Every enterprise deal now passes through the same gate: a security reviewer opens your trust page. In a few minutes they decide whether to send you a 300-question spreadsheet or approve you.
Most advice about trust centers is opinion. We wanted data. In October 2026 we reviewed the public trust, security and compliance pages of 111 venture-backed software companies. The sample covers AI labs, developer tools, data infrastructure, fintech, HR, healthtech, security and go-to-market software. For each one we recorded:
- which frameworks it claims
- whether the SOC 2 report is gated
- whether it publishes subprocessors, penetration tests and bug bounties
- whether it addresses AI governance and data residency
- which trust-center platform, if any, hosts the page
This report covers what we found, the 11 strategies that separate strong trust pages from weak ones, and a stage-by-stage playbook you can use this quarter.
Key findings at a glance
| Finding | Share of 111 companies |
|---|---|
| Show SOC 2 on their trust page | 90% (100) |
| Explicitly name SOC 2 Type II | 77% (86) |
| Claim ISO 27001 | 49% (54) |
| Show both SOC 2 and ISO 27001 | 47% (52) |
| Reference GDPR | 57% (63) |
| Reference CCPA/CPRA | 43% (48) |
| Reference HIPAA | 39% (43) |
| Hold ISO/IEC 42001 (AI management) | 16% (18) |
| Disclose penetration testing | 61% (68) |
| Put the SOC 2 report behind a request, NDA or login | 42% (47) |
| Publish or link a subprocessor list | 41% (45) |
| Have a dedicated AI governance or AI data section | 44% (49) |
| Advertise a bug bounty or responsible-disclosure program | 33% (37) |
| Offer data residency choices | 29% (32) |
| Use a third-party trust-center platform | 41% (46) |
| Show a "last updated" date | 12% (13) |
The median company lists four frameworks or regimes; the mean is 4.6. The range is wide: Vercel lists 18, while a handful of well-known companies show none on the page we reviewed.
Methodology
Who we looked at. We sampled 111 venture-backed software companies whose customers are mostly businesses. We picked them because they sell to buyers who run security reviews. Sectors:
- AI (24)
- data infrastructure (18)
- security (16)
- developer tools (15)
- HR and payroll (9)
- productivity (8)
- sales and marketing (8)
- fintech (7)
- healthtech (6)
Several compliance vendors (Vanta, Drata, Secureframe, Oneleet, Delve, Sprinto, Conveyor and SafeBase) are in the sample. We wanted to see whether the companies selling trust practise what they preach.
What we counted. For each company we visited the primary public trust or security page. That was usually trust.company.com, a /security page, or a security section of the docs. We recorded only what that page showed or directly linked. If a field could not be confirmed from the page, we left it blank rather than guessing.
Read the numbers as "what buyers can see". If a page doesn't show a certification, that doesn't mean the company lacks it. Several large companies, including Deel, Personio, Plaid and Glean, almost certainly hold SOC 2 attestations that their primary page didn't surface. That gap is a finding in itself. A security reviewer only sees what you show, and nobody will dig through three help-center articles to give you credit.
Snapshot date. Pages were reviewed in October 2026. Trust pages change often, so treat individual entries as a point-in-time snapshot. The full company list is in the appendix.
Finding 1: SOC 2 Type II is table stakes, not a differentiator
Nine in ten companies show SOC 2 on their trust page, and 77% specifically say Type II. Not a single company showed a Type I without a Type II. Type I is a bridge, not a destination.
Strong pages go beyond a logo:
- OpenAI gives the exact coverage window of its 2026 SOC 2 Type 2 report (July 1, 2025 to June 30, 2026).
- Vercel does the same with a matching audit period.
- Baseten names its June 2024 to May 2025 observation window.
- Pinecone says its 2025 Type II audit found zero deviations. A clean audit result is a sales asset, so say so.
- Noyo claims six years of SOC 2 Type II with no gaps between audit periods. Continuity is a credibility signal that few companies use.
The strategy: if you sell to mid-market or enterprise buyers, SOC 2 Type II isn't optional. It's the entry ticket. Showing it gets you into the room; it doesn't win the deal. Use the details to stand out: the audit period, the auditor and a clean opinion. If you are starting from zero, our SOC 2 guide for startups covers timelines and costs. Our SOC 2 software rankings compare the automation platforms.
Finding 2: Half the market now pairs SOC 2 with ISO 27001
ISO 27001 appears on 49% of trust pages, and 47% show it next to SOC 2. The pairing is about geography. SOC 2 is an American attestation, while European, Middle Eastern and Asia-Pacific procurement teams ask for ISO certificates.
