yes, we established a dedicated teams. The members of this team perform constant vulnerability verification scans with two different external, commercial solutions.
SecurityMetrics scans our infrastructure once a quarter, in terms of PCI standards (Payment Card Industry Data Security Standard).
All endpoints are scanned and constantly test for vulnerabilities by third party solutions.
Please see: PCI DSS Compliance, SecurityScorecard rating.
- Does CodeTwo perform penetration testing or security assessments?
Yes, critical applications with user data undergo regular penetration tests. Vulnerability assessments are performed internally (continuously).
- How are the identified vulnerabilities prioritized and remediated at CodeTwo?
We continuously perform vulnerability scanning and prioritize findings based on severity and business impact. Critical vulnerabilities are addressed immediately by updating to the last patched versions. When patches are not yet available, we implement temporary mitigations where possible and work closely with the supplier until an official fix is released.
- Is there a defined process for applying security patches and updates for CodeTwo products?
Yes, the organization has defined process for applying security patches and updates. The organization performs scheduled maintenance several times a year, which is transparent to Customers - it does not affect the main capabilities of our service, like mail flow or signature adding features. If CodeTwo ever performs a security patch or update that requires any actions on the Customer’s side, Customers will be notified in advance with sufficient notice and clear instructions.
Normally, however, updates are rolled out in the background and the process is unnoticeable for the customer. There is no downtime whatsoever for any of the components of the service.
- Are third-party libraries and dependencies monitored for vulnerabilities at CodeTwo?
Yes, third-party libraries are strictly managed in accordance with ISO/IEC 27001 requirements.
Data Protection & Encryption
- Is Customer data encrypted in transit using industry-standard protocols (e.g. TLS) in CodeTwo software?
Yes, all data in transit is protected using encryption protocols, with a minimum standard of TLS 1.2.
Please see: Security and reliability of the CodeTwo cloud service.
- Is sensitive data encrypted at rest in CodeTwo software?
Yes, all data is kept in encrypted storage.
- How are cryptographic keys managed and protected at CodeTwo?
Cryptographic keys are managed and protected in accordance with established internal procedures aligned with industry’s best practices and ISO/IEC 27001 requirements. The organization implements a formal key management process covering key generation, storage, rotation, access control, and revocation. Access to cryptographic keys is restricted based on principle of least privilege and is subject to appropriate security controls and monitoring.
- Are data classification and data protection policies implemented in CodeTwo?
Yes, the data classification policy and data protection policies have been implemented and are maintained in accordance with ISO/IEC 27001 requirements. These policies are confidential and restricted to internal use within the organization.
Please see: Appendix 3 – Summary of security measures implemented by CodeTwo in the Data Processing Agreement.
- Are measures in place to prevent unauthorized access to CodeTwo customer data?
Access Control & Identity
- How is user access to systems and data granted, modified, and revoked at CodeTwo?
The organization has implemented a system of controls to make sure that no one can cease to work for the organization without having their authentication credentials deactivated and all access rights revoked.
Please see point 4. Access control in Appendix 3 – Summary of security measures implemented by CodeTwo in the Data Processing Agreement.
- Are access right assigned according to the principle of least privilege at CodeTwo?
Yes, Access rights are assigned according to the principle of least privilege and the security-by-design approach. Access is granted only to the extent necessary for users to perform their assigned duties. We maintain a formal Access Management Policy aligned with ISO/IEC 27001 requirements, including role-based access control, approval procedures, and periodic access reviews.
Please see point 4. Access control in Appendix 3 – Summary of security measures implemented by CodeTwo in the Data Processing Agreement.
- Is multi-factor authentication (MFA) required for administrative or privileged access at CodeTwo?
Yes, multi-factor authentication is required for all systems.
Please see point 4. Access control in Appendix 3 – Summary of security measures implemented by CodeTwo in the Data Processing Agreement.
- Are user access rights periodically reviewed at CodeTwo?
Yes, users’ access rights are formally reviewed in accordance with the Access Management Policy and all access roles and permissions are frequently audited by a dedicated team.
Please see point 4. Access control in Appendix 3 – Summary of security measures implemented by CodeTwo in the Data Processing Agreement.
- How are privileged accounts monitored and controlled at CodeTwo?
The organization constantly monitors information systems against all attempts of unauthorized access and use of expired or invalid credentials.
Please see point 4. Access control in Appendix 3 – Summary of security measures implemented by CodeTwo in the Data Processing Agreement.
Monitoring & Logging
- Are security logs generated for CodeTwo critical systems and applications?
Yes, security logs are generated and monitored for all critical systems and applications.
- Are CodeTwo service logs monitored for suspicious or unauthorized activities?
- Are centralized monitoring tools or SIEM solutions used at CodeTwo?
Yes, we use a variety of tools to monitor malicious traffic in our environments. Monitoring activities are supported by a dedicated team and formalized processes aligned with ISO/IEC 27001.
Please see: Security and reliability of the CodeTwo cloud service.
- How long are security logs retained at CodeTwo?
Security logs are retained in accordance with established internal policies aligned with industry best practices, legal requirements, and information security standards (including ISO/IEC 27001). Log retention periods are defined based on the purpose of monitoring, incident investigation, and compliance obligations. Access to logs is restricted and logs are protected against unauthorized access, modification, or deletion. For security reasons, specific log retention timeframes are not publicly disclosed.
- Are alerts generated and investigated when potential security events occur at CodeTwo?
We use a variety of tools to monitor malicious traffic in our environments. Each alert is analyzed and subject to our internal procedures.
Security Contact
- Is information about the CodeTwo Data Protection Officer (DPO) available on the website, and what are the available contact methods?
Yes, you can find DPO contact information on our website.
If you want to exercise your privacy rights or have any other questions relating to data protection you can contact our Data Protection Officer using this form or this email: moc.owtedoc@opd.
Please see contact information here: https://www.codetwo.com/company/contact.
- Is it possible to learn more about CodeTwo’s security measures?
Yes, the organization has developed a comprehensive security measures and procedures form prepared by the Information Security Team. This document, along with the ISO/IEC 27001 and ISO/IEC 27018 audit report prepared by an external and independent certification organization (available upon request), will be provided after the execution of a Non-Disclosure Agreement (NDA).
