Docker’s Information Security team manages our security and compliance program. A dedicated team with legal, security engineering, information security, and GRC resources supervises all security and privacy-related business operations.

Yes. Docker completed a SOC 2 Type 2 audit for the period of November 1, 2023, through January 31, 2024 and undergoes annual SOC 2 Type 2 audits.

Our SOC 2 Type 2 report is available to customers under NDA through your Account Executive. Customers can access Whistic by submitting a request for up-to-date security documentation.

Our next SOC 2 Type 2 report will be available in April 2025 and will cover the period February 1, 2024 through January 31, 2025.

The current SOC 2 Type 2 audit includes Docker Desktop, Docker Hub, Docker Scout, and Docker Build Cloud. Docker will evaluate additional products that are released for introduction based on GA release date and the reporting period.

Docker relies on cloud hosting providers and sub-processors in a shared responsibility model. Their security responsibilities are covered in the cloud hosting provider’s compliance attestations (e.g., SOC 2, ISO 27001), which Docker reviews annually.

Yes. All of Docker Hub is included, which includes public and private repositories.

Yes. Docker achieved ISO 27001 certification in April 2024. Our ISO documents are available to customers under NDA on Whistic.

Docker follows NIST standards where applicable, but our alignment is not 100%.

Yes. Docker has a Governance, Risk, and Compliance team that is responsible for performing internal assessments of Docker’s control environment. The audits are focused on technical and security requirements, as well as compliance with contractual obligations and applicable legislation (i.e., GDPR).

Docker does not provide audit rights beyond questionnaires. Our SOC 2 report, security policy TOCs, and frequently requested security documentation are available to customers on Whistic. Customers can access Whistic by submitting a documentation request.

Yes. Due to our worldwide customer base, Docker is subject to many different privacy laws and regulations. Docker complies with leading privacy regulations like GDPR, CCPA, CPA, CTDPA, VCDPA, UCPA, and The APEC Privacy Framework. See our Privacy FAQs for more information.