The pattern is strongest in sectors that sell into Europe:
- HR and payroll: 6 of 9 companies (67%) claim ISO 27001.
- Data infrastructure: 10 of 18.
- Productivity: 5 of 8.
- Sales and marketing: only 2 of 8, which suggests ISO 27001 is still a real gap there.
The ISO extensions are rising too:
- ISO 27701 (privacy information management): 14%
- ISO 27017 (cloud security): 11%
- ISO 27018 (protection of personal data in the cloud): 11%
These extensions tend to cluster on the most complete pages. ClickUp, dbt Labs, Figma, OpenAI, Sigma Computing and Wiz all list several of them.
The strategy: plan to add ISO 27001 within 12 to 18 months of your first SOC 2, especially if you have European pipeline. Most automation platforms map controls across both frameworks, so the second is much cheaper than the first. See ISO 27001 compliance tools.
Finding 3: AI governance has become its own trust-center section
Forty-four percent of companies have a dedicated AI governance, AI security or "AI training data" section. Only two years ago that section barely existed. It isn't only AI companies doing this:
- Brex lists AI Security, AI Risk Management and AI Governance.
- Lattice and Jasper publish "AI Training Data and Bias" sections.
- Ashby links responsible-AI materials from its trust center.
The most common AI commitment is about training data. Twelve companies make an explicit statement about how customer data is, or isn't, used to train models:
- Notion says customer data is never used to train Notion AI models.
- Writer says it doesn't train on customer data, inputs or outputs.
- Calendly says customer data isn't used to train models across customers.
- Miro excludes customer data from model training, with an opt-in exception for non-enterprise users.
- Runway says it separates customer content storage from its model-training systems.
Four companies go further and commit to zero data retention. Modal says inference payloads are never written to disk. Fireworks AI keeps nothing for open models by default. Writer commits to zero retention too. Perplexity offers it, but not by default, and says so plainly.
ISO/IEC 42001, the AI management-system standard, is now on 16% of pages. Holders include:
- Anthropic, OpenAI, Anysphere (Cursor), Harvey, Hebbia, Writer, Synthesia and Fireworks AI
- several non-AI-native companies: Ramp, Rippling, Deel, Figma, Miro, ClickUp, dbt Labs and Commure
- compliance vendors Drata and Sprinto
Only 6 of the 24 AI-sector companies (25%) hold it. So the AI companies that hold ISO 42001 stand out from most of their peers.
A newer signal is AIUC-1, an AI-agent-specific standard. Anysphere (Cursor) and Harvey list it. Harvey's page also references the EU AI Act, as does Notion's.
The strategy: if your product touches customer data with AI, which is most products in 2026, publish an AI section now. At minimum it should cover:
- training-data use
- retention
- which model providers act as subprocessors
- opt-out controls
If you sell to regulated enterprises, budget for ISO 42001 next. It is moving from "nice to have" to an RFP checkbox. Tools such as Drata, Vanta and Sprinto now support ISO 42001 control sets. AI-governance specialists such as Asenion focus on EU AI Act and NIST AI RMF alignment.
Finding 4: The smartest companies gate the report, not the posture
Forty-two percent of companies require a request, NDA, login or customer status before they release the full SOC 2 report. The posture itself stays public: certifications, policies, control summaries and FAQs. Only the auditor's report is protected.
Gating varies a lot:
- Neon releases its SOC 2 report only to paying customers and reviews requests within two business days.
- MotherDuck gives its annual report to Business-plan customers on request.
- Mutiny releases reports to Enterprise customers under NDA.
- OpenAI gives the report to authenticated Trust Portal users.
- Snyk and Deepgram route requests through the account team.
- Airwallex shows its PCI DSS Level 1 certificate publicly and keeps the full Attestation of Compliance private for registered accounts.
Gating is reasonable, because a SOC 2 report describes your control environment in detail. But every manual step adds days to a sales cycle. The best implementations use a click-through NDA with instant access: the prospect accepts terms and downloads the report straight away. Requests that sit in a security inbox for a week cost deals.
The strategy: keep the posture public and gate the report behind a self-serve NDA. Set an internal SLA of one business day or less for anything that can't be automated, and put that SLA on the page, as Neon does.
