# Cloud Trust Center Study

**URL:** https://theauditrail.com/research/trust-centers/
**Published:** 2026-10-02
**Modified:** 2026-10-06
**Author:** The Audit Trail editorial desk

> 80% of 164 cloud companies run a trust center. Only 5 of 114 that show SOC 2 access let anyone download the report.

---

Research

# What 164 Cloud Companies Publish on Their Trust Centers

80% of 164 cloud companies run a trust center. Only 5 of the 114 that show SOC 2 access let anyone download the report. Platform, framework and gating data.

The Audit Trail editorial desk

Updated Oct 6, 2026 · First published Oct 2, 2026

[Some vendors pay us to be assessed or listed. Payment never changes a score, a rank or a verdict.](https://theauditrail.com/how-we-make-money/)

In brief

-   Most cloud companies run a trust center and keep the SOC 2 report behind a request.
-   5 of 114 trust centers let anyone download the SOC 2 report.
-   70% of documents on Vanta and Conveyor trust centers are gated.
-   SafeBase, which Drata owns, hosts 38% of the trust centers.
-   ISO 42001, the AI management standard, already shows on 31%.

80%

of 164 cloud companies run a dedicated trust center (131 of them)

5 of 114

trust centers that show SOC 2 access let anyone download the report

70%

of 941 documents at the 40 companies on Vanta or Conveyor need a request or NDA

38%

of trust centers run on SafeBase, which Drata owns

Data from 2 October 2026.

131 of the 164 cloud companies in the sample run a dedicated trust center, 80%. Almost none of them let a visitor download the SOC 2 report. Of the 114 trust centers that say how to get it, 5 offer a public download. The rest ask for a form, a login, an NDA click or an email.

The sample is the 2025 Forbes Cloud 100, which lists private companies, plus the 64 other companies in the BVP Nasdaq Emerging Cloud Index, which are public. The 2026 Cloud 100 was not out on 2 October 2026. [Vanta](https://theauditrail.com/vendors/vanta/) is on the Cloud 100 and is also a platform we score. Its trust center was counted like any other.

## Who runs a trust center

A trust center is a dedicated page where a company lists the frameworks it holds and shares its security documents. 131 companies have one. 25 more have only a marketing security page. 4 put everything behind a login, and 4 show no trust center at the usual addresses.

Private and public companies are level. 81% of the Cloud 100 run a trust center, and so do 78% of the public index.

## The SOC 2 report stays behind a request

A [SOC 2](https://theauditrail.com/frameworks/soc-2/) report is the document a [CPA firm](https://theauditrail.com/frameworks/soc-2/who-performs-a-soc-2-audit/) issues after the audit. 114 trust centers say how to get it. 89 use a request form, 7 need a login, 7 say to contact the company and 6 use an NDA click-through. 5 let anyone download it, which is 4% of the 114. The other 17 trust centers do not say how to get the report.

Other documents follow the same pattern. Pen test results are gated on 67 trust centers. 5 show a public summary, and 1, HubSpot, publishes the full report. Security questionnaires such as the CAIQ and SIG are gated on 59 and public on 6. Subprocessor lists are the most open document, public on 50 trust centers and gated on 29.

## 70% of documents need a request

Vanta and Conveyor tag every document on a trust center with an access level in the page data, so for those two platforms the count is exact. 40 companies run their trust center on Vanta or Conveyor. Between them they list 941 documents, and 660 of those need a request or an NDA, which is 70%. Vanta pages gate 437 of 620 documents. Conveyor pages gate 223 of 321.

The 70% covers those 40 companies only. SafeBase pages carry no clean per-document flag, so SafeBase trust centers are left out of this figure.

## SafeBase hosts the most trust centers

SafeBase runs 50 of the 131 trust centers, 38%. [Drata](https://theauditrail.com/vendors/drata/) owns SafeBase. Vanta hosts 26 (20%), and another 26 are self-built. Conveyor hosts 14 (11%). Whistic, TrustCloud and the other platforms host under 2% each, and [Secureframe](https://theauditrail.com/vendors/secureframe/) hosts 1. For 7 trust centers, the platform is not identifiable.

Six of the compliance platforms we score sell a trust center of their own, and it counts toward the Trust and questionnaires criterion in our [rubric](https://theauditrail.com/rubric/). Their [AWS Marketplace listings](https://theauditrail.com/research/compliance-software-pricing-2026/) put Vanta’s trust center in its Plus tier and above, from $21,500 a year. Drata lists its trust center as an optional module.

## SOC 2 and ISO 27001 travel together

82% of trust centers name both SOC 2 and [ISO 27001](https://theauditrail.com/frameworks/iso-27001/). 11% name SOC 2 only, and 4% name ISO 27001 only.

The median trust center names 7 frameworks. [HIPAA](https://theauditrail.com/frameworks/hipaa/) appears on 44% and [PCI DSS](https://theauditrail.com/frameworks/pci-dss/) on 43%. CSA STAR and ISO 27701 each show on 34%, and SOC 3 on 31%. Some level of FedRAMP appears on 27%, TISAX on 19% and C5 on 15%.

## ISO 42001 already shows on 31%

ISO 42001, the management system standard for AI, is named on 40 of the 131 trust centers. Private companies lead: 35% of Cloud 100 trust centers name it, against 24% in the public index. 56% of trust centers have a section on AI.

