Trust center

Last updated: 6 November 2026

Everything a security or procurement review usually asks for, in one place. If you need something that isn't here, such as a completed security questionnaire, email [email protected] with "Security" in the subject.

At a glance

Company	SunDevs (Pvt) Ltd, Sri Lanka
Hosting	Oracle Cloud Infrastructure, United States, behind Cloudflare
Encryption	TLS for all traffic; data at rest on encrypted storage; secrets encrypted or one-way hashed
Tenant isolation	Enforced in the data layer and tested automatically on every change
Sign-in	Passwords bcrypt-hashed, sign-in lockout, two-factor sign-in for every account, required for our administrators
Backups	Encrypted before they leave our servers, stored off-site, point-in-time recovery, restore drills
Payments	Processed by Paddle, our PCI DSS compliant merchant of record
Privacy	GDPR, UK GDPR and Sri Lanka PDPA; DPA with Standard Contractual Clauses
Status	status.sunlicense.com
Vulnerability reports	Vulnerability disclosure policy, with safe harbor

Security

How the Service is protected (isolation, access control, credentials, data protection, operations and incident response) is described on the Security page, which is also Annex II of our DPA.

Internally, SunDevs follows a written Information Security Policy, approved by the company's leadership and reviewed at least once a year. It covers access control, cryptography, secure development and change management, vulnerability management with fix deadlines by severity, logging, incident response, business continuity, suppliers, people and devices. We also keep an incident response plan and a security risk register. Customers under review can ask us for a summary.

Privacy and data protection

• Privacy policy: what we collect and why, and your rights
• Data processing addendum: our obligations as your processor, including Standard Contractual Clauses for transfers, breach notification within 72 hours, and audits
• Subprocessors: who processes data for us, what, and where; we notify every organization's Owner before adding one
• Data retention policy: how long each kind of data is kept and how it is deleted
• Data location: the Service runs in the United States and is delivered through Cloudflare's global network; backups and files are stored in Cloudflare R2; service email is sent through Brevo in the EU

Payments

Payments are processed by Paddle, our merchant of record, which is PCI DSS compliant. Card details are entered on Paddle's checkout and never reach SunLicense's servers, so SunLicense doesn't store, process or transmit cardholder data. Paddle publishes its PCI DSS attestation on its trust center.

Availability and continuity

• Live status and incident history: status.sunlicense.com
• License validation is designed to keep working when other parts of the Service are down, and offline license files let your software run without reaching us at all
• Databases are backed up automatically, encrypted with a key the server itself can't use to decrypt, and kept off-site; the main database has point-in-time recovery, and restores are tested regularly

Vulnerability disclosure

Report security issues under our Vulnerability disclosure policy. We acknowledge reports within 3 business days and don't take legal action against good-faith research. The contact is also published in security.txt.

Certifications and assessments

• SOC 2 / ISO 27001: not held yet.
• Security questionnaires: we answer reasonable questionnaires, at most once a year per customer as set out in the DPA. Email [email protected].