Finding 5: Penetration tests are the most published proof beyond certificates
Sixty-one percent of companies disclose penetration testing. The best treat the pentest as a document, not a sentence:
- Wiz published a 2026 third-party penetration-test report covering its web platform and external infrastructure.
- Semgrep describes a full-scope white-box test by Include Security covering its AppSec platform and three product lines.
- CircleCI reports an annual penetration test with no identified issues.
- Vanta offers summary pentest reports through its trust center.
- Teleport publishes third-party audit reports every year and keeps previous years' reports available.
- Retool discloses specific vulnerabilities (SAMLStorm), the affected versions and the fixed releases.
Retool's choice to publish vulnerabilities, rather than hide them, earns trust with technical buyers.
Bug bounties are less common, at 33%. Where they exist they're usually run through a named platform: Glean uses Bugcrowd and Modern Treasury uses HackerOne.
The strategy: commission an annual third-party pentest and publish a summary letter: tester, scope, date and remediation status. You don't need to publish the findings. Add a security.txt file and a responsible-disclosure policy before you pay for a bug bounty.
Finding 6: Subprocessor transparency separates the good pages from the great
Forty-one percent of companies publish or link a subprocessor list. The examples show what "good" looks like:
- Conveyor lists 27 subprocessors and states that customer content is stored in the US.
- Render names AWS, GCP, Cloudflare and ClickHouse, with each one's purpose and country.
- Delve lists Anthropic, AWS, Railway and Cloudflare as subprocessors.
- Anysphere (Cursor) publishes its subprocessor list and states it has no infrastructure in China, which answers a common question before anyone asks it.
In 2026, buyers read subprocessor lists more carefully than ever because of AI. They want to know which model providers see their data. A list that names your model providers answers the AI-security questionnaire before it arrives.
The strategy: publish a subprocessor list with purpose, data categories and location for every vendor. Let customers subscribe to change notifications, which most enterprise DPAs require anyway. Name your LLM providers explicitly.
Finding 7: Data residency is now a product feature, not just a legal one
Twenty-nine percent of companies advertise data-residency choices, and the most advanced treat it as a product feature:
- ElevenLabs offers isolated environments in the EU, India and Singapore.
- ClickUp lets enterprise customers host core workspace data in the US, Europe or Asia Pacific.
- Metabase offers US, Europe, Latin America and Asia-Pacific hosting, plus self-hosted and air-gapped deployments.
- Linear lets customers choose EU or US storage.
- Airbyte runs separate US and EU data planes.
- Temporal lets customers pick the processing jurisdiction for each cloud provider.
- Synthesia, Leapsome and HiBob are EU-first and say so. For example, HiBob hosts in AWS Ireland with Germany as the backup.
A related pattern is architecture as a compliance strategy: designing the product so that less customer data reaches you. Examples:
- Census runs sensitive operations inside the customer's warehouse.
- Dagster keeps pipeline code and data in the customer's environment.
- Monte Carlo stores agent traces in the customer's own cloud account.
- RudderStack says it doesn't store customer data at all.
The less data you hold, the less you have to secure and the fewer findings an auditor can raise.
The strategy: if you sell into Europe, an EU region is quickly becoming a requirement. Whatever your architecture, write down exactly where data lives and what never leaves the customer's environment, and put that on the trust page. It is often your strongest security argument.
Finding 8: Your sector decides your second and third frameworks
Average number of frameworks listed, by sector:
| Sector | Companies | Avg. frameworks listed | Distinctive frameworks |
|---|---|---|---|
| Productivity | 8 | 6.4 | ISO 27017/27018, ISO 42001, SOC 3 |
| Healthtech | 6 | 5.7 | HIPAA (6 of 6), HITRUST, ONC |
| Developer tools | 15 | 5.3 | HIPAA, FedRAMP, SOC 3 |
| Fintech | 7 | 5.1 | PCI DSS, SOC 1, DORA |
| Data infrastructure | 18 | 4.9 | HIPAA (11 of 18), PCI DSS |
| Security | 16 | 4.6 | FedRAMP, GovRAMP, CMMC |
| HR & payroll | 9 | 4.0 | ISO 27001 (6 of 9), ISO 27701 |
| AI | 24 | 3.6 | ISO 42001, AIUC-1 |
| Sales & marketing | 8 | 3.4 | GDPR, CCPA, EU-US DPF |
Each sector's "second framework" follows its buyer:
-
Healthtech: every company lists HIPAA. Healthie stacks HITRUST R2, ONC certification, PIPEDA/PHIPA and the Australian Privacy Act on top, for 12 regimes in total. See HIPAA compliance tools.
