{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"anthropic","name":"Anthropic","domain":"anthropic.com","category":"AI infrastructure","one_liner":"Anthropic, PBC is an American artificial intelligence (AI) public benefit corporation headquartered in San Francisco, California","trust_center_url":"https://trust.anthropic.com/","security_page_url":null,"url":"https://certreports.com/vendors/anthropic/security","last_verified_at":"2026-11-04T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"hipaa","framework_name":"HIPAA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states that it will sign a business associate agreement on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/hipaa","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-21 22:56:53.095838+00","content_hash":"086922fd6aa01b3b788625f161380bb879790b1373aabb7ee0413456b1efd322","wayback_url":null,"quote":"HIPAA","confidence":1},{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-20 00:42:16.109449+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"HIPAA","confidence":1}]},{"framework":"soc-2","framework_name":"SOC 2","state":"verified_auditor","state_label":"Verified","sentence":"Confirmed by the public SOC 3 report for the period ending 30 Sep 2025, as of 4 Nov 2026.","kind":"type2","status_text":"Evidenced by the public SOC 3 report for the same examination period","issued_at":"2025-11-12","expires_at":null,"period_start":"2024-10-01","period_end":"2025-09-30","auditor":null,"impact_level":null,"as_of":"2026-11-04","under_review":false,"source":"soc3","url":"https://certreports.com/vendors/anthropic/soc-2","evidence":[{"source_type":"auditor","source_name":"Anthropic SOC 3 report (trust.anthropic.com)","url":"https://trust.anthropic.com/doc/trust?rid=6925de671c0c91e594eed26b&r=iz673w96495gyjer8h78n&view=true","fetched_at":"2026-10-26 02:01:31.883505+00","content_hash":"4a2eec78000029cc5ce1f1f22ed9e79b221832ff3a4964a6c7f459507d96185b","wayback_url":null,"quote":"In our opinion, management's assertion that the controls within Anthropic's AI Services system were effective throughout the period October 1, 2024 , through September 30, 2025, to provide reasonable assurance that Anthropic's service commitments and system requirements were achieved based on the applicable trust services criteria is fairly stated, in all material respects.","confidence":0.9}]},{"framework":"fedramp","framework_name":"FedRAMP","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a FedRAMP authorization on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states FedRAMP High on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/fedramp","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-21 22:56:53.095838+00","content_hash":"086922fd6aa01b3b788625f161380bb879790b1373aabb7ee0413456b1efd322","wayback_url":null,"quote":"FedRAMP High","confidence":1},{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-20 00:42:16.109449+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"FedRAMP High","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-21 22:56:53.095838+00","content_hash":"086922fd6aa01b3b788625f161380bb879790b1373aabb7ee0413456b1efd322","wayback_url":null,"quote":"ISO 27001:2022","confidence":1},{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-20 00:42:16.109449+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"ISO 27001:2022","confidence":1}]},{"framework":"cyber-essentials","framework_name":"Cyber Essentials","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an Cyber Essentials certificate on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states UK Cyber Essentials on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/cyber-essentials","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-21 22:56:53.095838+00","content_hash":"086922fd6aa01b3b788625f161380bb879790b1373aabb7ee0413456b1efd322","wayback_url":null,"quote":"UK Cyber Essentials","confidence":1},{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-20 00:42:16.109449+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"UK Cyber Essentials","confidence":1}]},{"framework":"iso-42001","framework_name":"ISO/IEC 42001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 42001 certificate on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 42001:2023 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/iso-42001","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-21 22:56:53.095838+00","content_hash":"086922fd6aa01b3b788625f161380bb879790b1373aabb7ee0413456b1efd322","wayback_url":null,"quote":"ISO/IEC 42001:2023","confidence":1},{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-20 00:42:16.109449+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"ISO/IEC 42001:2023","confidence":1}]},{"framework":"soc-3","framework_name":"SOC 3","state":"verified_auditor","state_label":"Verified","sentence":"Confirmed by the public SOC 3 report for the period ending 30 Sep 2025, as of 4 Nov 2026.","kind":"type2","status_text":"Public SOC 3 report on the vendor's trust centre","issued_at":"2025-11-12","expires_at":null,"period_start":"2024-10-01","period_end":"2025-09-30","auditor":null,"impact_level":null,"as_of":"2026-11-04","under_review":false,"source":"soc3","url":"https://certreports.com/vendors/anthropic/security","evidence":[{"source_type":"auditor","source_name":"Anthropic SOC 3 report (trust.anthropic.com)","url":"https://trust.anthropic.com/doc/trust?rid=6925de671c0c91e594eed26b&r=iz673w96495gyjer8h78n&view=true","fetched_at":"2026-10-26 02:01:31.883505+00","content_hash":"4a2eec78000029cc5ce1f1f22ed9e79b221832ff3a4964a6c7f459507d96185b","wayback_url":null,"quote":"In