SOC2C

QRlogic

qr-logic.com
Security overviewCompliancePenetration test
Trust level
Domain Verified
Identity confirmed

The company proved it controls this domain (DNS or company email).

Domain verified via support@qr-logic.com● Verified Oct 2026

QRlogic is SOC 2 compliant.

Request report access
Framework
SOC 2
Auditor
Not public
Last report
—
Renewal
Unknown

About

QRlogic is a GDPR-focused QR code management platform for businesses. Create dynamic QR codes, update destinations without reprinting, and use smart routing rules and scan analytics. Hosted in Germany, QRlogic is designed to help businesses manage QR code campaigns with privacy in mind.

Compliance & infrastructure

Key controls
  • ✓Encryption in transit
Hosting
Hetzner (Germany)Elestio (Ireland)
Data handled
Anonymized IP addressesdevice typeapproximate locationQR code datascan timestamps

Subprocessors

2
  • E
    Elestio · Hosting infrastructure management
    Ireland
  • H
    Hetzner · Physical server infrastructure
    Germany

Penetration test

Unknown. QRlogic's penetration test vendor isn't listed yet.

Ask QRlogic to add who performed their pen test:

Listing history

  • FAQ added · by the company
  • FAQ added · by the company
  • FAQ added · by the company
  • FAQ added · by the company
  • Subprocessor added · by the company
  • Subprocessor added · by the company
  • Profile details updated · by the company
  • Profile claimed and domain verified · by the company
  • Listed on SOC2C

Complete this profile

3/11 details · 27%

SOC2C shows the verified essentials. 8 details are not yet provided. Trust centers list more, so we invite the owner to fill the gaps here.

  • Auditorraises trust
    Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
  • Report dateraises trust
    Add your most recent report period so buyers see how current your SOC 2 is.
  • Renewal date
    Add your renewal window so buyers know your coverage is active.
  • Other certifications
    List your other frameworks (ISO 27001, HIPAA, PCI DSS) the way your trust center does.
  • Trust center link
    Link your official trust center so buyers can request the full report.
  • Documents
    List the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
  • Security controls
    Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
  • Logo
    Add your logo for a recognizable listing.
Edit your trust center →

Frequently asked

Is QRlogic SOC 2 compliant?
QRlogic is SOC 2 compliant. On SOC2C this listing is Domain Verified.
Can I use QRlogic's SOC 2 for a vendor risk assessment?
Yes. QRlogic's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is QRlogic penetration tested?
QRlogic hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is QRlogic secure?
Security isn't a single yes/no, but QRlogic is SOC 2 compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does QRlogic have a bug bounty or vulnerability disclosure program?
QRlogic hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@qr-logic.com or via a /security page.

Answers published by QRlogic

Reproduced from QRlogic's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page.

Where is data stored?
QRlogic stores and processes data exclusively on infrastructure located within the European Union. Our infrastructure is provided by Hetzner in Germany and Elestio in Ireland. The database and authentication software are self-hosted on this infrastructure. No transfers of the personal data covered by our Data Processing Agreement outside the EU/EEA currently take place. For further details, please see our Data Processing Agreement: https://qr-logic.com/avv
Is QRlogic GDPR compliant?
QRlogic is designed with GDPR data protection principles in mind, including data minimization, access controls, and defined data retention periods. We provide a Data Processing Agreement under Article 28 GDPR and document our technical and organizational measures. Customers remain responsible for ensuring that their own use of QR codes and analytics complies with applicable data protection law. Our Data Processing Agreement is available at https://qr-logic.com/avv.
Which personal data does QRlogic process?
QRlogic processes limited scan analytics data, including anonymized IP addresses, device type, and approximate location derived from the anonymized IP address. Precise location is processed only when a scanner grants browser location permission, solely for location-based routing, and is not saved in the database. Additional information is available in our Data Processing Agreement at https://qr-logic.com/avv.
How long is customer data retained?
Customer data is retained in accordance with our data retention policy. Upon subscription expiration or termination, associated customer data is automatically deleted within seven days. Automated infrastructure backups are provided by Elestio, performed daily, and retained for 180 days. Backups are encrypted at rest using AES-256 and stored separately from the deployed environment. Personal data contained in backups is not deleted individually but is removed when the respective backup expires. Backups are used exclusively to restore the service in the event of a failure.