-
Fintech: payments companies add PCI DSS and SOC 1, because their customers' auditors rely on their controls for financial reporting. Airwallex, Modern Treasury and Ramp all list SOC 1 Type II. Airwallex also references the EU's DORA regulation. See PCI DSS tools.
-
Public sector: 9 companies list FedRAMP and 10 list state programmes (GovRAMP, TX-RAMP). They include:
- Wiz: FedRAMP High.
- Ramp: FedRAMP Moderate plus GovRAMP and TX-RAMP.
- Secureframe: a FedRAMP 20x Low authorization and CMMC Level 2.
- OpenAI references FedRAMP 20x.
- CircleCI holds FedRAMP LI-SaaS.
The FedRAMP 20x pathway has cut time-to-authorization enough that startups are now attempting it. See FedRAMP tools.
-
Data infrastructure: HIPAA is surprisingly common (11 of 18), because data platforms end up processing health data for their customers.
The strategy: choose your second framework by asking which buyer segment is stuck in procurement. Don't copy a competitor's badge wall.
Finding 9: Most companies still self-host, but platform-hosted pages disclose more
- Self-hosted page59% (65)
- SafeBase28% (31)
- Conveyor5% (5)
- Other platforms9% (10)
Fifty-nine percent of companies run their own trust page: a marketing page, a docs section or a help-center article. The other 41% use a trust-center platform:
- SafeBase: 31 companies, 28% of the sample and by far the most common. SafeBase is now part of Drata.
- Conveyor: 5.
- Secureframe: 2.
- Wolfia: 2 (Notion, Miro).
- TrustCloud: 1 (Deel).
- Vendor-native trust centers: Delve, Oneleet and Sprinto.
The difference in disclosure is large:
| Disclosure | SafeBase-hosted (31) | Self-hosted (65) |
|---|---|---|
| Penetration testing disclosed | 94% | 48% |
| Subprocessor list | 61% | 23% |
| SOC 2 report gated behind request/NDA | 35% | 43% |
Platform pages arrive with slots for a pentest letter, a subprocessor list and a document library. Filling them in feels like finishing a checklist, so companies publish more. Self-hosted pages tend to stop at a paragraph about encryption and a SOC 2 badge.
Seventeen companies (15%) keep their main security information in documentation or help-center pages. Anthropic and Mistral answer certification questions in help-center articles. That works for developers, but procurement teams expect a single trust URL.
The strategy: your first enterprise prospects will ask for a trust URL. A platform gets you a complete page in a day and makes NDA-gated document sharing self-serve. Questionnaire-automation tools such as Conveyor and Whistic also answer incoming questionnaires from the same content library. Compliance platforms including Vanta, Drata, Secureframe, Oneleet, Sprinto and Delve include trust centers fed by live control monitoring. If you self-host, copy a platform's structure at minimum:
- certifications
- document library
- subprocessors
- policies
- an FAQ
Finding 10: Almost nobody proves their page is current
Only 12% of trust pages show a "last updated" date, and just 6% link a status page. That is the most surprising gap in the data. A trust page with no date makes the reader wonder how stale it is.
Two examples stand out:
- Oneleet's trust center shows live control status, updated "26 minutes ago" when we checked, and lists the controls being monitored.
- Secureframe, Rippling and Hex Trust list specific monitored controls.
Continuous monitoring is the main promise of compliance automation. Showing it publicly turns an internal process into a sales asset.
Validity dates are another underused signal:
- Secureframe shows its CMMC Level 2 certificate is valid until 9 September 2028.
- OpenAI and Vercel state their audit periods.
Most companies show a logo and leave the reader to guess.
The strategy: add a "last reviewed" date and a status-page link. If your platform supports it, show live control status. All three are cheap and signal that someone owns the page.
Finding 11: The companies selling trust mostly practise what they preach
The compliance vendors in our sample (Drata, Vanta, Secureframe, Oneleet, Delve, Sprinto, Conveyor, SafeBase) generally run strong pages:
- Drata lists 10 frameworks, including ISO 42001 and FedRAMP, plus an external pentest report and a subprocessor list.
- Secureframe lists FedRAMP 20x Low and CMMC Level 2 with validity dates.
- Oneleet shows live control monitoring.
- Conveyor lists 27 subprocessors and shows its last-updated date.
There are gaps. Several vendor pages list only one to three frameworks, and few show live status the way Oneleet does. If you're evaluating these vendors, look at their own trust page as a demo of what yours will look like. Our Vanta vs Drata vs Oneleet comparison goes further.
