AfterShip Trust Centre
AfterShip Trust Centre
At AfterShip, we are committed to protecting customer data and continually earning our customer’s trust. We embed security and privacy into every product decision we make and operational process we design, and we back that commitment with audited controls, adherence to applicable data protection regulations, and clear, transparent documentation. Report issues
Trusted by the world’s biggest brands
Compliance Certifications and Frameworks
Certified by rigorous global security and privacy standards, AfterShip prioritizes data protection. We ensure all data remains secure through robust policies, advanced technology, and ongoing monitoring to prevent breaches and unauthorized use. Detailed reports on our security protocols are available upon request.
Control procedures and audits
AfterShip undergoes extensive audits to ensure our security and privacy control procedures meet industry standards and are verified in a SOC 2 Type II report.
Information security management
AfterShip holds ISO 27001 certification, the global standard for implementing information security management systems (ISMS) controls.
Data privacy
AfterShip fully complies with the most rigorous data privacy laws and regulations, such as the General Data Protection Regulation (GDPR).
)
Secure system configuration
AfterShip follows the Center for Internet Security (CIS) Benchmarks to harden our cloud infrastructure and systems against common threats, aligning configurations with industry-accepted best practices.
)
Application security best practices
AfterShip follows the OWASP Top 10 guidance throughout our software development lifecycle to identify, mitigate, and prevent the most critical web application security risks.
Contact us for more information
Legal, Privacy, and Security Documents
Terms of Service
Our Terms of Service establish the contractual rights, obligations, and responsibilities governing the use of AfterShip’s products. Learn more
Privacy Policy
Our Privacy Policy explains how AfterShip collects, uses, stores, and protects personal data, and describes the rights available to individuals under applicable data protection laws. Learn more
Cookie Policy
Our Cookie Policy details how and why cookies and similar technologies are used on our websites and services, and how users can manage their preferences. Learn more
Data Processing Agreement
Our DPA defines AfterShip’s data protection obligations when processing personal data on behalf of customers, including security measures, subprocessors, and data subject rights. Learn more
Subprocessors
Our Subprocessors list provides transparency into the third parties we engage to support our services and the safeguards in place to protect customer data. Learn more
Service Level Agreement
Our Service Level Agreement outlines AfterShip’s service availability commitments and support standards for eligible enterprise customers. Learn more
)
)
Security and Privacy at AfterShip
The AfterShip Services are hosted on Google Cloud Platform and Amazon Web Service in the United States of America and are protected by security and environmental controls. Google Cloud Platform and Amazon Web Service regularly undergo independent verification of security, privacy, and compliance controls. Additional details are available at:
AfterShip configures the firewalls on the production environment according to industry best practices and monitors unauthorized intrusions' services. AfterShip also uses Cloudflare WAF to block cyber-attacks. AfterShip performs automated vulnerability scans on the production environment and remediates any findings that present a risk to our environment. Additionally, AfterShip undergoes annual third-party penetration testing. A bug bounty program through HackerOne is also maintained, where security researchers are invited to submit vulnerabilities to AfterShip throughout the year. Additionally, the security review process facilitated by the security team is an integral part of AfterShip’s development lifecycle and the industry security coding and review practices are followed.
AfterShip regularly performs security awareness training for all staff. AfterShip also offers 24/7 security monitoring and incident response.
Product Security
AfterShip prioritizes system and data security through secure product development. Enjoy built-in protection for your apps, identities, and information.
Highlights
- Audit logging
- Multi-factor authentication (MFA/2FA)
- Role-based access control (RBAC)
- Single sign-on (SSO)
- Strong password requirements
)
)
Data Security
AfterShip follows strict protocols for the diligent collection, storage, processing, sharing, and deletion of your data as outlined in our Privacy Policy.
Highlights
- Access monitoring
- Routine database backups and recovery practices
- Data breach notifications made to customers within the time limits established under the GDPR
- Data collection and processing per user instructions
- Data erasure per user instructions or according to established retention periods
- Encryption-in-transit (TLS 1.2) and encryption-at-rest (AES-256)
Application Security
AfterShip continuously monitors system security and reliability, taking proactive measures to enhance data availability in worst-case scenarios.
Highlights
- Annual third-party penetration tests
- Automated vulnerability scanning and remediation
- Bug bounty program
- Cloudflare WAF to block cyber-attacks
- Code analysis
)
)
Infrastructure Security
AfterShip proactively monitors our systems to ensure reliable, consistent, and trustworthy service.
Highlights
- 24/7 proactive monitoring and incident response
- Business continuity and disaster recovery controls
- Services hosted on AWS and Google Cloud in the United States
Network Security
AfterShip protects its network perimeter and internal traffic through layered controls and continuous monitoring to block threats, detect anomalies, and safeguard customer data.
