Security & Trust

Your trade documents carry commercially sensitive information. Protecting it is built into how Customs Declare works, not added afterwards. This page describes the measures in place today, and we update it whenever they change.

Your data stays in your workspace

Each company’s workspace is kept strictly separate from every other. The separation is enforced by the database itself on every request, not only by application code, so one customer can never see another customer’s documents or declarations.

Encryption

• All connections to Customs Declare are encrypted, and secure HTTPS connections are enforced.
• Credentials for the integrations you connect, such as your accounting software or mailbox, are encrypted at rest using industry-standard encryption.
• Passwords are never stored in readable form -- we keep only a one-way hash that can’t be reversed. The same applies to API secrets and to password-reset, invitation and signup links.

Account protection

• Session cookies can’t be read by scripts running in your browser and are only ever sent over encrypted connections.
• If a session appears to have been copied and reused, we sign that user out on every device.
• “Continue with Google” sign-ins and signup links only work in the browser that started them, so an intercepted link is useless to anyone else.
• Password-reset, invitation and email-verification links expire and can be used only once.
• Automated protections limit repeated sign-in attempts and other abuse.

Protection against web attacks

Strict browser security policies protect every page against common attacks such as malicious script injection and clickjacking.

Access control

• Every member of a workspace has a role (admin, document processor, approver or viewer) that limits what they can see and do.
• API access uses dedicated service accounts rather than a person’s login.
• Webhook notifications we send are signed, so your systems can verify they genuinely came from us.

A person approves every declaration

No declaration is ever finalized automatically. Each one needs explicit approval by a member of your team, whatever their role and however confident the automated result.

Secure payments

Payments are made on our payment provider’s secure checkout page. Your card details go directly to them -- we never see or store your full card number.

Where your data is processed

Our servers, database and document storage are located in Germany, in the European Union. Our Privacy Policy lists every service provider that processes data on our behalf and what each one sees.

You stay in control of your data

You can download a copy of the personal data tied to your account, or request deletion of your account, at any time from Account → Privacy & data while signed in.

No tracking on this site

We don’t run analytics, advertising, or third-party tracking scripts. See our Cookie Policy for exactly what’s set in your browser.

Reporting a security issue

If you believe you’ve found a security vulnerability, please email support@customsdeclare.com privately rather than disclosing it publicly, with enough detail for us to reproduce it. We’ll acknowledge your report and keep you informed as we fix it. Please give us reasonable time to fix the issue before disclosing it, and don’t access or change other customers’ data or disrupt the service while investigating.