%20--%3e%3cstyle%20type='text/css'%3e.cls-0%20{fill:%23FF9900;}%3c/style%3e%3cpath%20class='cls-0'%20d='m117.3%2084h-14.1l39.2-79h-24.8l-20.3%2041.7-20.5-41.7h-3.8l-20.3%2041.7-20.8-41.7h-24.3l41%2083.3h8.2l18.2-37.7%2018.3%2037.8h23.7v2.8h10.7v-10.5h-10.6v3.3h0.2zm3.3-74.7h15.2l-28.9%2057.1-7.2-14.9%2020.6-42.2h0.3zm-69.3%2074.9-37-75h15.1l20.8%2042.4-5.8%2011%204.1%201.6%2016.9-33.9%207.2%2015.7-18.4%2038.1-2.9%200.1zm44.5-0.1-28.2-58.9%207.4-14.8%2029.6%2060.8-6.1%2012.9c0%200.1-2.7%200-2.7%200zm27.9%200.6v2.8h-3.1v-2.8h3.1z'/%3e%3c/svg%3e)
Trust Center
How this site and the services around it are built, in enough detail to be checked.
Certifications we do not hold
Warqline is not SOC 2 or ISO 27001 certified, and we are not going to imply otherwise on a page whose entire purpose is being trustworthy. We build and audit systems that meet those frameworks for clients; that is not the same as holding the certification ourselves. If your procurement process requires one, tell us early and we will tell you plainly where we stand.
How it is built
Each of these describes the running system, not an intention.
Where data is processed
The application and its database run in europe-west1 (Belgium). Static assets are served from a global content delivery network, so they are distributed worldwide by design. Authentication is operated by Google and may be processed outside the EU.
Encryption
Traffic is served over HTTPS with automatically renewed certificates; HTTP is redirected. Data at rest is encrypted by the underlying Google Cloud services. Credentials are held in a dedicated secret store, never in the repository or in container images.
Access control
Administrative functions require an authenticated session and a verified administrator claim, checked on the server for every request rather than in the browser. Client portal accounts are provisioned by Warqline; there is no self-service sign-up.
Deployment credentials
Continuous deployment authenticates with Workload Identity Federation and short-lived tokens. There is no long-lived cloud key stored in the repository or in CI, and the identity provider is restricted to this single repository.
Service accounts
Deployment and runtime use separate identities with different permissions. The runtime identity can read one secret and write to one database; it cannot deploy. Least privilege is the arrangement, not an aspiration.
Data retention
Contact enquiries are deleted 24 months after they arrive, enforced by a database-level policy rather than by a scheduled job someone has to remember to run.
Backups and recovery
Site content is versioned in git and deployable from source at any commit; hosting keeps prior releases and can roll back. Enquiry data is held in a managed database with the provider's point-in-time recovery.
Third parties
Deliberately few. Google Cloud hosts the site, its database and authentication. Resend delivers contact email and is based in the United States. Google Analytics counts page views, and is the only one that needs your agreement — it is not loaded unless you give it. Typefaces are served from our own servers, so if you decline analytics, viewing the site contacts no third party at all.
Data protection
Warqline Technologies is the data controller for personal data collected through this site. What we collect, why, where it goes and how long we keep it is set out in full in the privacy policy, and what the site stores in your browser is in the cookie policy.
You can ask us for a copy of your data, corrections, or deletion, at partner@warqline.com. If you are not satisfied with our response you can complain to the Autoriteit Persoonsgegevens.
Found something?
If you believe you have found a vulnerability in our systems, we want to hear about it before anyone else does.
Include enough detail to reproduce the issue. We will acknowledge your report and keep you informed while we work on it. Please give us a reasonable window to fix the problem before publishing, and do not access or modify data that is not yours while testing.
We do not currently run a paid bug bounty. We would rather say so than let you find out after the work.
Security questions before you sign anything
Send them over. We would rather answer a long questionnaire early than discover a blocker at contract stage.
Talk to an Engineer