The 2026 trust-center playbook, by stage
Seed to Series A: the first enterprise deal
- SOC 2 Type II: start with a Type I to unblock deals if you must, but begin the Type II observation window straight away.
- A single trust URL. Use a trust-center platform or a structured
/securitypage. - The basics, stated plainly:
- encryption at rest and in transit, with the algorithms named (68% of companies include this)
- SSO and MFA (43%)
- your hosting provider and region
- A subprocessor list, including any LLM providers.
- An AI data-use statement: training, retention and opt-out.
- An annual pentest summary letter.
Budget: for a seed-stage company, a compliance automation platform plus an auditor typically costs $15,000 to $40,000 in year one. See our best compliance tools for startups.
Series A to B: scaling into the mid-market
- ISO 27001, especially with European pipeline. Use the shared control mapping.
- A self-serve NDA for report access, with a one-day SLA for anything manual.
- A data residency option, or at least a precise statement of where data lives.
- A responsible-disclosure policy, then a bug bounty.
- Questionnaire automation to keep pre-sales engineers out of spreadsheets.
Series B and beyond: enterprise and regulated markets
- Sector frameworks:
- HIPAA or HITRUST for health
- PCI DSS and SOC 1 for payments and finance
- FedRAMP or GovRAMP for public sector
- ISO 42001 if AI is central to your product and you sell to regulated buyers.
- ISO 27701, 27017 and 27018 for privacy-heavy and cloud-heavy European deals.
- Live control monitoring shown on the trust page, plus validity dates and audit periods.
- Published security advisories in the style of Retool's vulnerability disclosures.
A trust-page checklist you can use today
Score your own page against the companies in this study. One point each:
- SOC 2 Type II shown with the audit period
- A second framework that fits your buyers (ISO 27001, HIPAA, PCI DSS, FedRAMP)
- Self-serve, NDA-gated report access
- Penetration-test summary with tester and date
- Subprocessor list with purpose and location, naming AI providers
- AI section: training-data use, retention and opt-out
- Data residency statement or regional options
- Encryption, SSO and MFA details
- Responsible-disclosure policy or bug bounty
- "Last updated" date and status-page link
How the sample scored. We applied this checklist to what each company's page visibly shows. The median company scores 5 out of 10. Only 16% score 7 or higher, and just 8% (9 companies) reach 8 or more. Scoring 7 or more puts you ahead of almost every company we reviewed. Scoring 5 or fewer probably means your security reviews take longer than they should.
Bottom line
The data shows the market shifting from badges to evidence. A SOC 2 logo is a given. The pages that shorten security reviews do four things:
- show their working: audit periods, pentest letters, subprocessors and live controls
- address AI data use directly
- treat data location as a feature
- make report access self-serve
Most of these steps cost little. Publishing a subprocessor list, adding a last-updated date, writing an AI data-use statement and switching to a click-through NDA can all be done this month. Together they make your trust page a sales tool rather than a formality.
To build the program behind the page, compare the platforms in our compliance tools directory. You can also read our guide on how to choose compliance tools.
Appendix: the 111 trust pages we reviewed
Frameworks are as shown on each company's page in October 2026. "Self-hosted" means the company runs its own page rather than a trust-center platform.