## How the counts work

The sample comes from Forbes’ own list data and the BVP index page as of 2 October 2026. A company’s trust center is the page at a trust subdomain, /trust or /security, or the top result of one search when none of those answer. The platform comes from the calls the page makes to its host, and from a “Powered by” line when the calls do not show it.

Counts reflect what each trust center shows a visitor without a login, form or NDA.

## Limits

-   Counts are as of 2 October 2026. Trust centers change.
-   Framework counts are as each trust center states them.
-   “None found” means no page at the usual addresses and none in one search. It does not prove a company has no trust center.
-   Document gating is exact for Vanta and Conveyor only. SOC 2 access on SafeBase trust centers comes from the visible page.
-   Three AI labs from the Cloud 100 count in every figure on this page and are left out of the table and the CSV.

## What it means for a buyer

Plan to request the SOC 2 report. 109 of the 114 trust centers that show access put it behind a form, a login, an NDA click or an email. The frameworks on a trust center are the company’s own list. The report shows what the auditor tested.

Expect to request pen test results and security questionnaires as well. Subprocessor lists are the document you are most likely to find in the open.

Vanta, Drata and Secureframe host trust centers for other companies. We also score all three as compliance platforms in the [SOC 2 software ranking](https://theauditrail.com/best/soc-2-compliance-software/) and the [compliance management ranking](https://theauditrail.com/best/compliance-management-software/).

## What it means for a company building one

A request form for the SOC 2 report is the common choice, used by 89 of the 114. A public download would put you with 5 companies in this sample.

82% of trust centers list SOC 2 and ISO 27001 side by side. If your buyers ask about AI, 56% of trust centers already carry an AI section and 31% name ISO 42001.

Self-built pages are as common as Vanta pages, 26 each. SafeBase hosts close to 2 in 5.

## The data

The charts and table below come from the same check. The CSV adds columns for subprocessor lists, pen test results, questionnaires, the AI section and the Vanta and Conveyor document counts.

How the SOC 2 report is offered, 114 trust centers that show it

-   Request form 89
-   Login 7
-   Contact us 7
-   NDA click-through 6
-   Public download 5

The other 17 trust centers do not say how to get the report.

Who hosts the 131 trust centers

-   [SafeBase (owned by Drata)](https://theauditrail.com/vendors/drata/) 38% (50)
-   Self-built 20% (26)
-   [Vanta](https://theauditrail.com/vendors/vanta/) 20% (26)
-   Conveyor 11% (14)
-   Not identified 5% (7)
-   Wolfia 2% (2)
-   TrustCloud 2% (2)
-   Whistic 2% (2)
-   Akitra 1% (1)
-   [Secureframe](https://theauditrail.com/vendors/secureframe/) 1% (1)

Frameworks named on the 131 trust centers

-   [SOC 2 (any type)](https://theauditrail.com/frameworks/soc-2/) 93% (122)
-   [ISO 27001](https://theauditrail.com/frameworks/iso-27001/) 85% (112)
-   [HIPAA](https://theauditrail.com/frameworks/hipaa/) 44% (57)
-   [PCI DSS](https://theauditrail.com/frameworks/pci-dss/) 43% (56)
-   CSA STAR 34% (45)
-   ISO 27701 34% (44)
-   ISO 42001 31% (40)
-   SOC 3 31% (40)
-   FedRAMP (any level) 27% (36)
-   TISAX 19% (25)
-   C5 15% (20)
-   HITRUST 8% (10)

Framework counts are as each trust center states them.

Show the table: 161 rows, checked Oct 2, 2026

Company

List

Result

Platform

SOC 2 report

Frameworks named

[1Password](https://trust.1password.io/)

Cloud 100

Trust center

SafeBase

CSA STAR, GDPR, ISO 27001, ISO 27017, ISO 27018, ISO 27701, PCI DSS, SOC 2 Type 2, TISAX

[Abnormal AI](https://abnormal.ai/trust-center)

Cloud 100

Security page only

Self-built

ISO 27001, ISO 27701, ISO 42001, SOC 2 Type 2, CSA STAR, FedRAMP Moderate, GovRAMP, CMMC, GDPR, CCPA

[Abridge](https://trust.abridge.com/)

Cloud 100

Trust center

SafeBase

Request form

SOC 2 Type 1, SOC 2 Type 2, HIPAA, CCPA

[Adobe](https://www.adobe.com/trust.html)

BVP index

Trust center

Self-built

Contact us

SOC 1, SOC 2 Type 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, ISO 9001, PCI DSS, CSA STAR, FedRAMP Moderate, TISAX, C5, IRAP, CMMC, NIST 800-171, GDPR

Agilysys

BVP index

None found

[Airtable](https://www.airtable.com/company/trust-and-security)

Cloud 100

Security page only

Self-built

Contact us

SOC 2 Type 2, HIPAA, GDPR, CCPA

[Airwallex](https://security.airwallex.com/)

Cloud 100

Trust center

SafeBase

Request form

SOC 1, SOC 2 Type 1, SOC 2 Type 2, ISO 27001, PCI DSS, GDPR, DORA

[Algolia](https://trust.algolia.com/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, ISO 27001, ISO 27017, GDPR, CCPA, C5, SOC 3

[Alkami](https://community.alkami.com/compliance-hub-101)

