Docker
Developer platform · docker.com · last read 2026-10-12
Identity
| Legal entity | Docker, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 2549000RVI3MXKU6VF93 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | docker.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
No data-location observation recorded yet.
Subprocessor chain
8 third parties · 5 of the vendor's own group companies · 10 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services, Inc. | US | Cloud service provider |
| Anthropic PBC | US | Generative AI services provider for AI product features |
| Auth0, Inc. (by Okta) | US | Single Sign-On provider |
| Cloudflare, Inc. | US | Content delivery network provider |
| Google, Inc. | US | Cloud service provider |
| OpenAi, L.L.C. | US | Generative AI services provider for AI product features |
| Salesforce, Inc | US | Cloud-based Customer support services |
| Snowflake Inc. | US | Data infrastructure provider |
Docker's own group companies listed as subprocessors (5)
| Company | Country | Purpose |
|---|---|---|
| Docker (Germany) GmbH | DE | — |
| Docker (Netherlands) B.V. | NL | — |
| Docker (UK) Ltd. | GB | — |
| Docker France SAS | FR | — |
| InfoSiftr, LLC. | US | — |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
The vendor's data processing agreement could not be read: the site refused our crawler.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | — | docker.com | 2026-10-08 |
| CSA Trusted Cloud Architectural Standard · CSA | Claimed | — | docker.com | 2026-10-08 |
| Data Privacy Framework · DPF | Claimed | self-certified | docker.com | 2026-10-08 |
| GDPR | Claimed | — | docker.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Available on request | — | docker.com | 2026-10-08 |
| ISO 27701 · ISO27701 | Available on request | — | docker.com | 2026-10-08 |
| The APEC Privacy Framework | Claimed | — | docker.com | 2026-10-08 |
| SOC 2 · SOC2 | Claimed | — | docker.com | 2026-10-08 |
| SOC 2 Type 2 · SOC2T2 | Available on request | Docker Desktop, Hub, Scout, Build Cloud, Testcontainers Cloud, Docker Hardened Images (DHI), and Offload; all of Docker Hub, including public and private repositories | docker.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Docker | Active | HR data, non-HR data | 2027-01-29 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Docker | Active | HR data, non-HR data | 2027-01-29 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Docker | Active | HR data, non-HR data | 2027-01-29 | 2026-10-09 |
| Global LEI Index (GLEIF) | DOCKER, INC. · DOCKER, INC. | ISSUED | US-DE | 2027-01-10 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Docker; Docker, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Docker; Docker, Inc.
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Docker; Docker, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Docker; Docker, Inc.
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Docker; Docker, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Docker; Docker, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2030-01-01; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Refused | partial | — | 2026-10-09 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.