| Company | Sector | Platform | Frameworks shown |
|---|---|---|---|
| Abridge | Healthtech | SafeBase | SOC 2 Type I, SOC 2 Type II, HIPAA, CCPA, TX-RAMP |
| Airbyte | Data infra | Self-hosted | SOC 2 Type II, ISO 27001 |
| Airtable | Data infra | Self-hosted | SOC 2 Type II, ISO 27001, ISO 27701, HIPAA, TX-RAMP Level 2, GDPR, CCPA/CPRA |
| Airwallex | Fintech | SafeBase | DORA, GDPR, PCI DSS, SOC 1, SOC 1 Type II, SOC 2 Type I, SOC 2 Type II, ISO 27001 |
| Ambience Healthcare | Healthtech | Self-hosted | SOC 2 Type I, SOC 2 Type II, HIPAA, GDPR |
| Anthropic | AI | Help center | ISO 27001, ISO 42001, SOC 2 Type I, SOC 2 Type II |
| Anysphere | Devtools | Self-hosted | AIUC-1, ISO 27001, ISO 42001, SOC 2 Type II |
| Apollo.io | Sales/Marketing | SafeBase | CASA Tier 2, CCPA, CPRA, EU-US DPF, GDPR, ISO 27001, SOC 2 Type II |
| Ashby | HR/Payroll | SafeBase | SOC 2 Type II, EU-US DPF, Swiss-US DPF, UK Extension to EU-US DPF, SOC 1 Type II |
| AssemblyAI | Data infra | Self-hosted | SOC 2 Type II |
| Attio | Sales/Marketing | Self-hosted | None shown |
| Baseten | AI | SafeBase | CCPA, CSA STAR Level 1, GDPR, HIPAA, ISO 27001, PCI DSS, SOC 2 Type II, SOC 3 |
| Brex | Fintech | SafeBase | PCI DSS, SOC 1 Type II, SOC 2 Type II, ISO 27001 |
| Calendly | Sales/Marketing | Self-hosted | SOC 2 Type II |
| Census | Data infra | Self-hosted | SOC 2 Type II, HIPAA, GDPR, CCPA |
| CircleCI | Devtools | SafeBase | SOC 2 Type II, FedRAMP LI-SaaS, GDPR, CCPA, CPRA, EU-US DPF, Swiss-US DPF, UK Extension to EU-US DPF, CSA STAR Level 1 |
| ClickHouse | Data infra | SafeBase | CCPA, EU-US DPF, GDPR, HIPAA, ISO 27001, PCI DSS, SOC 2 Type II, ISO 27701 |
| ClickUp | Productivity | Self-hosted | SOC 1 Type II, SOC 2 Type II, SOC 3, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, PCI DSS |
| Coda | Productivity | Self-hosted | ISO 27001, ISO 27017, ISO 27018, SOC 2 Type II, SOC 3, GDPR, CCPA, HIPAA |
| Cohere | AI | Self-hosted | SOC 2 Type II |
| Common Room | Sales/Marketing | Self-hosted | GDPR, CCPA, SOC Type 2 |
| Commure | Healthtech | SafeBase | SOC 2 Type II, HIPAA, ISO 27001, ISO 42001, TX-RAMP |
| Conveyor | Security | Conveyor | SOC 2 Type II |
| Copy.ai | AI | Self-hosted | SOC 2 Type II |
| Customer.io | Sales/Marketing | Self-hosted | CCPA, GDPR, HIPAA, SOC 2 Type II |
| Dagster Labs | Data infra | Self-hosted | SOC 2 Type II, HIPAA |
| dbt Labs | Data infra | Conveyor | SOC 2 Type II, GDPR, CCPA, ISO 27701, ISO 27001, ISO 27017, ISO 27018, ISO 42001 |
| Deel | HR/Payroll | TrustCloud | CSA STAR Level 1, ISO 42001, ISO 27001, ISO 27701 |
| Deepgram | AI | Self-hosted | SOC 2 Type II |
| Delve | Security | Delve | SOC 2 Type II |
| Descript | Productivity | Self-hosted | SOC 2 Type II, GDPR, CCPA |
| Drata | Security | SafeBase | SOC 2 Type II, ISO 27018, SOC 3, ISO 27001, ISO 27017, ISO 42001, HIPAA, CCPA, GDPR, FedRAMP Certified - Class B |
| ElevenLabs | AI | Self-hosted | GDPR, SOC 2, HIPAA |
| Figma | Productivity | Conveyor | ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, SOC 2 Type II, SOC 3, CSA, FedRAMP Moderate, GDPR, CCPA, EU Cloud Code of Conduct, TISAX |
| Fireworks AI | Data infra | Self-hosted | SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, HIPAA |