BVP index

Login only

Not identified

Login

SOC 2 (type not stated)

[AlphaSense](https://trust.alpha-sense.com/)

Cloud 100

Trust center

SafeBase

Request form

ISO 27001, SOC 2 Type 2

[Anysphere](https://trust.cursor.com/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, ISO 27001, ISO 42001, HIPAA

[AppFolio](https://www.appfolio.com/trust)

BVP index

Security page only

Self-built

Not listed

[AppsFlyer](https://www.appsflyer.com/trust)

Cloud 100

Trust center

Self-built

Not listed

ISO 27001, ISO 27017, ISO 27018, ISO 27701, CSA STAR

[Arctic Wolf](https://trust.arcticwolf.com/)

Cloud 100

Trust center

Conveyor

Request form

SOC 2 Type 2, SOC 2 Type 1, ISO 27001

[Asana](https://trustcenter.asana.com/)

BVP index

Trust center

Conveyor

Request form

SOC 2 Type 2, SOC 2 Type 1, SOC 3, ISO 27001, ISO 27017, ISO 27018, ISO 27701, HIPAA, GDPR, CCPA, CSA STAR, DORA

[Atlassian](https://customertrust.atlassian.com/)

BVP index

Trust center

Conveyor

Request form

C5, FedRAMP (level not stated), GDPR, GovRAMP, HIPAA, ISO 27001, ISO 27018, SOC 1, SOC 1 Type 2, SOC 2 Type 2, TISAX

[Attentive](https://security.attentive.com/)

Cloud 100

Trust center

SafeBase

Request form

SOC 2 Type 2, GDPR, CCPA

[Automation Anywhere](https://www.automationanywhere.com/trust-center)

Cloud 100

Trust center

Self-built

Login

ISO 27001, HIPAA, HITRUST, ISO 9001, ISO 42001, Cyber Essentials

[Automattic](https://automattic.com/security/)

Cloud 100

Security page only

[AvePoint](https://www.avepoint.com/company/trust-center)

BVP index

Security page only

Self-built

Contact us

TISAX, ISO 27001, ISO 27701, ISO 27017, IRAP, FedRAMP Moderate, SOC 2 Type 2, CSA STAR, Cyber Essentials, CMMC, GDPR

[Axonius](https://trust.axonius.com/)

Cloud 100

Trust center

SafeBase

Not listed

C5, CSA STAR, FedRAMP Moderate, HIPAA, IRAP, ISO 27001

[Benchling](https://securitytrust.benchling.com/)

Cloud 100

Trust center

SafeBase

Request form

CCPA, GDPR, ISO 27001, ISO 27017, ISO 27018, ISO 9001, NIS2, SOC 2 Type 2

[Bill.com](https://www.bill.com/security)

BVP index

Security page only

Self-built

Not listed

PCI DSS, SOC 1, SOC 2 (type not stated)

[BlackLine](https://trustcenter.blackline.com/)

BVP index

Trust center

Not identified

Request form

SOC 1, SOC 2 Type 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, ISO 9001, PCI DSS, EU AI Act

[Braze](https://www.braze.com/docs/developer_guide/disclosures/security_qualifications)

BVP index

Trust center

Self-built

Not listed

ISO 27001, SOC 2 Type 2, TISAX, HIPAA

[Brex](https://www.brex.com/trust)

Cloud 100

Security page only

Self-built

Not listed

SOC 1 Type 2, SOC 2 Type 2, PCI DSS

[Brightwheel](https://mybrightwheel.com/security/)

Cloud 100

Security page only

Self-built

Not listed

PCI DSS

[BrowserStack](https://www.browserstack.com/trust)

Cloud 100

Trust center

Self-built

Public download

ISO 42001, ISO 27701, ISO 27001, GDPR, CCPA, SOC 2 Type 2

[Calendly](https://public-profile.whistic.com/761120cf-454b-4c02-9483-f079882608a0)

Cloud 100

Trust center

Whistic

Contact us

SOC 2 Type 2, SOC 3, ISO 27001, CSA STAR, PCI DSS

[Canva](https://trust.canva.com/)

Cloud 100

Trust center

SafeBase

Request form

SOC 2 Type 2, SOC 3, PCI DSS, ISO 27001, GDPR, CCPA

[Carta](https://trust.carta.com/)

Cloud 100

Trust center

Conveyor

Request form

ISO 27001, SOC 2 Type 2, SOC 1, GDPR, CCPA

[Cato Networks](https://security.catonetworks.com/)

Cloud 100

Trust center

Conveyor

Request form

SOC 2 Type 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, ISO 27701, HIPAA, TISAX, PCI DSS, CSA STAR, Cyber Essentials, NIST 800-53, C5

[Cellebrite](https://cellebrite.com/en/about/trust/compliance/)

BVP index

Trust center

Self-built

Contact us

ISO 27001, ISO 27017, SOC 2 Type 2, SOC 3, FedRAMP High

[Celonis](https://trust.celonis.com/)

Cloud 100

Trust center

SafeBase

Request form

SOC 1, SOC 2 Type 2, ISO 27001, ISO 9001, ISO 27701, HIPAA, GDPR, CSA STAR, TISAX, Cyber Essentials

[Chainguard](https://security.chainguard.dev/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, ISO 27001, Cyber Essentials, GDPR, CCPA