Highlights
- Employee access to platforms controlled through SSO and MFA/2FA
- Firewalls configured according to industry best practices
- Intrusion detection and protection systems
- Security Information & Event Management (SIEM)
- Virtual Private Cloud
)
)
Corporate Security
AfterShip adheres to industry standards and best practices. Ongoing training ensures employees are up-to-date on the latest policies and processes.
Highlights
- Asset management practices
- Crisis Management and Information Security Incident Management policies
- Email protection
- ISO 27001-based ISMS
- HR background checks for all new hires
- Onboarding and subsequent annual information security trainings for all employees
Data Protection Compliance – For Your Benefit
Have peace of mind knowing that AfterShip protects your data.
Overview and Data Protection Law Basics
What do we mean by “applicable data protection laws”?
AfterShip’s data privacy programme is designed to comply with the world’s most stringent global data protection laws. When we use “applicable data protection laws”, we mean data protection and privacy laws that apply to our operations. In particular, AfterShip’s services are designed to be provided with specific attention to (i) data protection laws applicable to European Economic Area (EEA), the United Kingdom (UK), and Switzerland, (ii) US data protection laws, and (iii) any and all data protection laws and regulations applicable to personal data as such laws pertain and have jurisdiction with respect to AfterShip’s operations, in each case as amended, superseded, or replaced from time to time.
Data protection laws applicable to the European Economic Area and the United Kingdom, and Switzerland means (i) the European Union’s (EU) General Data Protection Regulation (2016/679) (GDPR), the 2002/58/EC Directive on Privacy and Electronic Communications, (ii) the UK Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR) as defined by the DPA as amended by the Data Protection, Privacy and Electronic Communications (EU Exit) Regulations 2019, (iii) the Swiss New Federal Act on Data Protection (“nFADP”) entered into force on 1 September 2023, and (iv) any and all other data protection laws and regulations applicable to personal data in the EEA, the UK, and Switzerland. The GDPR/UK GDPR/nFADP applies to all organisations established in the EEA/UK/Switzerland and to organisations, whether or not established in the EEA/UK/Switzerland, that process the personal data of EEA/UK/Swiss individuals in connection with the offering of goods or services to data subjects in the EEA/UK/Switzerland.
US data protection laws means the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Utah Consumer Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, and any other similar comprehensive state privacy laws that place obligations on a business or controller in relation to personal data (as defined under such laws), as well, as or the extent applicable, the Electronic Communications Privacy Act; Massachusetts Gen. Law Ch. 93H; the Federal Trade Commission Act; the Gramm-Leach-Bliley Act, and any relevant regulation, rule, or other binding instrument which implements such laws.
Is AfterShip compliant with applicable data protection laws?
Yes, we strive to meet the requirements set out in applicable data protection laws, and in order to monitor our compliance, we conduct annual audits to ensure all new products, services, and any other changes in our company are in accordance with applicable data protection laws.
Is AfterShip a data processor or a data controller under applicable data protection laws?
Acting as a data processor: The substantial majority of AfterShip’s services are provided as a data processor processing personal data on behalf of a data controller. For the purposes of AfterShip’s services, a data controller is either (i) an AfterShip customer, or (ii) a logistics partner, either of which is contracting AfterShip services or integrating with the AfterShip platform for their tracking and customer post-purchase operations. As a data processor, AfterShip does not independently determine the means or the purposes for processing personal data, and AfterShip will solely act in accordance with the data controller’s instructions, which are set out in a data processing agreement (DPA).
Acting as a data controller: Occasionally, AfterShip may also act as a data controller; most often with respect to individuals' use of AfterShip’s mobile application.
Do data controllers sign a DPA with AfterShip?
AfterShip systematically concludes a DPA with each data controller, which sets out what type of personal data AfterShip will process and the measures to be applied to such processing.
How can I ensure personal data is removed or purged?
Any user may request to have personal data held by AfterShip removed in accordance with applicable data protection laws. AfterShip processes personal data in accordance with AfterShip’s retention policy, which accounts for the purpose of such processing in accordance with the GDPR.
What happens in the event of a data breach?
AfterShip has implemented and continues to evolve measures to secure personal data. In spite of these measures, should a data breach occur, AfterShip will inform the data controller, without undue delay, in accordance with its legal and contractual obligations.
European-Specific Data Privacy Information
What is the GDPR?
The GDPR promulgated by the EU protects the fundamental right to privacy and the protection of personal data of individuals located in a EEA member-state (“European data subjects”).
Who does the GDPR apply to?