our opinion, management's assertion that the controls within Anthropic's AI Services system were effective throughout the period October 1, 2024 , through September 30, 2025, to provide reasonable assurance that Anthropic's service commitments and system requirements were achieved based on the applicable trust services criteria is fairly stated, in all material respects.","confidence":0.95}]}],"brief":{"summary":"Anthropic has a SOC 2 Type II report, evidenced by a SOC 3 report issued 12 Nov 2025 for the period ending 30 Sep 2025, confirmed as of 29 Sep 2026. The vendor states on its trust centre a HIPAA badge as of 21 Sep 2026, though BAA availability is not confirmed in the evidence. Anthropic also states FedRAMP High on its trust centre as of 21 Sep 2026; this is a vendor statement, not a registry listing. It states ISO/IEC 27001:2022, ISO/IEC 42001:2023 and UK Cyber Essentials on its trust centre, all as of 21 Sep 2026. Only the SOC 2 and SOC 3 evidence is independently audited; the remaining frameworks rely on Anthropic's own trust centre statements dated 21 Sep 2026.","bullets":["SOC 2 Type II: evidenced by SOC 3 report, issued 12 Nov 2025, period ending 30 Sep 2025, confirmed as of 29 Sep 2026.","FedRAMP High: vendor-stated on trust centre as of 21 Sep 2026 (not a registry listing in these rows).","HIPAA badge, ISO/IEC 27001:2022, ISO/IEC 42001:2023 and UK Cyber Essentials: vendor-stated on trust centre as of 21 Sep 2026; HIPAA BAA availability not confirmed."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-29 03:18:14.310704+00"},"legal_docs":[{"kind":"security_txt","url":"https://trust.anthropic.com/","availability":"public","detail":"Public documents on the trust centre: [Anthropic] 2025 Type 2 SOC 3 Report.pdf; [Anthropic] ISO 27001 Certificate (2025).pdf; [Anthropic] ISO 42001 Certificate (2025).pdf; [Anthropic Ireland Limited] Cyber Essentials Certificate (2025)","as_of":"2026-09-19"},{"kind":"subprocessors","url":"https://trust.anthropic.com/","availability":"public","detail":"20 subprocessors listed on the trust centre","as_of":"2026-09-21"},{"kind":"privacy","url":"https://console.anthropic.com/legal/privacy","availability":"public","detail":null,"as_of":"2026-09-21"},{"kind":"ai_policy","url":"https://trust.anthropic.com/","availability":"public","detail":"Listed on the trust centre as \"Anthropic Frontier Compliance Framework\"","as_of":"2026-09-21"}],"documents":[{"type":"ai_policy","title":"Anthropic Frontier Compliance Framework","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"architecture_diagram","title":"[Anthropic] - Infrastructure Diagram - April 2025","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"architecture_diagram","title":"Claude Cowork Desktop Security Architecture Overview","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"architecture_diagram","title":"Claude for Excel, Powerpoint, Word: Architecture Overview (Anthropic first party)","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"architecture_diagram","title":"Claude for Excel, Powerpoint, Word: Architecture Overview (Third party platforms)","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"architecture_diagram","title":"Microsoft 365 connector for Claude: architecture and data flows","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"bridge_letter","title":"[Anthropic] 2026 SOC 2 Bridge Letter.pdf","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"hipaa_report","title":"[Anthropic] 2025 Type 1 HIPAA - Report (C4E).pdf","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"hipaa_report","title":"[Anthropic] 2025 Type 1 HIPAA Report (1P API).pdf","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"iso_certificate","title":"[Anthropic] ISO 27001 Certificate (2025).pdf","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"iso_certificate","title":"[Anthropic] ISO 42001 Certificate (2025).pdf","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"iso_soa","title":"[Anthropic] - ISO Statement of Applicability","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"AB 2013 Training Data Summary","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Mythos 5 + Fable 5 Model Documentation Form","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Mythos 5 and Claude Fable 5 Training Data Summary","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Mythos 5.1 & Fable 5.1 Model Documentation Form","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Mythos 5.1 & Fable 5.1 Training Data Summary","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Mythos Preview Model Documentation Form","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Mythos Preview Training Data Summary","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Opus 4.7 Model Documentation Form","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Opus 4.7 Training Data Summary","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Opus 4.8 Model Documentation Form","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Opus 4.8 Training Data Summary","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Opus 5 Model Documentation Form","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Opus 5 Training Data Summary","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Sonnet 5 Model Documentation Form","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"model_documentation","title":"Claude Sonnet 5 Training Data Summary","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"[Anthropic] 2025 Annual Penetration Testing Reports","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"questionnaire","title":"[Anthropic] - CAIQ Full (June 2026)","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"questionnaire","title":"[Anthropic] - HECVAT v4.1.6 (June 2026)","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"questionnaire","title":"[Anthropic] - SIG Lite (June 2026)","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"questionnaire","title":"[Anthropic] - VSA Core (June 2026)","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"[Anthropic] CMEK - Cryptographic Design Whitepaper","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"[Anthropic] Identity & Access Controls","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Claude Desktop Security Overview (Third-party platforms)","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"[Anthropic] 2025 Type 2 SOC 2 and CSA STAR L2 Report.pdf","availability":"on_request","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"soc3_report","title":"[Anthropic] 2025 Type 2 SOC 3 Report.pdf","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"vpat","title":"[Anthropic] VPAT - Accessibility Conformance Report (ACR) - Claude Enterprise Android app","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"vpat","title":"[Anthropic] VPAT - Accessibility Conformance Report (ACR) - Claude Enterprise iOS app","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"},{"type":"vpat","title":"[Anthropic] VPAT - Accessibility Conformance Report (ACR) - Claude.ai Enterprise (web)","availability":"public","source_url":"https://trust.anthropic.com/","last_seen":"2026-09-21"}],"statements":[{"topic":"data_location","question":"Where are your data centers located?","answer":"For more information, please view this post.","value":null,"regions":[],"source_url":"https://trust.anthropic.com/faq?s=x9fqw5wvl0m3xrqey5u6wx","as_of":"2026-09-21"},{"topic":"model_training","question":"Will you be using our Claude for Work conversations to train your generative models?","answer":"No. By default, we will not use your chats or coding sessions when using our Commercial products (Claude for Work, Anthropic API, etc.). If you provide feedback or otherwise explicitly opt-in to training, then we may use those materials to train our models. Learn more about disabling feedback for your Claude for Enterprise plan here.","value":"no","regions":[],"source_url":"https://trust.anthropic.com/faq?s=mi6pavinewvqliehrrk41x","as_of":"2026-09-21"}],"security_profile":{"iso42001":true,"trains_on_customer_data":"no","data_residency_regions":[],"pen_test_cadence":"annual","as_of":"2026-09-21"},"regulations_url":"https://certreports.com/api/v1/vendors/anthropic/regulations/{regulation}","subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Cloud Infrastructure","location":"Worldwide","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Arkose Labs","domain":null,"purpose":"Fraud and abuse detection","location":"United States","vendor_url":null},{"name":"Boldr","domain":"boldrimpact.com","purpose":"User support","location":"Canada","vendor_url":null},{"name":"Brave Search","domain":"brave.com","purpose":"Web Search","location":"United States","vendor_url":null},{"name":"Cloudflare","domain":"cloudflare.com","purpose":"Traffic Routing (CDN)","location":"Worldwide (Local to Customer)","vendor_url":"https://certreports.com/vendors/cloudflare/security"},{"name":"ElevenLabs","domain":"elevenlabs.io","purpose":"Text to speech","location":"United States","vendor_url":"https://certreports.com/vendors/elevenlabs/security"},{"name":"Functional Software, dba Sentry","domain":"sentry.io","purpose":"Error Handling, User Support","location":"United States","vendor_url":"https://certreports.com/vendors/sentry/security"},{"name":"Google Cloud Platform","domain":"google.com","purpose":"Cloud infrastructure","location":"Worldwide","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"Intercom","domain":"intercom.com","purpose":"User support","location":"United States","vendor_url":"https://certreports.com/vendors/intercom/security"},{"name":"Iterable","domain":null,"purpose":"Email communications","location":"United States","vendor_url":null},{"name":"Microsoft Azure","domain":"azure.com","purpose":"Cloud Infrastructure","location":"Worldwide","vendor_url":null},{"name":"Nutun","domain":"nutun.com","purpose":"User support","location":"South Africa","vendor_url":null},{"name":"Palantir Federal Cloud Service (PFCS)","domain":null,"purpose":"FedRAMP Cloud","location":"United States","vendor_url":null},{"name":"Persona","domain":"withpersona.com","purpose":"Fraud and abuse detection, identity verification","location":"United States","vendor_url":"https://certreports.com/vendors/persona-identities/security"},{"name":"Sift","domain":"sift.com","purpose":"Fraud and abuse detection","location":"United States","vendor_url":"https://certreports.com/vendors/sift/security"},{"name":"Stripe","domain":"stripe.com","purpose":"Billing","location":"United States","vendor_url":"https://certreports.com/vendors/stripe/security"},{"name":"TurboPuffer","domain":"turbopuffer.com","purpose":"Web Search","location":"United States","vendor_url":null},{"name":"Twilio","domain":"twilio.com","purpose":"Analytics, email/SMS communications","location":"United States","vendor_url":"https://certreports.com/vendors/twilio/security"},{"name":"WorkOS","domain":"workos.com","purpose":"Security, Single Sign-On","location":"United States","vendor_url":null},{"name":"Yoti","domain":"yoti.com","purpose":"Fraud and abuse detection, identity verification","location":"United Kingdom","vendor_url":null}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-04T19:17:18.987Z"}