[Checkout.com](https://trust.checkout.com/)

Cloud 100

Trust center

Vanta

Request form

SOC 1, SOC 2 Type 2, PCI DSS, ISO 27001, GDPR, CCPA, Cyber Essentials

[Checkr](https://security.checkr.com/)

Cloud 100

Trust center

Not identified

Request form

CCPA, ISO 27001, SOC 2 Type 2, GDPR, SOC 3, ISO 42001

[Claroty](https://claroty.com/trust)

Cloud 100

Trust center

Self-built

Contact us

C5, CSA STAR, GDPR, HIPAA, ISO 27001, ISO 27701, SOC 2 Type 2, TISAX

[Clay](https://trust.clay.com/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, GDPR, CCPA, ISO 27001, ISO 42001

[ClickHouse](https://trust.clickhouse.com/)

Cloud 100

Trust center

SafeBase

Request form

CCPA, GDPR, HIPAA, ISO 27001, ISO 27701, PCI DSS, SOC 2 Type 2

[ClickUp](https://security.clickup.com/)

Cloud 100

Trust center

SafeBase

Request form

SOC 2 Type 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, PCI DSS, GDPR, CCPA

[Clio](https://trust.clio.com/)

Cloud 100

Trust center

SafeBase

Request form

GDPR, HIPAA, SOC 1, SOC 1 Type 2, SOC 2 Type 2

[Cloudflare](https://trust.cloudflare.com/)

BVP index

Login only

Self-built

Login

[Cohesity](https://www.cohesity.com/trust/)

Cloud 100

Trust center

Self-built

SOC 2 Type 2, ISO 27001, HIPAA, FedRAMP Moderate, GovRAMP, GDPR, CCPA

[Collibra](https://www.collibra.com/company/trust-center)

Cloud 100

Trust center

Self-built

Not listed

CCPA, FedRAMP Moderate, GDPR, HIPAA, ISO 27001, ISO 27017, ISO 27018, ISO 42001, ISO 9001, ITAR, SOC 1, SOC 2 (type not stated), TISAX

[Cribl](https://trust.cribl.io/)

Cloud 100

Trust center

TrustCloud

ISO 27001, SOC 3, SOC 2 Type 2

[Crowdstrike](https://trust.crowdstrike.com/)

BVP index

Trust center

SafeBase

Request form

C5, CSA STAR, Cyber Essentials, DORA, FedRAMP High, GDPR, GovRAMP, ISO 27001, ISO 27017, ISO 42001, PCI DSS, SOC 2 Type 1, SOC 2 Type 2, TISAX

[Cyera](https://security.cyera.io/)

Cloud 100

Trust center

SafeBase

NDA click-through

CCPA, GDPR, ISO 27001, SOC 2 (type not stated), C5, PCI DSS, HIPAA

[Databricks](https://www.databricks.com/trust)

Cloud 100

Security page only

Self-built

Contact us

SOC 2 Type 2

[Datadog](https://trust.datadoghq.com/)

BVP index

Trust center

SafeBase

Request form

CCPA, CSA STAR, Cyber Essentials, EU AI Act, FedRAMP High, GDPR, GovRAMP, HIPAA, IRAP, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, PCI DSS, SOC 2 Type 2, TISAX

[Dataiku](https://www.dataiku.com/legal/trust)

Cloud 100

Trust center

Self-built

Contact us

ISO 27001, ISO 27701, ISO 9001, ISO 42001, SOC 1, SOC 2 Type 2, HIPAA, GDPR, CCPA

[Dbt Labs](https://trust.getdbt.com/)

Cloud 100

Trust center

Conveyor

Request form

SOC 2 Type 2, GDPR, CCPA, ISO 27701, ISO 27001, ISO 27017, ISO 27018, ISO 42001, HIPAA

[Deel](https://trust.deel.com/)

Cloud 100

Trust center

Not identified

Request form

GDPR, ISO 27001, CCPA, ISO 27701, SOC 1, SOC 2 Type 2, CSA STAR, EU AI Act, ISO 42001

[DeepL](https://trust.deepl.com/)

Cloud 100

Trust center

SafeBase

Request form

C5, GDPR, HIPAA, ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2 Type 2, SOC 3

[Dialpad](https://trust.dialpad.com/)

Cloud 100

Trust center

SafeBase

Request form

CCPA, CSA STAR, GDPR, HIPAA, ISO 27001, ISO 27017, ISO 27018, PCI DSS, SOC 2 (type not stated)

[DigitalOcean](https://www.digitalocean.com/trust)

BVP index

Trust center

Self-built

Login

SOC 2 (type not stated), SOC 3, HIPAA, DORA

[DocuSign](https://www.docusign.com/trust)

BVP index

Trust center

Self-built

Not listed

[Dynatrace](https://trust.dynatrace.com/)

BVP index

Trust center

Conveyor

Public download

SOC 2 Type 2, SOC 1, ISO 27001, ISO 27017, ISO 42001, HIPAA, TISAX, GDPR, CCPA, FedRAMP Moderate, CSA STAR, IRAP, PCI DSS

[Elastic](https://assurance.elastic.co)

BVP index

Trust center

Vanta

Request form

FedRAMP High, FedRAMP Moderate, PCI DSS, CSA STAR, ISO 27001, ISO 27017, ISO 27018, ISO 27701, SOC 2 Type 2, SOC 3, TISAX, HIPAA, Cyber Essentials, IRAP

