Security at Linnworks
Verify the security of your commerce operations through our comprehensive protection framework
Security frameworks and compliance
ISO 27001 certified
We operate under an internationally recognized management system.
GDPR compliant
Customers’ personal data is stored and protected in compliance with the EU General Data Protection Regulation (GDPR).
Secure encryption of data
Data is encrypted at rest and in transit using AES-256 and TLS 1.2+.
Comprehensive security measures
Data security and encryption
Modern foundations: 2FA, configurable password policies, user password awareness.
Secure key management: Encryption keys are rotated and stored via AWS KMS with independent control layers.
Network security
Isolated AWS VPCs: All data is securely hosted in isolated AWS virtual Private Clouds.
Environment isolation: Production, development, and test environments are fully separated using VLANs and internal firewalls.
Access management
Role-based Access Control (RBAC): Access is provisioned based on least privledge principles.
Multi-Factor Authentication (MFA): Mandatory MFA is enforced across all administrative and development platforms.
Business continuity and disaster recovery
High availability: 99.5% uptime through redundancy.
Daily backups: Secure, geographically distributed backups ensure fast data restoration.
Privacy and data protection
Data Residency Control: Data is processed in compliance with regional regulatory requirements.
Transparency: We honor data minimization, consent, purpose limitation, and all data subject rights (access, deletion, rectification).
Secure development lifecycle
Security by Design: Our SLDC embeds security at every phase from ideation to deployment.
Continuous Testing: Routine SAST, vulnerability scans, and pen testing guard against emerging threats.
Vulnerability and incident management
24/7 response: A dedicated security team monitors and responds to threats round-the-clock.
Frequently asked questions
All customer data is securely stored in isolated AWS Virtual Private Clouds (VPCs) with enterprise-grade encryption. We use AES-256 encryption for data at rest and TLS 1.2+ for data in transit. Our data centres are geographically distributed across multiple availability zones to ensure high availability and disaster recovery capabilities.
We implement strict role-based access controls (RBAC) and multi-factor authentication (MFA) for all administrative access. Your data is logically separated in single-tenant environments, and we maintain comprehensive audit logs of all access activities. Our ISO 27001 certification ensures that we adhere to international best practices for information security management.
We follow a comprehensive Secure Development Lifecycle (SDLC) with security embedded at every phase. This includes regular static application security testing (SAST), dynamic application security testing (DAST), penetration testing, and vulnerability assessments. Our security team continuously monitors for threats, and we maintain a responsible vulnerability disclosure program for external security researchers.
We comply with GDPR and the UK Data Protection Act, employing robust physical, technical, and administrative measures to secure personal information throughout its lifecycle.
• We process personal data lawfully and only use it for defined, consented purposes.
• Our team and third-party processors adhere to strict confidentiality and data protection standards.
• Data retention is limited to what’s necessary; obsolete information is securely disposed of.
• Customer data remains within their region, and no transfers to separate regions occur.
Report security findings.
If you believe you have found a security vulnerability in our systems, we encourage responsible disclosure through our security reporting channels.
Vulnerability Disclosure Program
At Linnworks, we continuously invest in people, infrastructure, and processes to deliver secure, reliable, and compliant commerce solutions because your trust is our top priority.