Bugfender vs Bugsink

Vendor claims penetration tests and SDLC reviews. No public independent audit report or no-logs attestation found (this product stores customer logs by design).

DPA allows customer-funded audits by agreement; no public third-party audit report reviewed.

ICDQ certificate 069/23 SGSI, ISO 27001:2022, BEENARIO GMBH, scope includes Bugfender customer data (support, development, hosting, sysadmin, HR). Current issue 18 Apr 2025, expires 19 Apr 2028. Cert address Baiersbronn vs imprint Walldorf.

No public ISO certificate referenced on privacy/DPA pages reviewed.

No public SOC 2 report found. 2022 blog says they certified ISO 27001 instead of SOC 2.

No public SOC report found in materials reviewed.

German controller/processor. Security and DPA help pages claim GDPR processing with access, rectification, erasure, expiry, export, and breach notice. Confirm via signed DPA.

Dutch controller/processor materials; hosted data in EU per DPA; self-host keeps events local.

EU entity, no known US parent, default log region EU. US-group processors on the public list: Wasabi Inc., Statuspage.io/Atlassian, Intercom, Cloudflare, Stripe. Optional AWS (Private Instance any region; HIPAA SaaS us-west-1/us-east-1). Not legal advice.

No known US parent; hosted app data path is EU (Hetzner/Scaleway). Stripe (US) processes payments only. Self-host keeps error payloads local but phone-home goes to Bugsink. Not a zero-adjacency claim; not legal advice.

Model DPA download plus counter-sign workflow. Pricing table lists GDPR DPA on paid plans, not Free. Vendor article says SCC/Schrems II language is unnecessary because they are EU-based; privacy policy still names US recipients.

Public hosted DPA available; covers subprocessors, EU location, retention, audits at controller expense.

Logging and crash product. MCP is a read connector to existing tenant data, not an AI system they market as high-risk.

Error tracking product; not positioned as an AI system.

Vendor says self-service SaaS is not suitable. Dedicated HIPAA instance (BAA, AWS us-west-1 and us-east-1) or customer-hosted on-prem. Not independently verified here.

Privacy and cookie pages name Wasabi Inc., Statuspage/Atlassian, Intercom, Cloudflare, and Stripe. Default logs are claimed EU-resident, but US legal entities still sit on the path. On-prem or a tightly scoped private instance is the way to shrink that surface.

Security marketing says encryption at rest always. A 2018 help article says logs are not always encrypted at rest in the datacenter or on the device. Do not log secrets or health data until Beenario confirms the current control.

Help pages say EU ISO 27001 datacenters in multiple locations but do not publish the colocation or cloud brand for standard SaaS. That complicates supplier questionnaires.

Support can open an account when you contact them; operators can reach production databases for maintenance. The security page says support access is audit-logged and staff use 2FA. Still a residual insider-access fact for sensitive payloads.

Official FAQ: no server-side logs. Teams expecting one tool for API and mobile will still need a second stack.

Self-hosted installs periodically send usage/settings metadata and the install’s IP to Bugsink. Error events stay local, but zero-egress policies need an explicit review of phone-home behaviour.

Source is public and free for non-competing use, but the license restricts competing hosted offerings. Do not treat as MIT/Apache-style open source in procurement checklists.

Not a substitute for full APM/observability platforms if you need traces, infra metrics, and log platforms.

ISO/SOC materials not found publicly; hosted buyers may need NDA artifacts beyond the published DPA.

DPA states Stripe does not receive error/application data; still a US payment subprocessor for billing identity.