Trust centre

Trust, security and compliance

KleverCargo is built and operated by Klever Logistics doo under an ISO/IEC 27001:2022 certified information security management system, hosted in the European Union, with a GDPR data processing agreement available to every customer.

ISO/IEC 27001:2022
Plus ISO 9001, 14001 and 45001
Frankfurt, EU
Servers, database, documents and primary backups
GDPR DPA
With EU Standard Contractual Clauses
48 hours
Breach notification to customers

Certifications

Klever Logistics doo holds four management system certificates issued by SCK Certifications Pvt. Ltd. under accreditation by the United Accreditation Foundation (UAF), a signatory of the IAF Multilateral Recognition Arrangement. Scope: provision of IT digital support services for the logistics and transport industry, including development, implementation and support of the KleverCargo application platform, IT platform infrastructure and client data handling. All four are listed as active on IAF CertSearch.

ISO/IEC 27001:2022
ACTIVE
Information Security Management System
SCK/05/KLD/25/38/4080
First issued 22.05.2025 · valid to 21.05.2028 · surveillance audit passed May 2026
ISO 9001:2015
ACTIVE
Quality Management System
SCK/01/KLD/25/38/4077
First issued 22.05.2025 · valid to 21.05.2028
ISO 14001:2015
ACTIVE
Environmental Management System
SCK/02/KLD/25/38/4078
First issued 22.05.2025 · valid to 21.05.2028
ISO 45001:2018
ACTIVE
Occupational Health and Safety Management System
SCK/03/KLD/25/38/4079
First issued 22.05.2025 · valid to 21.05.2028

Hosting and data location

Customer data is hosted in the European Union. An encrypted offline backup copy is kept at our premises in Serbia. Our team operates the platform from Serbia, a Council of Europe Convention 108+ country whose data protection law follows the GDPR.

Region

Application servers, the managed database, backups and document storage run in DigitalOcean’s Frankfurt (Germany) data centres, certified against ISO/IEC 27001 and audited under SOC 2 Type II.

Backups

The managed database takes automated daily backups with point-in-time recovery, retained for 7 days in the same EU region; uploaded documents are stored in redundant object storage in the same region. An additional offline copy of the database and documents is kept on an encrypted volume in a locked area at our premises in Serbia; a new copy is made daily and the last 30 are kept. Restores are tested yearly. Recovery point objective 24 hours, recovery time objective 8 hours.

Availability

We target 99.5% monthly availability. Maintenance is announced in the platform in advance and scheduled outside Central European business hours where possible. Every release is deployed atomically and can be rolled back.

Security practices

A summary of the ISO 27001 controls that matter most to customers. The full technical and organisational measures are Annex II of our Data Processing Agreement, and the detailed security documentation is available under NDA.

Access control
  • Data segregated per company; roles and per-feature permissions configured by your administrators
  • Drivers and gate staff see only their own tasks and visits
  • Passwords stored only as salted hashes; secure session cookies; rate-limited log-ins
  • Infrastructure access limited to named personnel with multi-factor authentication, reviewed quarterly
Encryption
  • TLS 1.2 or higher for all traffic, HTTPS enforced, Content Security Policy on the web application
  • Database, backups and document storage encrypted at rest
  • Secrets kept out of source code and rotated on personnel change
Operations
  • Separate production, development and test environments; no production data in development, except a recorded diagnostic copy on an encrypted laptop, deleted within 7 days
  • Version-controlled changes, automated testing before every release, automated deployment
  • Regular patching, dependency vulnerability checks and internal security reviews
  • Authentication, administrative and business events logged, with access restricted to authorised personnel
People and incidents
  • Confidentiality undertakings and security training for every employee and contractor
  • Documented incident response procedure
  • Customers notified of a personal data breach within 48 hours of KleverCargo becoming aware of it

Data protection

For the data your company puts on the platform, your company is the controller and KleverCargo is the processor.

Data Processing Agreement

Every customer accepts our DPA on the platform. It incorporates the EU Standard Contractual Clauses (Module Two), the UK Addendum and Swiss adaptations, a complete data inventory, our technical and organisational measures and the sub-processor list. Enterprise customers may sign it as a countersigned document.

Legal entity and EU representative

Klever Logistics doo, Đorđa Isakova 22, 21241 Kać, Republic of Serbia. Registration number 22085417, tax number 114885593.

EU representative under Article 27 GDPR: KleverCargo Innovation B.V., Veemkade 328, 1019 HD Amsterdam, the Netherlands.

Policies

Terms of use
Privacy policy
Cookie policy

The DPA is available inside the platform; prospective customers can request the text from legal@klevercargo.com.

Sub-processors

Third parties that process customer data on our behalf, each bound by a data processing agreement. Customers are notified 30 days before a sub-processor is added or replaced. Transfer safeguards for each are listed in the DPA.

DigitalOcean, LLC
United States entity · processing in Frankfurt, Germany (EU)
Cloud hosting of the Platform: application servers, database, backups and object storage for uploaded documents
Twilio Inc. (SendGrid)
United States entity · processing in United States and EU
Delivery of transactional e-mail sent by the Platform
Google LLC (Google Maps Platform)
United States entity · processing in United States and EU
Geocoding, maps and route calculation
Google LLC (Firebase Cloud Messaging)
United States entity · processing in United States and EU
Push notifications to the KleverCargo Drive mobile application
Infobip d.o.o.
Croatia (EU) entity · processing in EU
Viber Business Messages to customers’ contacts and receipt of their replies
Anthropic, PBC
United States entity · processing in United States
Artificial intelligence model that reads documents a User files (invoices and other shipment documents) while the User has automatic reading switched on, and suggests column mappings when a User asks for it during a spreadsheet import
Seyfor d.o.o. (Minimax online accounting, moj.minimax.rs)
Serbia entity · processing in Serbia
Issuing, delivering and bookkeeping of subscription invoices

Documents for procurement and security reviews

Available under NDA on request to security@klevercargo.com. We answer security questionnaires within 10 business days.

ISO certificates

Current certificates and the latest surveillance audit statement.

Statement of Applicability

Summary of the ISO 27001 Annex A controls in scope.

Security questionnaire

Completed security questionnaire structured after the CSA Cloud Controls Matrix, and a transfer impact assessment for Serbia.

Backup and recovery

Backup locations and schedule, recovery point and recovery time objectives, and the results of the latest restore test.

Report a vulnerability

If you believe you have found a security issue in KleverCargo, e-mail security@klevercargo.com with the steps to reproduce it. We acknowledge reports within two business days, keep you informed while we fix the issue, and will not take legal action against good-faith research that avoids data access beyond what is needed to demonstrate the issue, does not disrupt the service, and gives us reasonable time to remediate before disclosure.