SOC2

A black and white icon of a medal with stars on a white background.

ISO 27001

A shield with a cross in the middle on a white background.

GDPR Ready

A pair of arrows pointing up on a white background.

99.5% Uptime

Build secure, reliable websites every time

Every website built using Duda is backed by enterprise-grade security and industry-leading reliability, so you can worry less about your infrastructure and focus more on delivering great websites.

A screenshot of a smart homes website with a door handle

Secure from the start

A pair of blue squares with diagonal lines on them on a white background.

Rock-solid infrastructure

Build sites that can weather any storm with 99.5% uptime, advanced cybersecurity practices, and automatic backups.

Secure development

With Duda, security starts at development. Code is written in a way that minimizes risk and is then repeatedly tested for vulnerabilities.

A blue square with arrows pointing in opposite directions on a white background.

Protected data

Your data, and your customers’ data, is carefully protected by industry standards like ISO 27001 and engineering safeguards.

A blue shield icon on a white background.

Websites built using Duda boast advanced cybersecurity practices, automatic data protections, and ultra-reliable hosting—all of which come together to form a strong foundation.

Rock-solid infrastructure

The entire Duda platform, from individual websites to the editor itself, is hosted on Amazon’s dependable AWS platform to provide the reliability your clients expect. See it for yourself.

99.5% site uptime

Duda websites come with automated DDoS mitigation, SSL certificates, data encryption, and strict access controls out of the box to squash attacks from bad actors—all without you needing to even lift a finger. 

Advanced cybersecurity

Your data, and your customer’s data, is physically dispersed across multiple cloud-computing zones and automatically backed up to reduce risk while ensuring integrity and easy recovery.

Worry-free data storage

At Duda, a high degree of security and reliability is woven throughout the platform- starting with the very first line of code and continuing throughout the life of the product.

Secure software development

We incorporate industry-leading security practices throughout the entire development process via rigorous information governance and best practice organizational procedures.

Secure software development lifecycle

Through automated scanning, continuous patch deployment, and blackbox penetration testing we constantly monitor for—and mitigate—any vulnerabilities.

Vulnerability management

We employ SAST, DAST, and SCA testing tools alongside cloud-infrastructure vulnerability scanners to ensure the security and integrity of the platform.

Security testing

Your data is in good hands

Through a thoughtful system of engineering and organization safeguards, your data, and your customer’s data, is locked down and safe from prying eyes.

Secure information practices

Duda implements a comprehensive and continuously improving information security policy, is certified to ISO/IEC 27001:2022 and has completed a SOC 2 Type II examination.

Robust user permissions

Account owners can tailor the level of access each client and teammate has down to the individual feature, so edit access is only available to those who need it.

Password safety built-in

Enforce an added level of security and mitigate phishing and other password-related risks with multi-factor authentication (MFA) and single sign-on (SSO).

Privacy and consent management

All Duda sites come with Privacy and Privacy Settings pages available right out of the box, alongside support for Cookie Notifications and tracking toggles.

GDPR ready

With support for Europe-only hosting in Frankfurt and advanced cookie compliance integrations, Duda lets you build sites that stand up to the strictest privacy regulations.

Delete and destroy

Customer Data is only retained so long as Duda and the partner or customer have an active agreement—after that it’s destroyed.

I love that Duda comes integrated with security, SSL certificates, all that you need to get your website securely added to the internet.
Chris B.
Read the full review
Building accessible and compliant websites
Read the case study
Security isn't just about protecting data; it's about safeguarding trust and respecting user privacy.
The Ultimate Checklist for GDPR Compliant Websites
Read the the full story
Duda is easy to use and intuitive platform that allows you to build sites for your clients really fast... Built-in security is a big plus and makes you save time.
Agency Professional
Read the full review

Security FAQs

  • How often does Duda go down?

    The Duda professional website builder is highly stable with a 99.5% uptime guarantee. Uptime status is monitored and reported live.

  • Do I need to buy an SSL certificate?

    No. Duda provides, and automatically renews, SSL certificates for every site published at no additional cost.

  • Do I need to get DDoS protection?

    No. Duda provides robust DDoS protection for every site published, and the editor itself, at no additional cost.

  • What data encryption methods does Duda use?

    Duda uses HTTPS and TLS 1.2/1.3 to encrypt data in transit, while data at rest is protected by AES-256 encryption.

  • How does Duda comply with European data protection requirements?

    Duda maintains privacy and security measures designed to support its obligations under the GDPR. Our commitment to privacy & data security is a long-term commitment, not a one-off project. Duda is an active participant in the Data Privacy Framework, certified since 2017, with support for Europe-only hosting among other GDPR-specific considerations. For more information, please visit Duda’s Data Privacy Addendum.

  • Is Duda SOC2 certified?

    Yes. Duda has completed a SOC 2 Type II examination covering Security, Availability, and Confidentiality.

  • How does Duda keep customer sites and data separate?

    Duda is a multitenant platform. Customers share underlying infrastructure but do not share access to one another’s sites or data. Duda uses account and site identifiers, permission checks, encryption, and restricted production access to maintain logical separation between customer environments.

  • How does Duda respond to security incidents?

    Duda maintains an incident-response process covering detection, investigation, containment, recovery, and follow-up. The CISO coordinates the response with the appropriate Engineering, DevOps, Legal, Support, and business teams. If customer personal data is affected, Duda provides notification according to its Data Processing Addendum.

  • How can I secure my Duda account?

    All users should enable two-step verification or SSO where available, use unique credentials, and regularly review team and client access. They should also secure the email, domain registrar, DNS, and payment accounts connected to Duda. Duda’s trusted-device checks notify users about access attempts from unrecognized devices.

  • Does Duda use customer data to train AI models?

    Duda does not use Customer Personal Data submitted to or generated through AI features to train general-purpose or cross-customer AI models unless the customer has expressly authorized that use in writing. AI providers processing data for Duda are managed under Duda’s supplier and subprocessor requirements.

  • Can I review and restore changes to my site?

    Authorized users can use Duda’s activity and backup features to review relevant activity and recover from unwanted changes. Duda normally creates an automatic backup when a site is published, and customers can create manual backups before major changes or custom-code updates. Deleted sites may be recoverable through Support for a limited period.