| Fivetran | Data infra | SafeBase | CCPA, Cyber Essentials, GDPR, HITRUST, ISO 27001, ISO 27701, SOC 1, SOC 2, PCI DSS v4.0.1 |
| Fly.io | Devtools | Self-hosted | SOC 2 Type II, HIPAA |
| Glean | Productivity | Self-hosted | None shown |
| Gusto | HR/Payroll | Self-hosted | SOC 1, SOC 2, HIPAA |
| Harness | Devtools | SafeBase | ISO 27001, ISO 27017, ISO 27018, SOC 2, CCPA, GDPR, CSA STAR, DORA, NIS2, SOC 1 |
| Harvey | AI | SafeBase | AIUC-1, CCPA, EU AI Act, GDPR, IRAP, ISO 27001, ISO 27701, ISO 42001, SOC 2 Type II, TX-RAMP, WCAG |
| Healthie | Healthtech | Self-hosted | HIPAA, SOC 2 Type I, SOC 2 Type II, HITRUST R2, ONC Certification, PIPEDA/PHIPA, FERPA, AUS Privacy Act, CCPA, GDPR, WCAG 2.1 A, WCAG 2.1 AA |
| Hebbia | AI | Self-hosted | ISO 42001, SOC 2 Type II, ISO 27001, GDPR, CCPA |
| Hex | AI | Self-hosted | SOC 2 Type II |
| Hex Trust | Fintech | Self-hosted | SOC 1 Type I, SOC 1 Type II, SOC 2 Type I, SOC 2 Type II, CSA STAR Level 2 |
| HiBob | HR/Payroll | Self-hosted | SOC 2 Type II, ISO 27001, ISO 27018 |
| Hightouch | Sales/Marketing | Self-hosted | SOC 2 Type II, ISO 27001, HIPAA, GDPR, CCPA |
| Jasper | AI | SafeBase | CCPA, GDPR, SOC 2 |
| LangChain | AI | Self-hosted | SOC 2 Type II, GDPR, HIPAA |
| Lattice | HR/Payroll | SafeBase | CCPA, GDPR, SOC 2 |
| LaunchDarkly | Devtools | Self-hosted | SOC 2 Type II, ISO 27001, FedRAMP, GDPR, CCPA, HIPAA |
| Leapsome | HR/Payroll | Self-hosted | SOC 2 Type II, GDPR, ISO 27001 |
| Linear | Devtools | Self-hosted | SOC 2 Type II, GDPR, HIPAA, ISO 27001 |
| Loom | Productivity | Self-hosted | GDPR, CCPA, SOC 2 Type II |
| Lovable | Devtools | Self-hosted | None shown |
| Mercury | Fintech | Self-hosted | SOC 2 Type II, PCI DSS |
| Metabase | Data infra | Self-hosted | SOC 2 Type II, SOC 1 Type II, GDPR, CCPA |
| Miro | Productivity | Wolfia | ISO 42001, ISO 27001, SOC 2 Type II, SOC 3, GDPR, CCPA, Cyber Essentials |
| Mistral AI | AI | Help center | SOC 2 Type II, ISO 27001, ISO 27701 |
| Modal | AI | Self-hosted | SOC 2 Type II, HIPAA |
| Modern Treasury | Fintech | Self-hosted | PCI DSS 4.0, SOC 2 Type II, SOC 1 Type II, NIST CSF 1.1, GDPR, CCPA, CPRA |
| Monte Carlo | Data infra | Self-hosted | SOC 2 Type II, ISO 27001, GDPR, CCPA |
| MotherDuck | Data infra | Self-hosted | SOC 2 Type II |
| Mutiny | Sales/Marketing | Self-hosted | GDPR, CCPA, SOC 2 Type II |
| Nabla | Healthtech | Secureframe | SOC 2 Type II, ISO 27001, HIPAA, CCPA, Texas RAMP, GDPR, PIPEDA |
| Neon | Data infra | SafeBase | CCPA, GDPR, HIPAA, ISO 27001, ISO 27701, SOC 2, SOC 3 |
| Notion | Productivity | Wolfia | SOC 2 Type II, SOC 2 Type I, SOC 3 Type II, ISO 27001, HIPAA, BSI C5, EU AI Act, GDPR |
| Noyo | Data infra | Conveyor | SOC 2 Type II, HIPAA |
| Oneleet | Security | Oneleet | SOC 2 Type II, ISO 27001, SOC 2 Type I |
| OpenAI | AI | SafeBase | SOC 2 Type II, SOC 3, PCI DSS v4.0.1, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, CCPA, CSA STAR, GDPR, TX-RAMP, FedRAMP 20x |
| Orca Security | Security | SafeBase | ISO 27018, CSA STAR, FedRAMP Moderate, GDPR, GovRAMP, IRAP, ISO 27001, ISO 27017, ISO 27701, PCI DSS v4.0.1, SOC 2 |
| Perplexity | AI | Self-hosted | SOC 2 Type II |