[ElevenLabs](https://compliance.elevenlabs.io/)

Cloud 100

Trust center

Vanta

Request form

CCPA, CSA STAR, Cyber Essentials, DORA, EU AI Act, FedRAMP (level not stated), GDPR, HIPAA, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, PCI DSS, SOC 2 Type 2, SOC 3

[EvenUp](https://trust.evenuplaw.com/)

Cloud 100

Trust center

Secureframe

Request form

SOC 2 Type 2, HIPAA, CCPA

[Fal AI](https://trust.fal.ai/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2

[Fastly](https://www.fastly.com/trust)

BVP index

Security page only

Self-built

Not listed

CCPA

[Figma](https://compliance.figma.com/)

BVP index

Trust center

Conveyor

Request form

C5, CCPA, CSA STAR, FedRAMP Moderate, GDPR, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, PCI DSS, SOC 2 Type 2, SOC 3, TISAX

[Fireworks AI](https://trust.fireworks.ai/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, HIPAA, GDPR, ISO 27001, ISO 27701, ISO 42001

[Five9](https://trustcenter.five9.com/)

BVP index

Trust center

SafeBase

Request form

C5, CCPA, CSA STAR, Cyber Essentials, DORA, GDPR, HIPAA, ISO 27001, ISO 27017, PCI DSS, SOC 2 Type 2

[Fivetran](https://trust.fivetran.com/)

Cloud 100

Trust center

SafeBase

Request form

CCPA, Cyber Essentials, GDPR, HITRUST, ISO 27001, ISO 27701, PCI DSS, SOC 1, SOC 2 (type not stated)

[Flock Safety](https://security.flocksafety.com/)

Cloud 100

Trust center

SafeBase

Request form

ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, SOC 2 Type 2

[Forter](https://www.forter.com/trust/)

Cloud 100

Security page only

Self-built

Not listed

[Freshworks](https://trust.freshworks.com/)

BVP index

Trust center

SafeBase

Request form

CCPA, CSA STAR, Cyber Essentials, ISO 27001, ISO 27701, SOC 1, SOC 1 Type 2, SOC 2 Type 2, SOC 3

[Gitlab](https://trust.gitlab.com/)

BVP index

Trust center

SafeBase

Request form

CCPA, CSA STAR, GDPR, ISO 27001, ISO 27017, ISO 27018, ISO 42001, PCI DSS, SOC 2 (type not stated), TISAX

[Glean](https://trust.glean.com/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, ISO 27001, ISO 42001, HIPAA, GDPR

GlossGenius

Cloud 100

None found

[Gong](https://trust.gong.io/)

Cloud 100

Trust center

SafeBase

Request form

CSA STAR, HIPAA, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, PCI DSS, SOC 2 Type 2

[Grafana Labs](https://trust.grafana.com/)

Cloud 100

Trust center

SafeBase

ISO 27001, PCI DSS, GDPR, TISAX, CSA STAR, FedRAMP High

[Grammarly](https://www.grammarly.com/trust)

Cloud 100

Trust center

Self-built

SOC 2 (type not stated)

[Guild](https://trust.guild.com/)

Cloud 100

Login only

Vanta

[Gusto](https://trust.gusto.com/)

Cloud 100

Trust center

Self-built

NDA click-through

SOC 1, SOC 2 (type not stated), HIPAA

[Harness](https://trust.harness.io/)

Cloud 100

Trust center

SafeBase

Request form

CCPA, CSA STAR, DORA, GDPR, ISO 27001, ISO 27017, ISO 27018, SOC 2 Type 2

[Harvey](https://trust.harvey.ai/)

Cloud 100

Trust center

SafeBase

Request form

CCPA, EU AI Act, GDPR, HIPAA, IRAP, ISO 27001, ISO 27701, ISO 42001, SOC 2 Type 2

[HiBob](https://www.hibob.com/privacy/security/)

Cloud 100

Trust center

Self-built

NDA click-through

ISO 27001, ISO 27018, PCI DSS, SOC 2 Type 2, GDPR

[HubSpot](https://trust.hubspot.com/)

BVP index

Trust center

Conveyor

Request form

SOC 1, SOC 2 Type 2, SOC 3, HIPAA, GDPR, CCPA

[Hugging Face](https://huggingface.co/docs/hub/security)

Cloud 100

Security page only

Self-built

Not listed

SOC 2 Type 2, GDPR

[Intapp](https://www.intapp.com/trust/)

BVP index

Security page only

Self-built

Not listed

ISO 27701, DORA

[Intercom](https://trust.intercom.com/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, ISO 27001, ISO 27018, ISO 27701, ISO 42001, GDPR, CCPA, HIPAA, CSA STAR, EU AI Act

[Island](https://trust.island.io/)

Cloud 100

Trust center

Self-built

Cyber Essentials, FedRAMP High, GDPR, HIPAA, ISO 27001, PCI DSS, SOC 1, SOC 2 (type not stated)

[JFrog](https://jfrog.com/trust/)

BVP index

Trust center

Self-built

Not listed

SOC 2 Type 2, SOC 3, IRAP, ISO 27001, ISO 27701, ISO 27017

[Klaviyo](https://trust.klaviyo.com/)

