Langdock
AI tools · langdock.com · last read 2026-10-12
Identity
| Legal entity | Langdock GmbH |
|---|---|
| HQ | DE |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | langdock.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | langdock.com | 2026-10-08 |
EU: The document labels the standard multi-tenant SaaS deployment as "Hosted via Microsoft Azure on servers inside the EU." It names no extra cost, add-on or customer opt-in for this. It says hosting for most models is "configurable", and only the dedicated, own-cloud and on-premise deployments are tied to Enterprise seat thresholds.
Subprocessor chain
7 third parties · 0 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services (AWS) | EU | AI Provider |
| Cloudflare | EU | Protection against malicious traffic |
| Google Cloud | EU | AI Provider |
| Microsoft Azure | EU | Hosting & AI Provider |
| Mistral | EU | AI Provider |
| OpenAI Ireland Ltd | EU | AI Provider |
| Sentry | EU | Error tracking |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · langdock.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC (module not stated) |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | other |
| Notice of new subprocessors | At least 14 days before engagement, by publication at https://trust.langdock.com/subprocessors and by email to those subscribed on that page |
| If you object to one | Written objection within 14 days of publication, on specific data protection grounds; otherwise deemed approved. If no agreement within 14 days of the objection, either party may terminate on 30 days' notice |
| Breach notification | without undue delay after becoming aware of the breach |
| Audit | Information on request; compliance shown primarily by independent attestations/certification audit reports (e.g., ISO 27001, SOC 2 Type II); inspections only on substantiated suspicion of breach or if reports are insufficient, preferably in writing/remote, during business hours with reasonable notice; third-party auditors must not be competitors and must sign NDA |
| Audit | Inspections may be carried out by a third party appointed by the Controller; that party must not be a competitor of the Processor and must sign a confidentiality agreement before the inspection |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| GDPR | Claimed | — | langdock.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | — | langdock.com | 2026-10-08 |
| SOC 2 Type II · SOC2T2 | Claimed | — | langdock.com | 2026-10-08 |
| SOC2 Type II · SOC2T2 | Claimed | — | langdock.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Langdock; Langdock GmbH
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Langdock; Langdock GmbH
- Data Privacy Framework List (US): checked 2026-10-12, no entry under Langdock; Langdock GmbH
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Langdock; Langdock GmbH
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Langdock; Langdock GmbH
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Langdock; Langdock GmbH
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Langdock Desktop | — | Not declared | unknown | docs.langdock.com | 2026-10-11 |
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | JavaScript only | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.