| Personio | HR/Payroll | SafeBase | ISO 27001, ISO 27017, GDPR |
| Pinecone | AI | SafeBase | CCPA, GDPR, HIPAA, ISO 27001, SOC 2 |
| Plaid | Fintech | Self-hosted | None shown |
| PlanetScale | Data infra | Self-hosted | SOC 1 Type II, SOC 2 Type II, HIPAA, GDPR, PCI DSS 4.0 Level 1 Service Provider |
| PostHog | Devtools | SafeBase | SOC 2 Type II, GDPR, CCPA, HIPAA |
| Qdrant | AI | Self-hosted | SOC 2 Type II, HIPAA |
| Railway | Devtools | SafeBase | SOC 2 Type II, SOC 3, HIPAA, GDPR, EU-US DPF, Swiss-US DPF |
| Ramp | Fintech | SafeBase | CCPA, ISO 27001, PCI DSS, SOC 1 Type II, SOC 2 Type II, FedRAMP Moderate, Cyber Essentials Plus, GovRAMP, ISO 42001, TX-RAMP |
| Remote | HR/Payroll | Secureframe | ISO 27001, SOC 2 Type II, GDPR |
| Render | Devtools | Self-hosted | SOC 2 Type II, ISO 27001, GDPR, HIPAA, EU-US Data Privacy Framework |
| Replicate | AI | Self-hosted | None shown |
| Replit | Devtools | Self-hosted | SOC 2 Type II, GDPR |
| Retool | Devtools | SafeBase | SOC 2 Type II, ISO 27001, GDPR, CCPA |
| Rippling | HR/Payroll | Self-hosted | SOC 1 Type II, SOC 2 Type II, SOC 3, CSA STAR Level 2, ISO 27001, ISO 27018, ISO 42001, GDPR, CCPA |
| Roboflow | AI | SafeBase | SOC 2, HIPAA |
| RudderStack | Data infra | Self-hosted | SOC 2 Type II, HIPAA, GDPR |
| Runway | AI | Self-hosted | SOC 2 Type II, ISO 27001, GDPR, CCPA/CPRA |
| SafeBase | Security | SafeBase | SOC 2 Type II, CCPA, GDPR, HIPAA, CSA STAR |
| Secureframe | Security | Self-hosted | SOC 2 Type II, ISO 27001, FedRAMP 20x Low, CMMC Level 2, TX-RAMP Level 1, GDPR, CPRA |
| Semgrep | Security | SafeBase | GDPR, SOC 2 Type II |
| Sigma Computing | Data infra | SafeBase | CCPA, EU-US DPF, GDPR, HIPAA, ISO 27001, ISO 27017, ISO 27018, ISO 27701, SOC 1, SOC 2, SOC 3, PCI DSS |
| Snyk | Security | Self-hosted | ISO 27001, ISO 27017, SOC 2 Type II, GDPR |
| Socket | Security | Self-hosted | None shown |
| Sprinto | Security | Sprinto | ISO 27001, SOC 2, ISO 42001 |
| Statsig | Devtools | Self-hosted | SOC 2 Type II |
| Suki | Healthtech | Self-hosted | HIPAA |
| Supabase | Data infra | Self-hosted | SOC 2 Type II, HIPAA, ISO 27001, GDPR |
| Synthesia | AI | Self-hosted | ISO 42001, ISO 27001, SOC 2 Type II |
| Tailscale | Security | Self-hosted | SOC 2 Type II |
| Teleport | Security | Self-hosted | SOC 2 Type II, ISO 27001, HIPAA |
| Temporal | Devtools | Conveyor | SOC 2 Type II, GDPR, HIPAA, CCPA |
| Together AI | AI | Self-hosted | None shown |
| Vanta | Security | Self-hosted | SOC 2 Type II, ISO 27001, HIPAA, GDPR, CCPA, PCI DSS |
| Vercel | Devtools | SafeBase | SOC 2 Type II, ISO 27001, PCI DSS, HIPAA, HITECH, GDPR, CCPA, CPRA, EU-US DPF, Swiss-US DPF, UK Extension to EU-US DPF, PIPEDA, DSA, NIS2, DORA, nFADP, SOC 3, TISAX |
| Warmly | Sales/Marketing | SafeBase | CCPA, EU Data Act, GDPR, SOC 2 |
| Weaviate | AI | Self-hosted | SOC 2, HIPAA |
| Wiz | Security | SafeBase | CCPA, CSA STAR Level 1, ISO 27001, ISO 27017, ISO 27018, ISO 27701, SOC 2 Type II, SOC 3, GovRAMP, PCI DSS, TX-RAMP, FedRAMP High, IRAP |
| WorkOS | Security | Self-hosted | SOC 2 Type II, GDPR, CCPA |
| Writer | AI | Self-hosted | SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, HIPAA, PCI compliance, GDPR, CCPA |