{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"anthropic","name":"Anthropic","domain":"anthropic.com","category":"AI infrastructure","one_liner":"Anthropic, PBC is an American artificial intelligence (AI) public benefit corporation headquartered in San Francisco, California","trust_center_url":"https://trust.anthropic.com/","security_page_url":null,"url":"https://certreports.com/vendors/anthropic/security","last_verified_at":"2026-09-19T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"hipaa","framework_name":"HIPAA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states that it will sign a business associate agreement on its trust centre (Vanta) as of 19 Sep 2026.","kind":null,"status_text":"Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-19","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/hipaa","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-19 07:32:57.415757+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"HIPAA","confidence":1}]},{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 19 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 2 Type II on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-19","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/soc-2","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-19 07:32:57.415757+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"SOC 2 Type II","confidence":1}]},{"framework":"fedramp","framework_name":"FedRAMP","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a FedRAMP authorization on its trust centre (Vanta) as of 19 Sep 2026.","kind":null,"status_text":"Vendor states FedRAMP High on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-19","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/fedramp","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-19 07:32:57.415757+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"FedRAMP High","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Vanta) as of 19 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-19","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-19 07:32:57.415757+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"ISO 27001:2022","confidence":1}]},{"framework":"cyber-essentials","framework_name":"Cyber Essentials","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an Cyber Essentials certificate on its trust centre (Vanta) as of 19 Sep 2026.","kind":null,"status_text":"Vendor states UK Cyber Essentials on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-19","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/cyber-essentials","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-19 07:32:57.415757+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"UK Cyber Essentials","confidence":1}]},{"framework":"iso-42001","framework_name":"ISO/IEC 42001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 42001 certificate on its trust centre (Vanta) as of 19 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 42001:2023 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-19","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/anthropic/iso-42001","evidence":[{"source_type":"trust_center","source_name":"Anthropic trust centre (Vanta)","url":"https://trust.anthropic.com/","fetched_at":"2026-09-19 07:32:57.415757+00","content_hash":"56686d5703926c834297d54e0ac09bcdc8442e4b68aa8deadf1fa11cc3ca2524","wayback_url":null,"quote":"ISO/IEC 42001:2023","confidence":1}]}],"brief":{"summary":"Anthropic states on its trust centre, as of 19 Sep 2026, that it has a SOC 2 Type II report. As of 19 Sep 2026, the vendor also states FedRAMP High on its trust centre. As of 19 Sep 2026, Anthropic states ISO/IEC 27001:2022 and ISO/IEC 42001:2023 on its trust centre. As of 19 Sep 2026, the vendor states UK Cyber Essentials on its trust centre. As of 19 Sep 2026, Anthropic displays a HIPAA badge on its trust centre, though BAA availability is not captured in the evidence.","bullets":["SOC 2 Type II and FedRAMP High: vendor states on its trust centre, as of 19 Sep 2026.","ISO/IEC 27001:2022, ISO/IEC 42001:2023, UK Cyber Essentials: vendor states on its trust centre, as of 19 Sep 2026.","HIPAA: vendor displays a badge on its trust centre as of 19 Sep 2026; BAA availability not captured in evidence."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-19 10:36:06.150024+00"},"legal_docs":[{"kind":"privacy","url":"https://console.anthropic.com/legal/privacy","availability":"public","detail":null,"as_of":"2026-09-19"},{"kind":"security_txt","url":"https://trust.anthropic.com/","availability":"public","detail":"Public documents on the trust centre: [Anthropic] 2025 Type 2 SOC 3 Report.pdf; [Anthropic] ISO 27001 Certificate (2025).pdf; [Anthropic] ISO 42001 Certificate (2025).pdf; [Anthropic Ireland Limited] Cyber Essentials Certificate (2025)","as_of":"2026-09-19"},{"kind":"subprocessors","url":"https://trust.anthropic.com/","availability":"public","detail":"20 subprocessors listed on the trust centre","as_of":"2026-09-19"}],"subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Cloud Infrastructure","location":"Worldwide","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Arkose Labs","domain":null,"purpose":"Fraud and abuse detection","location":"United States","vendor_url":null},{"name":"Boldr","domain":"boldrimpact.com","purpose":"User support","location":"Canada","vendor_url":null},{"name":"Brave Search","domain":"brave.com","purpose":"Web Search","location":"United States","vendor_url":null},{"name":"Cloudflare","domain":"cloudflare.com","purpose":"Traffic Routing (CDN)","location":"Worldwide (Local to Customer)","vendor_url":"https://certreports.com/vendors/cloudflare/security"},{"name":"ElevenLabs","domain":"elevenlabs.io","purpose":"Text to speech","location":"United States","vendor_url":"https://certreports.com/vendors/elevenlabs/security"},{"name":"Functional Software, dba Sentry","domain":"sentry.io","purpose":"Error Handling, User Support","location":"United States","vendor_url":"https://certreports.com/vendors/sentry/security"},{"name":"Google Cloud Platform","domain":"google.com","purpose":"Cloud infrastructure","location":"Worldwide","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"Intercom","domain":"intercom.com","purpose":"User support","location":"United States","vendor_url":"https://certreports.com/vendors/intercom/security"},{"name":"Iterable","domain":null,"purpose":"Email communications","location":"United States","vendor_url":null},{"name":"Microsoft Azure","domain":"azure.com","purpose":"Cloud Infrastructure","location":"Worldwide","vendor_url":null},{"name":"Nutun","domain":"nutun.com","purpose":"User support","location":"South Africa","vendor_url":null},{"name":"Palantir Federal Cloud Service (PFCS)","domain":null,"purpose":"FedRAMP Cloud","location":"United States","vendor_url":null},{"name":"Persona","domain":"withpersona.com","purpose":"Fraud and abuse detection, identity verification","location":"United States","vendor_url":"https://certreports.com/vendors/persona-identities/security"},{"name":"Sift","domain":"sift.com","purpose":"Fraud and abuse detection","location":"United States","vendor_url":"https://certreports.com/vendors/sift/security"},{"name":"Stripe","domain":"stripe.com","purpose":"Billing","location":"United States","vendor_url":"https://certreports.com/vendors/stripe/security"},{"name":"TurboPuffer","domain":"turbopuffer.com","purpose":"Web Search","location":"United States","vendor_url":null},{"name":"Twilio","domain":"twilio.com","purpose":"Analytics, email/SMS communications","location":"United States","vendor_url":"https://certreports.com/vendors/twilio/security"},{"name":"WorkOS","domain":"workos.com","purpose":"Security, Single Sign-On","location":"United States","vendor_url":null},{"name":"Yoti","domain":"yoti.com","purpose":"Fraud and abuse detection, identity verification","location":"United Kingdom","vendor_url":null}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-19T15:46:02.819Z"}