Trust
Security and sub-processors
How we protect the record of your sites, and every company that helps us run WPLogbook. Use this page for your clients’ security questionnaires; the formal commitments are in our data processing agreement.
Last updated 31 October 2026
How we protect your data
Kept in the EU
All data is stored and processed in the European Economic Area, with EU-owned providers. Nothing is sent to the US.
Encrypted
TLS 1.2 or higher for everything in transit. Data and backups are encrypted at rest.
Least access
Staff only get the access their work needs, always with two-step verification. Every staff access to a customer’s record is logged, in our own logbook.
Collect less, your choice
IP addresses are hashed, and we store only the hash with a shortened version of the address. The plugin strips form fields, cookies and request headers from error reports before anything leaves the site. Per site, you choose what else we record: switch off IP addresses or query strings, or record user IDs instead of names. A change applies from that moment on.
Tamper-evident record
Entries are chained so a gap or an edit shows. Personal data is stored apart from the chain, so it can be erased on request without breaking that proof.
Open plugin
The WordPress plugin is open source, so anyone can check what it sends. It sends nothing until you connect a site yourself.
Backups and recovery
Encrypted backups every day, kept in a second EU location. Every quarter we restore one to test it.
Benchmarks without names
Benchmarks are built from anonymous totals only, with personal data and anything that points to you, your clients or your sites removed first. A figure is only shown when at least 10 accounts contribute to it.
Sub-processors
These companies process data on our behalf. All are based in the EU and bound by a data processing agreement. We tell customers at least 30 days before we add or replace one.
| Company | What for | Where | Data |
|---|---|---|---|
| TransIP | Application, database and record storage (VPS) | Amsterdam, Netherlands, EU | Site records, account data |
| TransIP | Encrypted backups, in a separate data centre | Alblasserdam, Netherlands, EU | Encrypted copies of the above |
| Mistral AI | Tally’s answers and summaries. Used only to produce the answer, kept for at most 30 days to detect abuse, never used for training | France, EU | Parts of a site’s record Tally needs for one answer |
| Lettermint | Alerts, reports and account emails | Netherlands, EU | Recipient name and email, message content |
| Mollie | Invoices and payments | Netherlands, EU | Billing contact and company details |
Want to hear about changes? Email privacy@wplogbook.com and we’ll add you to the notification list.
Found a security issue?
Tell us at security@wplogbook.com. We reply within two working days, keep you informed, and don’t take legal action against people who report in good faith and give us time to fix it. Our security.txt is at wplogbook.com/.well-known/security.txt.
WPLogbook is a service of WP Logbook, Pastoor Jansstraat 5, 6658 AZ Beneden-Leeuwen, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 84342145.