{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"alpaca","name":"Alpaca","domain":"alpaca.markets","category":"Developer tools","one_liner":"API-first stock and crypto brokerage platform","trust_center_url":"https://trust.alpaca.markets/","security_page_url":null,"url":"https://certreports.com/vendors/alpaca/security","last_verified_at":"2026-09-18T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 18 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 2 Type 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/alpaca/soc-2","evidence":[{"source_type":"trust_center","source_name":"Alpaca trust centre (Vanta)","url":"https://trust.alpaca.markets/","fetched_at":"2026-09-18 23:11:19.066868+00","content_hash":"054593e4689d2ba3c54c0790af3e7b3671ac8678ec511f6e420e9e3d61d52d8f","wayback_url":null,"quote":"SOC 2 Type 2","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/alpaca/gdpr","evidence":[{"source_type":"trust_center","source_name":"Alpaca trust centre (Vanta)","url":"https://trust.alpaca.markets/","fetched_at":"2026-09-18 23:11:19.066868+00","content_hash":"054593e4689d2ba3c54c0790af3e7b3671ac8678ec511f6e420e9e3d61d52d8f","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Vanta) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/alpaca/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Alpaca trust centre (Vanta)","url":"https://trust.alpaca.markets/","fetched_at":"2026-09-18 23:11:19.066868+00","content_hash":"054593e4689d2ba3c54c0790af3e7b3671ac8678ec511f6e420e9e3d61d52d8f","wayback_url":null,"quote":"ISO 27001:2022","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 17 Sep 2026.","kind":"listing","status_text":"Active: EU-US Certification","issued_at":"2025-11-14","expires_at":"2026-11-14","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/alpaca/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/9897","fetched_at":"2026-09-17 15:51:22.058769+00","content_hash":"054ffd8db09730255b2721ed494e8c4f36118bfcc10e09713f05605c1f17806d","wayback_url":null,"quote":"Alpaca: Active: EU-US Certification","confidence":1}]}],"brief":{"summary":"Alpaca states on its trust centre that it holds SOC 2 Type II, as of 18 Sep 2026. Alpaca also states on its trust centre that it meets GDPR and ISO 27001:2022, as of 18 Sep 2026. Alpaca is listed in the EU-US Data Privacy Framework registry with an active EU-US Certification, as of 17 Sep 2026. The EU-US Data Privacy Framework certification for Alpaca was issued 14 Nov 2025 and runs through 14 Nov 2026, as of 17 Sep 2026. No public evidence found for PCI DSS, FedRAMP, or HIPAA for Alpaca as of 18 Sep 2026.","bullets":["SOC 2 Type II, GDPR, ISO 27001:2022 - vendor-stated on trust centre, as of 18 Sep 2026.","EU-US Data Privacy Framework - listed in registry, active EU-US Certification through 14 Nov 2026.","EU-US Data Privacy Framework - certification issued 14 Nov 2025, as of 17 Sep 2026."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-19 11:19:03.207724+00"},"legal_docs":[{"kind":"privacy","url":"https://s3.amazonaws.com/files.alpaca.markets/disclosures/PrivacyPolicy.pdf","availability":"public","detail":null,"as_of":"2026-09-18"},{"kind":"security_txt","url":"https://trust.alpaca.markets/","availability":"public","detail":"Public documents on the trust centre: UK ICO Data Protection Certificate","as_of":"2026-09-18"}],"subprocessors":[],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-21T00:57:21.704Z"}