Question 1

What security measures are in place to safeguard customer data?

Accepted Answer

We employ robust security measures to protect customer data. This includes encryption for data in transit and at rest, compliance with GDPR and other applicable laws, and a cloud-native infrastructure following Zero Trust principles. Access to data is restricted based on the principle of least privilege, and comprehensive monitoring is in place to detect and respond to potential threats.

Question 2

Are you SOC 2, ISO 27001, or similarly certified?

Accepted Answer

Yes, we have been ISO 27001:2013 certified since 2022. The certification of our ISMS covers all of our development and production of Wolt products. See more in this blog post.

We are also PCI-DSS certified as we process payment information.

Question 3

I want to report a bug in your systems, do you have a bug bounty program?

Accepted Answer

Yes! We run our bug bounty program on Intigriti, there you can find our scope and are free to enroll to our program. Happy hacking!

Question 4

How do you handle security vulnerabilities?

Accepted Answer

We have a vulnerability management process that includes regular scanning, timely patching, and a protocol for escalating and resolving critical vulnerabilities.

Question 5

How do you secure third-party integrations or data sharing with other vendors?

Accepted Answer

We conduct thorough due diligence on all third-party vendors and require them to adhere to our security standards. Vendors go through a standardised vendor management process and onboarding where security and privacy aspects are assessed and reviewed. Security and privacy topics are incorporated into standard contract clauses.

Question 6

What measures are in place to ensure the physical security of premises?

Accepted Answer

We ensure the physical security and safety of our premises through access control systems and a dedicated physical security team responsible for implementing and maintaining robust security measures. All production data is stored in outsourced data centers.

Question 7

Do you provide security awareness training for your employees?

Accepted Answer

Yes, all employees undergo mandatory security awareness training annually, with additional targeted training for specific roles as needed.

Question 8

How do you manage data breaches, and what is your notification protocol?

Accepted Answer

In the event of a data breach or any other incident, we follow our incident response plan, which includes assessing the risk of exposure of personal data or classified information, containment of the underlying root cause and contacting of relevant stakeholders in accordance with legal requirements.

Question 9

I'd like to learn more about your security practices, where can I do that?

Accepted Answer

A good place to start would be to check out our Security Whitepaper, available to everyone.

Resources
Security Whitepaper Find out how we operate as a team and how we approach mitigating our core risks.	Link
Post about our ISO 27001:2013 certification See our blog post about our initial certification in 2022.	Link
Security Careers Site Interesting in working with us? Find our career pages here.	Link
Public Bug Bounty Program Security researchers welcome!	Link

Trust Center - Security

Public documentation and links

Security FAQ