Netlify Trust Center
Welcome to Netlify's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Explore our security posture and request access to our documentation below.
Netlify is reviewed and trusted by
Compliance programs
-
SOC 2 Type II
Independent audit of our security, availability, and confidentiality controls.
Held since 2026-09-30
-
ISO/IEC 27001
Certified information security management system.
Held since 2026-09-30
-
ISO/IEC 27018:2019
Certified controls for protecting personal data in public cloud services.
-
Penetration Test
Regular third-party penetration testing of our platform.
Held since 2026-09-30
-
PCI DSS
Compliance with the Payment Card Industry Data Security Standard.
Held since 2026-09-30
-
PCI DSS v4.0.0
Compliance with version 4.0.0 of the Payment Card Industry Data Security Standard.
Held since 2026-09-30
-
GDPR
Aligned with the EU General Data Protection Regulation.
-
CCPA
Aligned with the California Consumer Privacy Act.
-
HIPAA
Safeguards for handling protected health information.
-
DORA
Aligned with the EU Digital Operational Resilience Act.
-
Data Processing Addendum
GDPR-aligned data processing terms available to customers.
Held since 2026-09-30
-
EU-US Data Privacy Framework
Certified participant in the EU-US Data Privacy Framework.
-
Swiss-US Data Privacy Framework
Certified participant in the Swiss-US Data Privacy Framework.
-
VPAT
Accessibility conformance reported in a Voluntary Product Accessibility Template.
Document inventory
Security and compliance reports, policies, and agreements.
- Data Processing Agreement DPADownload
- Incident Response Business Continuity and Disaster Recovery Testing ReportAccess on request
- Security and Architecture OverviewAccess on request
- SOC 2 2026Access on request
- Threat Intelligence PolicyAccess on request
- Accessibility StatementAccess on request
- Penetration Test Executive SummaryAccess on request
- BAA for Business AssociatesDownload
- AOC PCI DSS Audit 2026Access on request
- Business Continuity Disaster Recovery PolicyAccess on request
- Incident Response PolicyAccess on request
- HIPAA Security Rule at NetlifyAccess on request
- Customer Penetration Testing PolicyAccess on request
- Data Classification PolicyAccess on request
- DORA AddendumAccess on request
- ePHI Information Access ManagementAccess on request
- HIPAA Security and Breach Audit 2026Access on request
- Fraud Risk Management PolicyAccess on request
- Information Security Management System (ISMS)Access on request
- Information Security PolicyAccess on request
- ISO 27001 27018 Certificate Award 2026Download
- ISO 27001 27018 Surveillance Audit Report 2026Access on request
- Operational Risk Management PolicyAccess on request
- PCI 12.5.2 DSS CDE Scoping AssessmentAccess on request
- PCI DSS - SAQ-A 2026Access on request
- PCI DSS SAQ-A Responsibility MatrixAccess on request
- Secure Development Lifecycle (SDLC)Access on request
- Vulnerability and Patch Management PolicyAccess on request
- VPATAccess on request
- Architecting a HIPAA-Compliant Composable Site on NetlifyAccess on request
- Evidence of Coverage COIAccess on request
No documents match your search.
Subprocessors
The third parties that process customer data on our behalf.
| Subprocessor | Registration # | Purpose | Category | Locations |
|---|---|---|---|---|
| Altinity, Inc / Clickhouse | SP-20210331.1 | Managed ClickHouse database services, including hosting, operation, and support of ClickHouse analytical databases. | Database | US |
| Amazon Web Services (AWS) | SP-20160510.1 | Cloud infrastructure provider supplying AWS compute, storage, networking, and managed services used to host and run Netlify infrastructure. | Hosting, compute, storage, backup | US |
| Amplitude, Inc. | SP-20211101.1 | Product analytics platform used to track user behavior, measure feature adoption, and analyze product engagement. | Analytics | US |
| Anthropic | SP-20240414.1 | Provider of large language models (Claude) and related AI services, accessed via API for AI-enabled features and workflows. | AI Services | US |
| Automattic, Inc. (Akismet) | SP-20181214.1 | Automated spam-filtering service (Akismet) used to detect and filter spam in comment, form, and text submissions. | Spam Filtering | US |
| Axiom | SP-20240930.1 | Logging, tracing, and monitoring platform used to ingest, store, and query event data for observability and troubleshooting. | logging, tracing, and monitoring | US |
| Crowdstrike, Inc. (Humio) | SP-20190312.1 | Log management and observability platform (Humio, now CrowdStrike Falcon LogScale) used for log ingestion, search, and security analytics. | Log Analysis | US |
| Datadog, Inc. | SP-20180312.1 | Observability platform providing infrastructure and application monitoring, log management, and security monitoring. | Analytics | US |
| Dynatrace DevCycle | SP-20230306.1 | Feature flag and feature management platform used to control feature releases, gradual rollouts, and experimentation. | Feature Flagging | US |
| Fivetran Inc. | SP-20201028.1 | Automated data movement platform providing ELT pipelines that replicate data from source systems into the data warehouse. | Data Services | US |
| Google Cloud Platform GCP / Zencore Group, LLC | SP-20160815.1 | Google Cloud Platform infrastructure and managed services, with Zencore Group, LLC as the associated Google Cloud partner. | Infrastructure Service Provider | US |
| Kapa.AI | SP-20230417.1 | AI assistant trained on developer documentation that answers technical questions for developers and support teams. | AI Servces | US |
| Name.com | SP-20180619.1 | Domain name registrar used to register and manage company domain names. | Domain Registration | US |
| Neon | SP-20250422.1 | Third-party provider for a Netlify Extension that lets users create a Postgres database on Netlify's account with Neon and later claim it for production use. | Database Hosting | US |
| NS1 | SP-20160229.1 | Managed DNS and traffic management service providing authoritative DNS and traffic steering. | Managed authoritative DNS | Global, US |
| OpenAI | SP-20240304.1 | Provider of large language models (GPT family) and related AI services, accessed via API. | AI Servces | US |
| OpenRouter | SP-20260806.1 | AI services: model routing platform providing unified API access to large language models from multiple providers. | AI Services | US |
| Orb | SP-20240601.1 | Usage-based billing platform used to meter usage, calculate charges, and generate invoices for usage-based pricing. | Billing and invoicing | US |
| Salesforce, Inc. | SP-20200419.1 | Customer relationship management (CRM) platform used to manage accounts, contacts, opportunities, and the sales pipeline. | CRM | US |
| Segment | SP-20191031.1 | Customer data platform used to collect, route, and deliver analytics event data to downstream tools. | Customer data platform | US |
| SendGrid | SP-20250829.1 | Cloud-based email delivery service used to send transactional and marketing emails. | Email Services | US |
| Sigma Computing, Inc. | SP-20230127.1 | Cloud analytics and business intelligence platform used to explore and visualize data from the cloud data warehouse. | Business Intelligence | US |
| Smartbear Software, Inc / Bugsnag | SP-20220806.1 | Software quality platform providing testing and API quality tools (SmartBear) and application error monitoring (Bugsnag). | Error Reporting | US |
| Snowflake, Inc. | SP-20210406.1 | Cloud data warehouse used to store, process, and analyze company data. | Warehousing | US |
| Stripe | SP-20240808.1 | Payment processing platform used to process customer credit card payments. | Payment Processing | US |
| WorkOS, Inc. | SP-20220810.1 | Enterprise authentication platform providing SSO, directory sync, and related enterprise identity integrations. | Identity and Access Management | US |
No subprocessors match your search.