The GDPR applies to all organisations established in the EEA and to organisations, whether established in the EEA or not, that process the personal data of European data subjects in connection with the offering of goods or services to data subjects in the EEA.
Is AfterShip GDPR compliant?
AfterShip has implemented all the GDPR mandated compliance mechanisms and conducts annual audits to ensure all new products, services, and any other changes in our company comply with GDPR.
How does this apply to the United Kingdom and Switzerland?
The UK and Switzerland have each enacted data protection legislation substantially similar to the GDPR and apply the same mechanisms and processes with respect to personal data originating from these jurisdictions.
Is AfterShip allowed to transfer personal data out of the EEA, UK, and Switzerland?
The GDPR does not require EU data to reside in Europe, nor does similar legislation in the UK and Switzerland. The GDPR provides mechanisms to facilitate transfers of personal data outside of the EEA. These mechanisms are aimed at confirming an adequate level of protection or ensuring the implementation of appropriate safeguards when personal data is transferred to a third country.
Where personal data will be transferred outside of the EEA to third countries not covered by adequacy decisions, AfterShip commits under its DPA (accessible here), to the compliant processes needed to effectuate the transfer legally. We also conclude the standard contractual clauses that have been pre-approved by the European Commission on 4 June 2021 for data transfers to third countries. Additionally, we follow the European Data Protection Board recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the GDPR mandated level of protection of personal data.
AfterShip’s DPO, GDPR Representative, and Employees
Does AfterShip have a Data Protection Officer (DPO)?
Our DPO ( dpo@aftership.com), who has expertise in data privacy, with more than 10 years of experience, in privacy and data protection matters: audits, DPIAs, transfer impact assessments, ISO 27001 projects, etc. and a long track record in assisting clients bringing novel technology products to market and of ensuring regulatory compliance.
Does AfterShip have a GDPR representative?
Pursuant to Article 27 of the GDPR, AfterShip has appointed the European Data Protection Office (EDPO) as its GDPR representative in the EU. You may contact EDPO regarding matters pertaining to the GDPR:
- by using EDPO’s online request form: https://edpo.com/gdpr-data-request/
- by writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium
How does AfterShip ensure that persons accessing personal data comply with legal requirements?
All AfterShip personnel who have access to personal data are provided such access in accordance with applicable data protection laws, and trained on the requirements related to such access. In addition to training sessions, AfterShip implements clear access policies and processes to promote compliance and security in line with our ISO27001 and SOC2 Type 2 certification, which are designed to ensure fulfilment of AfterShip’s obligations under applicable data protection laws.
Data Subject and Data Controller Requests
The following describes how personal data is managed when AfterShip receives a request from the individual whose personal data is being processed by AfterShip (each a “data subject”) or AfterShip’s customers, when they instruct AfterShip to process personal data. There are several different obligations that apply to AfterShip when it processes personal data. AfterShip might encounter requests from different parties to perform actions with respect to types of personal data that are stored or processed by AfterShip.
In most cases, a data controller will be AfterShip’s customer or logistics partner, and AfterShip will act as data processor, in accordance with the applicable data protection laws and the DPA. Please find below: (i) the process implemented by AfterShip, and (ii) an overview of data subject rights.
AfterShip Process for the Implementation of Rights
To ensure that the rights described in Section 2 are respected, AfterShip has implemented the following procedures:
AfterShip as a data processor
The majority of the time, AfterShip is acting as a data processor. This means that AfterShip processes personal data based on the instructions of a data controller, normally AfterShip’s professional customers such as merchants, platforms, or logistics partners.
In this case, AfterShip will act in accordance with the following process:
Data subject requests: a request from a data subject should be sent via email to privacy@aftership.com. In each case, AfterShip will forward the request to the relevant data controller without undue delay. AfterShip will comply with the data controller’s instructions on how to respond to the Data subject request.
Data controller requests: instructions from a data controller should be sent via email to privacy@aftership.com. AfterShip shall comply with data controller’s instructions, without undue delay, in accordance with and subject to the DPA and the applicable data protection laws.
AfterShip as a data controller
In the event where AfterShip is acting as a data controller, i.e. when the data subject uses AfterShip mobile application to track personal shipments, AfterShip will act in accordance with the following process:
- Data subject request: request from a data subject should be sent via email to privacy@aftership.com. Requests from data subjects will be answered within 30 days and fulfilled free of charge in accordance with applicable data protection laws.
Data Protection Rights
Data subjects have a number of rights under applicable data protection laws.