BVP index

Trust center

Conveyor

Request form

SOC 2 Type 2, ISO 27001, ISO 27017, PCI DSS, GDPR, CCPA

[Komodo Health](https://trust.komodohealth.com/)

Cloud 100

Trust center

Conveyor

Request form

SOC 2 Type 2, SOC 2 Type 1, GDPR, CCPA

[Lambda](https://trust.lambda.ai/)

Cloud 100

Trust center

SafeBase

Request form

CCPA, ISO 27001, ISO 27017, ISO 27701, SOC 2 Type 2

[LaunchDarkly](https://trust.launchdarkly.com/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, ISO 27001, ISO 27701, FedRAMP Moderate, GDPR, CCPA, HIPAA

[MaintainX](https://trust.getmaintainx.com/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, ISO 27001

[Mercor](https://trust.mercor.com/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2

Midjourney

Cloud 100

None found

[Miro](https://trust.miro.com/)

Cloud 100

Trust center

Wolfia

Request form

ISO 42001, ISO 27001, SOC 2 Type 2, SOC 3, IRAP, GDPR, Cyber Essentials

[Monday.com](https://trust.monday.com/)

BVP index

Trust center

SafeBase

Request form

CCPA, CSA STAR, GDPR, HIPAA, ISO 27001, ISO 27017, ISO 27018, ISO 27701, SOC 1, SOC 1 Type 2, SOC 2 Type 2, SOC 3

[MongoDB](https://trust.mongodb.com/)

BVP index

Trust center

Conveyor

Request form

SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018, ISO 9001, HIPAA, HITRUST, PCI DSS, CSA STAR, GDPR, FedRAMP (level not stated), TISAX, IRAP

[Motive](https://trust.gomotive.com/)

Cloud 100

Trust center

SafeBase

Request form

CCPA, ISO 27001, ISO 27701, PCI DSS, SOC 1, SOC 1 Type 2, SOC 2 Type 2

[Navan](https://trust.navan.com/)

Cloud 100

Trust center

SafeBase

Request form

ISO 27001, SOC 1, SOC 2 Type 2, PCI DSS, CSA STAR, GDPR

[nCino](https://trustcenter.ncino.com/)

BVP index

Trust center

SafeBase

Request form

CSA STAR, DORA, ISO 27001, ISO 42001, PCI DSS, SOC 1, SOC 1 Type 2, SOC 2 Type 2, SOC 3

[Netskope](https://www.netskope.com/company/security-compliance-and-assurance)

Cloud 100

Security page only

[NinjaOne](https://trustpage.ninjaone.com/)

Cloud 100

Trust center

Self-built

Request form

CCPA, CMMC, DORA, FedRAMP High, FedRAMP Moderate, GDPR, GovRAMP, HIPAA, ISO 27001, ISO 42001, NIS2, PCI DSS, SOC 2 Type 2, SOC 3

[Notion](https://trust.notion.com/)

Cloud 100

Trust center

Wolfia

Request form

SOC 2 Type 2, SOC 2 Type 1, SOC 3, ISO 27001, ISO 27017, ISO 27018, ISO 27701, HIPAA, C5, EU AI Act

[Nutanix](https://www.nutanix.com/trust/compliance-and-certifications)

BVP index

Trust center

Self-built

Contact us

CSA STAR, ISO 27001, ISO 27701, SOC 2 Type 2, SOC 3

[Odoo](https://www.odoo.com/security)

Cloud 100

Security page only

Self-built

Not listed

CSA STAR

[Okta](https://security.okta.com/)

BVP index

Trust center

SafeBase

C5, CSA STAR, DORA, FedRAMP High, FedRAMP Moderate, GDPR, HIPAA, IRAP, ISO 27001, ISO 27017, ISO 27018, NIST 800-53, PCI DSS, SOC 1, SOC 2 (type not stated), SOC 3, GovRAMP, TISAX

[OneTrust](https://www.onetrust.com/trust/)

Cloud 100

Trust center

Self-built

Public download

ISO 27001, ISO 27701, ISO 27017, ISO 9001, SOC 2 Type 2, PCI DSS, HITRUST, TISAX, CSA STAR, GDPR, CCPA

[PagerDuty](https://www.pagerduty.com/security/)

BVP index

Trust center

Self-built

Request form

FedRAMP Low, SOC 2 Type 2, ISO 27001, CCPA

[Palantir](https://palantir.safebase.us)

BVP index

Trust center

SafeBase

Request form

SOC 1, SOC 2 Type 1, SOC 2 Type 2, SOC 3, ISO 9001, ISO 27001, ISO 27017, ISO 27018, GDPR, CCPA, HIPAA, CSA STAR, Cyber Essentials, FedRAMP High, IRAP, TISAX, CMMC

[Palo Alto Networks](https://trust.paloaltonetworks.com/)

BVP index

Trust center

Conveyor

Request form

SOC 2 Type 2, C5, IRAP, GDPR, HIPAA, CCPA, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, FedRAMP High, FedRAMP Moderate, GovRAMP, TISAX, PCI DSS, CSA STAR, Cyber Essentials

[Papaya Global](https://www.papayaglobal.com/security-and-privacy/)

Cloud 100

Security page only

Self-built

Not listed

SOC 1, SOC 2 (type not stated), ISO 27001, ISO 27701, GDPR

[Paycom](https://www.paycom.com/about/security/)

