At AppFollow, protecting your data is a core priority. We follow the principles of confidentiality and EU data protection law, including the GDPR, and are ISO/IEC 27001:2022 certified.
For our certifications, policies, security controls and full list of subprocessors, visit the AppFollow Trust Center.
AppFollow collects publicly available app store data. It can also analyze data from your developer accounts when you connect them through integrations (e.g. Google Play Console, App Store Connect).
In this article, you'll learn about AppFollow's certifications, how we handle personal data, where your data is stored, and the security practices we follow.
Certifications
ISO/IEC 27001:2022
AppFollow has been ISO 27001 certified since May 2024 and successfully passed its surveillance audit in 2026, confirming continued compliance with the standard. ISO 27001 is the global standard for information security management, ensuring best practices for data protection.
You can view our certificate in the Trust Center.
SOC 2 Type II (in progress)
We are currently undergoing a SOC 2 Type II audit and expect to complete it in Q4 2026. The report will be published in our Trust Center once available.
Personal Data and GDPR
When you use AppFollow, we process personal data on your behalf as a data processor. This includes app store review data and data of your account's authorized users. We process it in accordance with the GDPR, our Privacy Policy and DPA.
The list of subprocessors we rely on, along with their purpose and location, is available in the Trust Center.
AppFollow is a company organized under the laws of Finland.
Data Location
Our hosting infrastructure is located in the EU:
- Customer data that we process on your behalf is stored in Germany (Amazon Web Services, Frankfurt, and Hetzner).
- Publicly available data that AppFollow collects independently, such as public app store data, may be processed on Hetzner servers in Finland.
Certain optional features may involve subprocessors outside the EU. See the subprocessors list for details.
Security Practices
We apply the principle of least privilege: no user or service, internal or external, has more access than it needs to function.
Our internal security policy covers our production, development and testing environments, including:
- Network security (firewalls, internal and private networks)
- Access security (SSH certificates, password policies, SSO role mappings)
- Data encryption and anonymization (database backups, secure service-to-service data transfer, anonymized data in dev/test environments)
- Web application firewall rules
- Centralized logging and alerting
Our web servers are rated A+ on SSL Labs.
A full overview of our security controls is available in the Trust Center.
Penetration Testing and Bug Bounty
We run independent penetration tests regularly. The report is available on request. Requests can be sent via security@appfollow.io.
We also run a limited bug bounty program.
Billing Information
Payments are processed by Stripe, which is certified as a PCI DSS Level 1 Service Provider, the highest level of certification in the payments industry. AppFollow does not store your full card details.
Google Play: Reply to Reviews Permissions
To reply to Google Play reviews from AppFollow, you need to connect your Google Play Console.
During this process, Google displays a general permission scope ("View and manage your Google Play Developer account"). However, AppFollow only needs the Reply to reviews permission, and you can grant only that permission in your Google Play Console. AppFollow never uses your account to control or change your app.
F.A.Q.
Have there been security incidents in the past?
No major security incidents have occurred. We have received a few minor reports, all of which were resolved with no impact on customers.
Do you have security certifications?
Yes. AppFollow is ISO/IEC 27001:2022 certified, and our SOC 2 Type II audit is in progress (expected completion: Q4 2026).
Do you have a bug bounty program?
Yes, we run a limited bug bounty program.
Do you run independent penetration tests?
Yes, regularly. The report is available on request via security@appfollow.io.
Which third-party services do you use?
See the full list of subprocessors in our Trust Center.
How can I check AppFollow service status?
Real-time status, ongoing incidents, scheduled maintenance and past uptime are published at status.appfollow.io.
Who can I contact?
- Security questions: security@appfollow.io
- Compliance and legal questions: legal@appfollow.io
- Product and account questions: contact our support team
For more information, see our Privacy Policy, AI Security, User Agreement and Trust Center.