The right to request access to personal data
A data subject has the right to obtain the following information:
- Confirmation that data subject’s personal data is being processed;
- The purposes of the processing;
- The categories of personal data processed;
- The recipients or categories of recipients to whom the personal data is disclosed;
- The retention period or the criteria applied to determine that period;
- The existence of the right to object to and to request rectification, erasure, or the restriction of processing of personal data;
- Where personal data was not collected directly from the data subject and any information available regarding the source of personal data; and
- The existence of any automated decision-making (including profiling) and meaningful information about the logic involved and the relevant consequences attached thereto.
This communication shall not adversely affect the rights and freedoms of others, which means that AfterShip cannot provide personal data related to any other data subject.
The right to obtain the rectification of any inaccurate personal data
Each data subject has the right to obtain the rectification of inaccurate personal data. Moreover, a data subject has the right to complete any incomplete personal data which is relevant for the purposes of the data processing.
The right to obtain the erasure of personal data
A data subject may request the erasure of personal data, under the following circumstances:
- Personal data is no longer necessary in relation to the purposes for which such personal data was collected or otherwise processed;
- A data subject withdraws consent which formed the sole legal grounds upon which processing was based;
- A data subject objects to the processing of personal data, which is either based on a data controller’s legitimate interest or necessary for a task carried out in the public interest or in the exercise of official authority vested in the data controller, and there are no overriding legitimate grounds for the processing;
- A data subject objects to the processing of personal data for direct marketing purposes, which includes any profiling related to direct marketing;
- Personal data has been unlawfully processed; or
- Erasure of personal data is necessary to comply with a legal obligation.
A data controller has no obligation to erase personal data in certain cases. In such a case, AfterShip will follow the data controller’s instructions. This includes cases where the processing is necessary, such as:
- To exercise the right to freedom of expression and information;
- To comply with a legal obligation, to carry out a task in the public interest, or to exercise an official authority vested in the data controller;
- For reasons of public interest in public health;
- For archiving purposes in the public interest, scientific or historical research, or statistical purposes (to the extent that the request would render impossible or seriously impair the objectives of such processing); or
- For the establishment, exercise, or defence of legal claims.
The right to limit the processing activities to which the personal data is subject
A data subject may request to restrict the processing of their personal data.
- The data controller must apply the restriction in the following cases:
- During the time needed to verify the accuracy of personal data that has been contested;
- When processing is unlawful, and the data subject requests restriction instead of erasure;
- When the personal data is no longer needed by the data controller but is required by the data subject to establish, exercise, or defend legal claims; or
- When an objection has been raised, and the data controller is verifying whether its legitimate grounds override those of the data subject.
During the restriction period, personal data may only be processed:
- With the data subject’s consent;
- For the establishment, exercise, or defence of legal claims;
- To protect the rights of another natural or legal person;
- For reasons of important public interest; or
- For storage purposes.
When a restriction is lifted, the data subject shall be informed.
The right to data portability
This means that the data subject shall receive personal data communicated in an easily transferable format and the data controller must transmit personal data to a person of its choosing. Personal data should be communicated in a structured, commonly used and machine-readable format, and upon request, can be directly transmitted to another data controller.
This applies in the following cases:
- The processing is based on data subject’s consent;
- The processing is based on the performance of a contract to which a data subject is a party.
This right does not apply to:
- The processing of personal data necessary for the performance of a task carried out in the public interest or in exercise of official authority vested in the data controller;
- Another person’s personal data: the communication should not adversely affect other people’s rights. This means that personal data related to another data subject cannot be transferred.
The right to object
- A data subject has the right to object to the processing of their personal data, in the following cases:
- Processing is based on the data controller’s legitimate interest, or;
- Processing is done for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
- Any processing of personal data for direct marketing purposes.
- The data controller should stop processing personal data, unless:
- Compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject can be demonstrated, or;
- For the establishment, exercise, or defence of legal claims.
This does not apply to direct marketing activities, which should always be stopped upon objection (including any profiling activities).
Automated individual decision making
- A data subject has the right not to be subject to a decision based solely on automated processing (including profiling), which produces legal effects or affects them similarly. This means that a data subject has the right to have human intervention in decision making that impacts their rights/legal situation, unless otherwise foreseen by the law.
Status Transparency
We proactively monitor our uptime status, making us a reliable, consistent, and trustworthy partner. View our platform status
More Questions?
If you believe you have found a security vulnerability in an AfterShip application, the AfterShip platform, or our infrastructure that could harm AfterShip or anyone who uses AfterShip, contact both security@aftership.com and privacy@aftership.com.
For questions related to personal data or privacy, or for data subject requests or data controller requests, contact privacy@aftership.com.
For questions related to account login, account security, or billing, visit our help center or contact our Support team at support@aftership.com.