Netlify Trust Center
Welcome to Netlify's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Explore our security posture and request access to our documentation below.
Netlify is reviewed and trusted by
Compliance programs
-
SOC 2 Type II
Independent audit of our security, availability, and confidentiality controls.
-
ISO/IEC 27001
Certified information security management system.
-
ISO/IEC 27018:2019
Certified controls for protecting personal data in public cloud services.
-
Penetration Test
Regular third-party penetration testing of our platform.
-
PCI DSS
Compliance with the Payment Card Industry Data Security Standard.
-
PCI DSS v4.0.0
Compliance with version 4.0.0 of the Payment Card Industry Data Security Standard.
-
GDPR
Aligned with the EU General Data Protection Regulation.
-
CCPA
Aligned with the California Consumer Privacy Act.
-
HIPAA
Safeguards for handling protected health information.
-
DORA
Aligned with the EU Digital Operational Resilience Act.
-
Data Processing Addendum
GDPR-aligned data processing terms available to customers.
-
EU-US Data Privacy Framework
Certified participant in the EU-US Data Privacy Framework.
-
Swiss-US Data Privacy Framework
Certified participant in the Swiss-US Data Privacy Framework.
-
VPAT
Accessibility conformance reported in a Voluntary Product Accessibility Template.
Document inventory
Security and compliance reports, policies, and agreements.
- Data Processing Agreement DPA
- Incident Response Business Continuity and Disaster Recovery Testing Report
- Security and Architecture Overview
- SOC 2 2026
- Threat Intelligence Policy
- Accessibility Statement
- Penetration Test Executive Summary
- BAA for Business Associates
- AOC PCI DSS Audit 2026
- Business Continuity Disaster Recovery Policy
- Incident Response Policy
- HIPAA Security Rule at Netlify
- Customer Penetration Testing Policy
- Data Classification Policy
- DORA Addendum
- ePHI Information Access Management
- HIPAA Security and Breach Audit 2026
- Fraud Risk Management Policy
- Information Security Management System (ISMS)
- Information Security Policy
- ISO 27001 27018 Certificate Award 2026
- ISO 27001 27018 Surveillance Audit Report 2026
- Operational Risk Management Policy
- PCI 12.5.2 DSS CDE Scoping Assessment
- PCI DSS - SAQ-A 2026
- PCI DSS SAQ-A Responsibility Matrix
- Secure Development Lifecycle (SDLC)
- Vulnerability and Patch Management Policy
- VPAT
- Architecting a HIPAA-Compliant Composable Site on Netlify
- Evidence of Coverage COI
No documents match your search.
Subprocessors
The third parties that process customer data on our behalf.
| Subprocessor | Registration # | Purpose | Category | Locations | Share |
|---|---|---|---|---|---|
| Altinity, Inc / Clickhouse | SP-20210331.1 | Managed ClickHouse database services, including hosting, operation, and support of ClickHouse analytical databases. | Database | US | |
| Amazon Web Services (AWS) | SP-20160510.1 | Cloud infrastructure provider supplying AWS compute, storage, networking, and managed services used to host and run Netlify infrastructure. | Hosting, compute, storage, backup | US | |
| Amplitude, Inc. | SP-20211101.1 | Product analytics platform used to track user behavior, measure feature adoption, and analyze product engagement. | Analytics | US | |
| Anthropic | SP-20240414.1 | Provider of large language models (Claude) and related AI services, accessed via API for AI-enabled features and workflows. | AI Services | US | |
| Automattic, Inc. (Akismet) | SP-20181214.1 | Automated spam-filtering service (Akismet) used to detect and filter spam in comment, form, and text submissions. | Spam Filtering | US | |
| Axiom | SP-20240930.1 | Logging, tracing, and monitoring platform used to ingest, store, and query event data for observability and troubleshooting. | logging, tracing, and monitoring | US | |
| Crowdstrike, Inc. (Humio) | SP-20190312.1 | Log management and observability platform (Humio, now CrowdStrike Falcon LogScale) used for log ingestion, search, and security analytics. | Log Analysis | US | |
| Datadog, Inc. | SP-20180312.1 | Observability platform providing infrastructure and application monitoring, log management, and security monitoring. | Analytics | US | |
| Dynatrace DevCycle | SP-20230306.1 | Feature flag and feature management platform used to control feature releases, gradual rollouts, and experimentation. | Feature Flagging | US | |
| Fivetran Inc. | SP-20201028.1 | Automated data movement platform providing ELT pipelines that replicate data from source systems into the data warehouse. | Data Services | US | |
| Google Cloud Platform GCP / Zencore Group, LLC | SP-20160815.1 | Google Cloud Platform infrastructure and managed services, with Zencore Group, LLC as the associated Google Cloud partner. | Infrastructure Service Provider | US | |
| Kapa.AI | SP-20230417.1 | AI assistant trained on developer documentation that answers technical questions for developers and support teams. | AI Servces | US | |
| Name.com | SP-20180619.1 | Domain name registrar used to register and manage company domain names. | Domain Registration | US | |
| Neon | SP-20250422.1 | Third-party provider for a Netlify Extension that lets users create a Postgres database on Netlify's account with Neon and later claim it for production use. | Database Hosting | US | |
| NS1 | SP-20160229.1 | Managed DNS and traffic management service providing authoritative DNS and traffic steering. | Managed authoritative DNS | Global, US | |
| OpenAI | SP-20240304.1 | Provider of large language models (GPT family) and related AI services, accessed via API. | AI Servces | US | |
| OpenRouter | SP-20260806.1 | AI services: model routing platform providing unified API access to large language models from multiple providers. | AI Services | US | |
| Orb | SP-20240601.1 | Usage-based billing platform used to meter usage, calculate charges, and generate invoices for usage-based pricing. | Billing and invoicing | US | |
| Salesforce, Inc. | SP-20200419.1 | Customer relationship management (CRM) platform used to manage accounts, contacts, opportunities, and the sales pipeline. | CRM | US | |
| Segment | SP-20191031.1 | Customer data platform used to collect, route, and deliver analytics event data to downstream tools. | Customer data platform | US | |
| SendGrid | SP-20250829.1 | Cloud-based email delivery service used to send transactional and marketing emails. | Email Services | US | |
| Sigma Computing, Inc. | SP-20230127.1 | Cloud analytics and business intelligence platform used to explore and visualize data from the cloud data warehouse. | Business Intelligence | US | |
| Smartbear Software, Inc / Bugsnag | SP-20220806.1 | Software quality platform providing testing and API quality tools (SmartBear) and application error monitoring (Bugsnag). | Error Reporting | US | |
| Snowflake, Inc. | SP-20210406.1 | Cloud data warehouse used to store, process, and analyze company data. | Warehousing | US | |
| Stripe | SP-20240808.1 | Payment processing platform used to process customer credit card payments. | Payment Processing | US | |
| WorkOS, Inc. | SP-20220810.1 | Enterprise authentication platform providing SSO, directory sync, and related enterprise identity integrations. | Identity and Access Management | US |
No subprocessors match your search.