Docker’s Security and GRC team manages our security and compliance program. A dedicated team with legal, security engineering, information security, and GRC resources supervises all security and privacy-related business operations.

Yes. Docker undergoes annual  SOC 2 Type 2 audits.

Our SOC 2 Type 2 report is available via our Trust Center. Customers can obtain a copy by submitting a request.

The current SOC 2 Type 2 audit report includes Docker Desktop, Hub, Scout, Build Cloud, Testcontainers Cloud, Docker Hardened Images (DHI), and Offload. As new products are introduced, they are evaluated for scoping and inclusion in our audits based on GA release date and the reporting cycle.

Docker relies on cloud hosting providers and sub-processors in a shared responsibility model. Their security responsibilities are covered in the cloud hosting provider’s compliance attestations (e.g., SOC 2, ISO 27001, ISO 27701), which Docker reviews annually.

Yes. All of Docker Hub is included, which includes public and private repositories.

Docker first achieved ISO 27001 certification in April 2024 and ISO 27701 certification in May 2026. Docker’s ISO 27701 scope and certifying body are as provided by the actual certificate. Our ISO documents are available to customers under NDA on our Trust Center.

Docker follows NIST standards where applicable, but our alignment is not 100%.

Yes. Docker has a Governance, Risk, and Compliance team that is responsible for performing internal assessments of Docker’s control environment. The audits are focused on technical and security requirements, as well as compliance with contractual obligations and applicable legislation (i.e., GDPR).

Docker does not provide audit rights beyond questionnaires. Our compliance reports, security policy TOCs, and frequently requested security documentation are available to customers on our Trust Center. Customers can submit a documentation request.

Yes. Due to our worldwide customer base, Docker is subject to many different privacy laws and regulations. Docker complies with leading privacy regulations like GDPR, CCPA, CPA, CTDPA, VCDPA, UCPA, and The APEC Privacy Framework. See our Privacy FAQs for more information.