Security at Picked
Last updated: July 13, 2026
Picked holds other companies' catalogue, stock, and order data. Here is how we protect it.
Where your data lives
Everything runs in the Netherlands on TransIP — servers, database, backups, and email. Your data does not leave the EU, except where a sub-processor below states otherwise.
Encryption
Traffic is served over TLS 1.3. Data is encrypted at rest, with additional application-level encryption on sensitive personal data.
Backups
Nightly encrypted backups: 14 daily and up to 3 monthly copies — residual copies expire within 90 days. Restore drill every quarter.
Access & 2FA
Two-factor authentication (TOTP) with recovery codes is available on every account. Access within a workspace is role-based.
Sub-processors
The third parties that process data on our behalf. We notify tenants of changes in advance, per the data processing agreement.
| Party | Purpose | Region |
|---|---|---|
| TransIP B.V. | Hosting, database, object storage, backups, and transactional email (VPS mail relay). | Region: Netherlands |
| Stripe | Subscription billing and payment processing. | Region: EU / US (DPA + Standard Contractual Clauses) |
| Sentry GmbH | Application error monitoring (EU region — Frankfurt). | Region: EU |
| BetterStack | Uptime monitoring and public status page. | Region: EU |
| Sendcloud | Shipping label generation (per-tenant, opt-in). | Region: Netherlands |
| PostNL | Direct carrier shipping labels (per-tenant, opt-in; recipient name and address). | Region: Netherlands |
| CM.com | SMS delivery for operational notifications (per-tenant, opt-in; phone numbers and message content). | Region: EU (Netherlands) |
| Anthropic | AI process generation from natural language. | Region: US (pending ADR) * |
| TransIP | Object storage for product images, media and GDPR export bundles. | Region: Netherlands |
* We will record this sub-processor's region as soon as our choice is final. Until then we make no promise here that we cannot yet keep.
The full sub-processor list also lives at picked.nl/legal/sub-processors.
Reporting a vulnerability
Think you've found a security issue? Email security@picked.nl. Report it privately and give us reasonable time to fix it before disclosing publicly. We will not pursue legal action against good-faith research that follows these rules.