API security, data storage and GDPR compliance

See where Ducky’s API runs, how we keep it secure and how we comply with regulations like GDPR

GDPR compliance

Our API offering does not log any personal information. It is designed to be used “server-to-server”, meaning the only IP addresses our servers see are the ones from our clients’ servers. No personal information is stored by any services.

For end users of Ducky’s websites and other services, see our privacy policy.

Where do you store data and where are the servers located?

The application servers are located in Northern Europe.

System security

IAM for cloud services follows principle of least privilege.

All accounts use two-factor authentication and SSO.

Applications follow security best practices and scans for vulnerabilities regularly.