Compliance, backed by independent audits
Verified every year, so you always know where your data stands
Verified compliance
An independent auditor has confirmed that we comply with GDPR and protect your data correctly.
Ongoing security audits
Our security measures are reviewed annually by an external auditor to ensure continuous compliance.
Trust and transparency
Demonstrate to customers and partners that their data is handled securely and in compliance with regulations.
Lower risk, less admin
Reduce the risk of GDPR violations and minimise the need for internal audits of your data processors.
Competitive advantage
A certified provider shows customers that you take data security seriously and follow best practices.
Protect your reputation
Lack of certification can raise concerns about data security and weaken your market credibility.
We care about your data
At Raptor, we process large amounts of data, both for our customers and their end consumers. This is a great responsibility that requires the highest level of data security.
For transparency, and to show that we fully comply with GDPR, we have chosen to have an external auditor review our efforts to protect customer data, in what's known as an ISAE 3000 report.
What is ISAE 3000
An ISAE 3000 certificate is your guarantee that Raptor follows all processes related to GDPR and compliance correctly and responsibly. As a Raptor customer, this means you can feel confident leaving data in our hands.
The ISAE 3000 certificate confirms compliance with current laws and regulations. Failing to meet the standards required by this certificate would compromise the protection of personal customer data. At Raptor, we hold ourselves to the highest standard of control over personal data, to protect consumer trust and support a secure environment for businesses to operate in.
How we check on our sub-processors
Microsoft, with its services Azure, Azure DevOps, and M365, is the only sub-processor used for processing personal data on behalf of the data controller, and makes a number of compliance documents available on its service trust page.
Raptor, as data processor, has chosen to audit the following types of compliance documents:
- Documents from the ISO 27000 family of standards: ISO 27001, 27017, 27018, 27701 certificates, SoAs, and reports (for Azure); ISO 27001 SoA (for Azure DevOps).
- SOC documents: SOC 1 type II, SOC 2 type II, and SOC 3 reports, as well as SOC bridge letter (for Azure); SOC bridge letter (for Azure DevOps); SOC 1, SOC 2, and SOC 3 reports, as well as SOC bridge letter (for M365).
Method of audit
Raptor has reviewed the above compliance documents, focusing on whether the certificates are still valid and their scope remains relevant and sufficient.
For the SOC reports, Raptor focused on the identified exceptions noted, as well as Microsoft's management responses to those exceptions.
Given the complexity and scale of the services, a large number of exceptions were noted, many of which are not directly related to Raptor's use of the services. The audit therefore focused on whether there are any unbridged gaps in compliance or unmitigated issues.
Date: 21.01.2026 Auditor: Dennis Benneballe Arnold-Grade
Conclusions of the audit
None of the security certificates have given rise to any follow-up action by Raptor. Raptor has identified areas in the SOC reports that need monitoring, and some that have not been fully mitigated since the last audit, which will be checked in the next round of SOC audit reports. These include:
- Secure development life cycle
- Change management
- Backup management
- Key and secret rotation
- Vulnerability management
- Physical security
- Access management
- Alerting