BVP index

Security page only

Self-built

Not listed

ISO 27001, ISO 27701, ISO 42001, ISO 9001, SOC 1, SOC 2 (type not stated), SOC 3

[Paylocity](https://trust.paylocity.com/)

BVP index

Trust center

Vanta

Request form

ISO 27001, SOC 1, SOC 2 Type 2

[Pendo](https://trust.pendo.io/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, SOC 3, PCI DSS, HIPAA, GDPR, CCPA

[Personio](https://trust.personio.com/)

Cloud 100

Trust center

SafeBase

Not listed

GDPR, ISO 27001, ISO 27017

[Plaid](https://security.plaid.com/)

Cloud 100

Trust center

Not identified

Request form

SOC 2 Type 2, ISO 27001, ISO 27701

[Postman](https://security.postman.com/)

Cloud 100

Trust center

SafeBase

Request form

SOC 2 Type 2, SOC 3, ISO 27001, ISO 27017, ISO 42001, HIPAA, PCI DSS, CSA STAR, GDPR, CCPA

[Procore](https://trust.procore.com/)

BVP index

Trust center

SafeBase

NDA click-through

SOC 1, SOC 2 Type 2, ISO 27001, FedRAMP Moderate

[Q2](https://www.q2.com/products/relationship-pricing-and-profitability/trust)

BVP index

Security page only

Self-built

Not listed

SOC 2 Type 2, NIST CSF

[Qualys](https://www.qualys.com/compliance/)

BVP index

Trust center

Self-built

Login

CSA STAR, PCI DSS

[Ramp](https://trust.ramp.com/)

Cloud 100

Trust center

SafeBase

NDA click-through

SOC 2 Type 2, SOC 1, PCI DSS, ISO 27001, CCPA, FedRAMP Moderate, GovRAMP, Cyber Essentials

[Ringcentral](https://trust.ringcentral.com/)

BVP index

Trust center

SafeBase

Login

C5, CCPA, Cyber Essentials, GDPR, HIPAA, HITRUST, ISO 27001, ISO 27017, ISO 27018, PCI DSS, SOC 2 Type 1, SOC 2 Type 2, SOC 3

[Rippling](https://trust.rippling.com/)

Cloud 100

Trust center

Self-built

Public download

SOC 1, SOC 2 (type not stated), SOC 3, ISO 27001, ISO 27018, ISO 42001, CSA STAR

[Rubrik](https://trust.rubrik.com/)

BVP index

Trust center

Whistic

Login

SOC 1, SOC 2 (type not stated), ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, HITRUST, HIPAA, C5, CSA STAR, TISAX, IRAP, FedRAMP (level not stated), GovRAMP, CMMC

[Runway](https://trust.runwayml.com/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, ISO 27001

[SailPoint](https://trust.sailpoint.com/)

BVP index

Trust center

SafeBase

Request form

CSA STAR, C5, FedRAMP Moderate, GovRAMP, IRAP, ISO 27001, ISO 27017, ISO 27018, ISO 27701, SOC 1, SOC 2 Type 2, SOC 3

[Salesforce](https://compliance.salesforce.com/)

BVP index

Trust center

Self-built

Login

[Samsara](https://security.samsara.com/)

BVP index

Trust center

Vanta

Request form

ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, SOC 2 Type 2

[SentinelOne](https://trust.sentinelone.com/)

BVP index

Trust center

SafeBase

Request form

CCPA, Cyber Essentials, FedRAMP High, GDPR, ISO 27001, ISO 27017, ISO 27018, SOC 2 Type 2

[ServiceNow](https://trust.servicenow.com/)

BVP index

Trust center

TrustCloud

Request form

SOC 2 Type 2, ISO 27001, FedRAMP High

[ServiceTitan](https://security.servicetitan.com/)

BVP index

Trust center

SafeBase

Request form

ISO 27001, ISO 27018, ISO 27701, PCI DSS, SOC 1, SOC 2 (type not stated)

[Shopify](https://www.shopify.com/security)

BVP index

Security page only

Self-built

PCI DSS, SOC 2 Type 2, SOC 3, GDPR, CCPA

[Sierra](https://trust.sierra.ai/)

Cloud 100

Trust center

Vanta

Request form

ISO 27001, ISO 42001, SOC 2 Type 2, HIPAA, PCI DSS, GDPR, CCPA, CSA STAR, EU AI Act, FedRAMP High

[Snowflake](https://trust.snowflake.com/)

BVP index

Trust center

Vanta

Request form

Cyber Essentials, FedRAMP High, FedRAMP Moderate, HIPAA, HITRUST, IRAP, ISO 27001, ISO 27017, ISO 27018, ISO 42001, ISO 9001, PCI DSS, SOC 1, SOC 2 Type 2, TISAX

[Snyk](https://trust.snyk.io/)

Cloud 100

Trust center

Vanta

Request form

ISO 27001, ISO 27017, SOC 2 Type 2, PCI DSS

[Sprinklr](https://trust.sprinklr.com/)

BVP index

Trust center

SafeBase

Login

ISO 27001, FedRAMP (level not stated), SOC 1, SOC 2 (type not stated), SOC 3, C5, PCI DSS, TISAX, HIPAA, CSA STAR, EU AI Act, GDPR, DORA, CCPA, Cyber Essentials

