{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"bigcommerce","name":"BigCommerce","domain":"bigcommerce.com","category":"E-commerce","one_liner":"BigCommerce, founded in 2009, is a leading open software-as-a-service (SaaS) ecommerce platform that empowers merchants of all sizes to","trust_center_url":"https://security.bigcommerce.com/","security_page_url":null,"url":"https://certreports.com/vendors/bigcommerce/security","last_verified_at":"2026-09-18T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states SOC 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/soc-2","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"SOC 2","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/gdpr","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"pci-dss","framework_name":"PCI DSS","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Visa Global Registry of Service Providers as of 17 Sep 2026.","kind":"attestation","status_text":"Listed on the Visa Global Registry as PCI DSS validated through 2027-05-31","issued_at":"2011-11-04","expires_at":"2027-05-31","period_start":null,"period_end":null,"auditor":"Coalfire Systems, Inc","impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"visa_grsp","url":"https://certreports.com/vendors/bigcommerce/pci-dss","evidence":[{"source_type":"registry","source_name":"Visa Global Registry of Service Providers","url":"https://www.visa.com/splisting/","fetched_at":"2026-09-17 15:57:14.984433+00","content_hash":"71d0924cea0625f1ddc8221a61474a1c6250cbff2505e064e61cd3b1ff68a2ed","wayback_url":null,"quote":"BigCommerce Holdings Inc: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-05-31","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/iso-27001","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"ISO/IEC 27001:2022","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"verified_registry","state_label":"Verified","sentence":"Listed in the CSA STAR registry as of 17 Sep 2026.","kind":"self_assessment","status_text":"STAR Level 1 self-assessment (CAIQ)","issued_at":"2023-08-12","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/bigcommerce/csa-star","evidence":[{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/bigcommerce-inc","fetched_at":"2026-09-17 15:44:42.254747+00","content_hash":"e7f124247f5399c92ba048620a83c0b6cca1f9a2f97419f32566e462a3b1bda7","wayback_url":null,"quote":"bigcommerce inc: STAR Level 1 self-assessment (CAIQ)","confidence":1}]},{"framework":"iso-27701","framework_name":"ISO/IEC 27701","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27701 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27701 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/iso-27701","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"ISO/IEC 27701","confidence":1}]},{"framework":"iso-42001","framework_name":"ISO/IEC 42001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 42001 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 42001 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/iso-42001","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"ISO/IEC 42001","confidence":1}]},{"framework":"soc-1","framework_name":"SOC 1","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 1 Type II report on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states SOC 1 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/security","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"SOC 1","confidence":1}]},{"framework":"soc-3","framework_name":"SOC 3","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a public SOC 3 report on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states SOC 3 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/security","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"SOC 3","confidence":1}]},{"framework":"iso-27017","framework_name":"ISO/IEC 27017","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27017 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27017:2015 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/security","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"ISO/IEC 27017:2015","confidence":1}]},{"framework":"iso-27018","framework_name":"ISO/IEC 27018","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27018 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27018:2019 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/security","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"ISO/IEC 27018:2019","confidence":1}]},{"framework":"iso-22301","framework_name":"ISO 22301","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO 22301 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO 22301 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/security","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"ISO 22301","confidence":1}]},{"framework":"ccpa","framework_name":"CCPA / CPRA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an CCPA / CPRA privacy notice on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states CCPA on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/security","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"CCPA","confidence":1}]},{"framework":"txramp","framework_name":"TX-RAMP","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an TX-RAMP certification on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states TX-RAMP on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/bigcommerce/security","evidence":[{"source_type":"trust_center","source_name":"BigCommerce trust centre (Drata)","url":"https://security.bigcommerce.com/","fetched_at":"2026-09-18 22:41:38.136543+00","content_hash":"fc25d981e7604e1453b27d3699bf69dcac422fc0bb6be17132199a08e5ffc254","wayback_url":null,"quote":"TX-RAMP","confidence":1}]}],"brief":{"summary":"As of 17 Sep 2026, BigCommerce is listed in the Visa Global Registry as PCI DSS validated, with validation issued 4 Nov 2011 and expiring 31 May 2027, audited by Coalfire Systems, Inc. As of 17 Sep 2026, BigCommerce is listed in the CSA STAR registry with a Level 1 self-assessment (CAIQ) dated 12 Aug 2023. As of 17 Sep 2026, no public evidence found for SOC 2 for BigCommerce. As of 17 Sep 2026, no public evidence found for HIPAA for BigCommerce. As of 17 Sep 2026, no subprocessor records were found in the supplied evidence for BigCommerce.","bullets":["PCI DSS: listed in Visa Global Registry, validated through 31 May 2027 (issued 4 Nov 2011), auditor Coalfire Systems, Inc, as of 17 Sep 2026","CSA STAR: listed in CSA STAR registry, Level 1 self-assessment (CAIQ) dated 12 Aug 2023, as of 17 Sep 2026","SOC 2 and HIPAA: no public evidence found as of 17 Sep 2026"],"model":"claude-sonnet-5","generated_at":"2026-09-17 18:48:25.645649+00"},"legal_docs":[{"kind":"subprocessors","url":"https://security.bigcommerce.com/","availability":"public","detail":"3 subprocessors listed on the trust centre","as_of":"2026-09-18"}],"subprocessors":[{"name":"Cloud Platform","domain":null,"purpose":null,"location":null,"vendor_url":null},{"name":"Data Access Logging Infrastructure Google","domain":null,"purpose":null,"location":null,"vendor_url":null},{"name":"Vercel or are using Cloudflare","domain":null,"purpose":null,"location":null,"vendor_url":null}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-19T02:20:58.162Z"}