We checked 16 ecommerce operations vendors. Three publish a security certification.

We read the public websites of sixteen ecommerce operations vendors on 28 August 2026 and looked for one thing: what a buyer can verify without signing an NDA or booking a call.

The vendors: Linnworks, Brightpearl, Cin7, Extensiv, Veeqo, ChannelEngine, Rithum, Lengow, PlentyONE, Billbee, Xentral, Channable, Productsup, Akeneo, Plytix and Sales Layer.

Everything below is a fact about a website on a date, not a judgement about a company. Certifications are held privately far more often than they are published, and a vendor with no security page may have an excellent security programme. That is rather the point: you cannot tell.

Three of sixteen name a certification

Vendor	What the site names
ChannelEngine	ISO 27001, since 2022
Rithum	SOC 2 Type II
Productsup	ISO 27001

The other thirteen do not name one on their site. Six have no security page at all — no trust centre, no compliance page, nothing between the pricing page and the privacy policy.

Sub-processor lists are uneven, and the good ones are public

Correction, 31 August 2026. This section previously said that not one of the sixteen publishes the list of sub-processors it uses. That was wrong, and it is withdrawn rather than softened. At least two of the vendors read do publish one:

• ChannelEngine names its sub-processors in Annex 3 of its public client DPA — Microsoft Ireland, Google Ireland, HubSpot, Zendesk, Zapier, Crossbeam and Atlassian, each with a purpose and a location. Checked 31 August 2026.
• Channable publishes a standing list of sub-processors with an updated-on date and an effective-from date. Checked 31 August 2026; the page is served behind a bot check, so the list itself was read from the PDF it links rather than from the page.

The original sentence was a count taken in one pass with no record of how each site was checked, which is exactly the kind of claim this article tells you not to accept from a vendor. It should not have survived its own advice. The other counts in this article carry the same caveat: they are one reading on one morning, and the method was “look at the website”, not “audit the company”.

What remains true is that a published list is unevenly distributed and worth asking for. If you are a controller under the GDPR, your processor’s sub-processors are your problem: Art. 28(2) requires the processor to have your authorisation to engage them, and Art. 28(4) makes the processor liable for them. A DPA that promises to notify you of changes to a list you have never seen is a promise about a document that does not exist publicly.

The Commission’s own standard contractual clauses for controllers and processors assume you can identify who is processing the data. A published list is how a vendor makes that answerable before the contract rather than after it.

Nine of sixteen publish no pricing, and every published price is qualified

Nine of the sixteen sites show no price at all. Every price that is published carries a qualifier — “starting at”, or a cap tied to GMV, or a band that resolves on a call.

There is a defensible reason for this in a business where implementation cost dominates licence cost. There is also a less defensible one, and a buyer cannot distinguish them from outside. What a buyer can do is ask which of the two it is, and ask for the meter: what is counted, when it is counted, and what happens when the count grows.

Eight of sixteen have a 404 on a URL their own navigation links to

This is the finding we expected least and rechecked most.

Broken on 28 August 2026: Akeneo’s /pricing and /trust-center, Channable’s /security, Extensiv’s /pricing, Rithum’s /pricing, Productsup’s /security, ChannelEngine’s trust-centre link, and several Xentral feature URLs.

A dead link is not a security finding. But /trust-center and /security returning 404 from a live nav is a fact about how closely anyone is reading those pages — and the trust page is the one page whose whole job is to be current.

What to ask instead

Adjectives are free. “Enterprise-grade”, “bank-level” and “military-grade” are not claims anybody can fail. These five questions have answers that can be wrong, which is what makes them worth asking:

1. Which certification, issued by whom, covering which scope, valid until when? “ISO 27001” without a scope statement can cover a single office.
2. Where is the sub-processor list, and how am I notified before it changes? Before, not after — Art. 28(2) is about authorisation.
3. Where is the data, and who can reach it? Region, and which staff roles have production access.
4. What is your last penetration test, and will you share the summary? A summary letter is normal to share; the full report is normally not.
5. What happens on exit? Export format, retention period, deletion evidence.

If a vendor cannot answer 1 and 2 from a public page, you have learned something about how long the answers take internally.

Where Zuduno stands

We hold no security certification. Not ISO 27001, not SOC 2, and neither is in progress. Saying so first is the point of the page.

What exists instead is a published inventory of twelve controls, including the ones that are not in place. That is on Security & trust, which also carries the certification status as the first thing on the page rather than the last.

We wrote this article knowing it invites the same audit of us. That seemed like the right way round.