[SPS Commerce](https://trust.spscommerce.com/)

BVP index

Trust center

SafeBase

Public download

ISO 27001, ISO 27017, ISO 27018, PCI DSS, SOC 1, SOC 1 Type 2, SOC 2 Type 2, SOC 3

[Stripe](https://docs.stripe.com/security)

Cloud 100

Security page only

Self-built

Contact us

PCI DSS, SOC 1, SOC 2 Type 2, SOC 3, NIST CSF

[Synthesia](https://security.synthesia.io/)

Cloud 100

Trust center

Vanta

Request form

ISO 42001, ISO 27001, ISO 27701, SOC 2 Type 2, GDPR, Cyber Essentials

[Talkdesk](https://www.talkdesk.com/about/trust/)

Cloud 100

Security page only

Self-built

Not listed

SOC 2 (type not stated), SOC 3, FedRAMP (level not stated), PCI DSS, ISO 27017, ISO 27018, ISO 27001, ISO 27701, GDPR, HIPAA, CSA STAR, Cyber Essentials

[Tanium](https://www.tanium.com/about/security)

Cloud 100

Security page only

Self-built

Not listed

ISO 27001, ISO 27018, FedRAMP (level not stated), GDPR, CCPA

[Tenable](https://compliance.tenable.com/)

BVP index

Trust center

Not identified

NDA click-through

GDPR, CSA STAR, FedRAMP (level not stated), SOC 2 Type 2, ISO 27001, PCI DSS, GovRAMP

[Toast](https://trustcenter.toasttab.com/)

BVP index

Trust center

Not identified

Request form

PCI DSS, SOC 2 Type 2, SOC 1

[Together AI](https://trust.together.ai/)

Cloud 100

Trust center

Vanta

Request form

SOC 2 Type 2, ISO 27001

[Twilio](https://security.twilio.com/)

BVP index

Trust center

SafeBase

Request form

CCPA, GDPR, HIPAA, ISO 27001, ISO 27017, ISO 27018, PCI DSS, SOC 2 (type not stated)

[UiPath](https://trust.uipath.com/)

BVP index

Trust center

SafeBase

Request form

SOC 1, SOC 2 Type 2, ISO 42001, ISO 27001, ISO 27017, ISO 27018, ISO 9001, HITRUST, HIPAA, C5, Cyber Essentials, IRAP

[Vanta](https://trust.vanta.com/)

Cloud 100

Trust center

Vanta

Request form

CCPA, FedRAMP (level not stated), FedRAMP Low, GDPR, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, PCI DSS, SOC 2 Type 2

VAST Data

Cloud 100

None found

[Veeva Systems](https://www.veeva.com/trust/)

BVP index

Security page only

Self-built

Not listed

ISO 27001, ISO 27017, ISO 27018, ISO 9001, SOC 2 Type 2

[Vercel](https://security.vercel.com/)

Cloud 100

Trust center

SafeBase

Request form

SOC 2 Type 2, SOC 3, ISO 27001, PCI DSS, HIPAA, GDPR, CCPA, NIS2, DORA, TISAX

[Waystar](https://trust.waystar.com/)

BVP index

Login only

Conveyor

NDA click-through

[Weave](https://trust.getweave.com/)

BVP index

Trust center

Akitra

Not listed

[Webflow](https://trust.webflow.com/)

Cloud 100

Trust center

SafeBase

Request form

CCPA, DORA, GDPR, ISO 27001, ISO 27017, ISO 27018, ISO 42001, PCI DSS, SOC 1, SOC 1 Type 2, SOC 2 Type 2

[Wix](https://www.wix.com/trust-center/security)

BVP index

Trust center

Self-built

Not listed

SOC 2 Type 2, PCI DSS, ISO 27001, ISO 27017, ISO 27018, ISO 27701, GDPR, CCPA

[Workato](https://trust.workato.com/)

Cloud 100

Trust center

Not identified

SOC 1, SOC 2 (type not stated), SOC 3, HIPAA, PCI DSS, IRAP, DORA, GDPR, NIS2, CCPA, ISO 27701, ISO 27001, ISO 42001

[Workday](https://security.workday.com/)

BVP index

Security page only

Self-built

Not listed

[Workiva](https://www.workiva.com/security)

BVP index

Trust center

Self-built

Contact us

CCPA, CMMC, CSA STAR, FedRAMP Moderate, GDPR, HIPAA, ISO 27001, SOC 1, SOC 1 Type 2, SOC 2 Type 2

[Zapier](https://trust.zapier.com/)

Cloud 100

Trust center

Conveyor

Request form

SOC 2 Type 2, SOC 3, GDPR, CCPA

[Zeta](https://trust.zetaglobal.com/)

BVP index

Trust center

SafeBase

Request form

SOC 2 Type 2, HITRUST

[Zoho](https://www.zoho.com/security.html)

Cloud 100

Security page only

Self-built

Not listed

[Zscaler](https://compliance.zscaler.com/)

BVP index

Trust center

SafeBase

Request form

SOC 2 Type 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, ISO 27701, CSA STAR, HIPAA, C5, Cyber Essentials, HITRUST, GDPR, TISAX, PCI DSS, NIST 800-53, IRAP

[Download the data (CSV)](https://theauditrail.com/research/trust-centers.csv)