{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"digication","name":"Digication","domain":"digication.com","category":"Education","one_liner":"AI-powered platform giving institutions the assessment data, accreditation evidence, and student retention signals needed to make learning","trust_center_url":"https://trust.digication.com/","security_page_url":null,"url":"https://certreports.com/vendors/digication/security","last_verified_at":"2026-11-02T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states SOC 2 (Coming soon) on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/digication/soc-2","evidence":[{"source_type":"trust_center","source_name":"Digication trust centre (Vanta)","url":"https://trust.digication.com/","fetched_at":"2026-09-21 22:36:44.812592+00","content_hash":"0910644a580b4de687ca3d9d11de37a794a59f84c996d24d1ece4aeb70551dad","wayback_url":null,"quote":"SOC 2 (Coming soon)","confidence":1},{"source_type":"trust_center","source_name":"Digication trust centre (Vanta)","url":"https://trust.digication.com/","fetched_at":"2026-09-18 23:07:52.398082+00","content_hash":"15bc4f503fa95b8981817e8bcb4789f87fbc9c49d8d489a78cea68c05c5d7991","wayback_url":null,"quote":"SOC 2 (Coming soon)","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/digication/gdpr","evidence":[{"source_type":"trust_center","source_name":"Digication trust centre (Vanta)","url":"https://trust.digication.com/","fetched_at":"2026-09-21 22:36:44.812592+00","content_hash":"0910644a580b4de687ca3d9d11de37a794a59f84c996d24d1ece4aeb70551dad","wayback_url":null,"quote":"GDPR","confidence":1},{"source_type":"trust_center","source_name":"Digication trust centre (Vanta)","url":"https://trust.digication.com/","fetched_at":"2026-09-18 23:07:52.398082+00","content_hash":"15bc4f503fa95b8981817e8bcb4789f87fbc9c49d8d489a78cea68c05c5d7991","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"expired","state_label":"Expired","sentence":"Certificate expiry unknown date passed; no renewal found as of 2 Nov 2026.","kind":"listing","status_text":"Inactive","issued_at":"2020-12-04","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-11-02","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/digication/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/8611","fetched_at":"2026-11-02 05:03:27.221339+00","content_hash":"fe9e6922afa17bced6d144c3a82a28b436d5d6633cdd878e10cb06ed765eff44","wayback_url":null,"quote":"Digication, Inc.: Inactive","confidence":1}]}],"brief":null,"legal_docs":[{"kind":"subprocessors","url":"https://trust.digication.com/","availability":"public","detail":"15 subprocessors listed on the trust centre","as_of":"2026-09-21"},{"kind":"privacy","url":"https://www.digication.com/policies/privacy-policy","availability":"public","detail":null,"as_of":"2026-09-21"}],"documents":[{"type":"business_continuity","title":"Digication Business Continuity and Disaster Recovery Plan","availability":"on_request","source_url":"https://trust.digication.com/","last_seen":"2026-09-21"},{"type":"incident_response","title":"Digication Incident Response Plan","availability":"on_request","source_url":"https://trust.digication.com/","last_seen":"2026-09-21"},{"type":"questionnaire","title":"Digication HECVAT","availability":"on_request","source_url":"https://trust.digication.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Digication Information Security Policy","availability":"on_request","source_url":"https://trust.digication.com/","last_seen":"2026-09-21"}],"statements":[{"topic":"data_location","question":"Where is Digication's infrastructure hosted?","answer":"Our infrastructure is hosted on Amazon Web Services (AWS) in the United States, providing enterprise-grade security, reliability, and compliance capabilities.","value":null,"regions":["US"],"source_url":"https://trust.digication.com/faq?s=o1mtbx58c5rzdm9fm8of","as_of":"2026-09-21"},{"topic":"retention","question":"How long does Digication retain customer data?","answer":"Data retention periods depend on the type of data and applicable legal requirements: - Active account data: Retained while accounts are active - Inactive account data: Retained according to institutional agreements - Deleted account data: Purged within 90 days of deletion request - Backup data: Retained for disaster recovery (automatically purged on rolling basis) - Data following contract termination: deleted within 90 days of the termination date, unless the institution requests an export or a different arrangement is agreed. Specific retention details are outlined in our Privacy Policy and service agreements.","value":null,"regions":[],"source_url":"https://trust.digication.com/faq?s=u33hxq8nzc4adb10hnq2u2","as_of":"2026-09-21"},{"topic":"retention","question":"Can users request deletion of their data?","answer":"Yes, in accordance with GDPR and other privacy regulations, data subjects have the right to request deletion of their personal data. Submit deletion requests to trust@digication.com. Institutions should contact us to coordinate student data deletion in compliance with their own policies.","value":null,"regions":[],"source_url":"https://trust.digication.com/faq?s=97w9xh8p3gdaq4w656e14c","as_of":"2026-09-21"},{"topic":"retention","question":"Is my data safe from accidental deletion?","answer":"Yes. We employ a \"Defense in Depth\" approach to data safety. We enforce strict \"Deletion Protection\" on our databases to prevent accidental termination and utilize \"Versioning\" on our file storage systems to preserve a history of all changes. This ensures that even if a file is overwritten or deleted, the prior version remains retrievable for the versioning retention period (30–90 days depending on the bucket).","value":null,"regions":[],"source_url":"https://trust.digication.com/faq?s=qc8bu6law9lvhzny5ji0p","as_of":"2026-09-21"},{"topic":"subprocessor_changes","question":"Will Digication notify customers of subprocessor changes?","answer":"Yes, we maintain an updated subprocessor list on our Trust Center and will notify institutional customers of material changes to our subprocessor arrangements.","value":null,"regions":[],"source_url":"https://trust.digication.com/faq?s=nlrhk0qqu9f32bi6d3vzs2","as_of":"2026-09-21"}],"security_profile":{"iso42001":null,"trains_on_customer_data":null,"data_residency_regions":["US"],"pen_test_cadence":null,"as_of":"2026-09-21"},"regulations_url":"https://certreports.com/api/v1/vendors/digication/regulations/{regulation}","subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Cloud Infrastructure","location":"US","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Anthropic","domain":"anthropic.com","purpose":"AI assistant and text generation","location":"US","vendor_url":"https://certreports.com/vendors/anthropic/security"},{"name":"Brightcove Zencoder","domain":"brightcove.com","purpose":"Media Processing","location":"US","vendor_url":"https://certreports.com/vendors/brightcove/security"},{"name":"Elastic","domain":"elastic.co","purpose":"Application Monitoring","location":null,"vendor_url":"https://certreports.com/vendors/elastic/security"},{"name":"Embedly","domain":"embed.ly","purpose":"Content embedding","location":null,"vendor_url":"https://certreports.com/vendors/embedly/security"},{"name":"Filestack","domain":"filestack.com","purpose":"File Management","location":null,"vendor_url":null},{"name":"Google Cloud","domain":"google.com","purpose":"Third-party authentication, and AI feature","location":"US","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"Hubspot","domain":"hubspot.com","purpose":"CRM","location":null,"vendor_url":"https://certreports.com/vendors/hubspot/security"},{"name":"Incommon / Shibboleth","domain":"incommon.org","purpose":"Identity Federation","location":null,"vendor_url":null},{"name":"Okta","domain":"okta.com","purpose":"Identity Management","location":null,"vendor_url":"https://certreports.com/vendors/okta/security"},{"name":"OpenAI","domain":"openai.com","purpose":"AI assistant and text generation","location":null,"vendor_url":"https://certreports.com/vendors/openai/security"},{"name":"Sendgrid","domain":"sendgrid.com","purpose":"Email Delivery Services","location":"US","vendor_url":"https://certreports.com/vendors/sendgrid/security"},{"name":"Stripe","domain":"stripe.com","purpose":"Payment Processing","location":"US","vendor_url":"https://certreports.com/vendors/stripe/security"},{"name":"TaxJar","domain":"taxjar.com","purpose":"Tax Compliance","location":"US","vendor_url":"https://certreports.com/vendors/taxjar/security"},{"name":"Zendesk","domain":"zendesk.com","purpose":"Customer support & service","location":null,"vendor_url":"https://certreports.com/vendors/zendesk/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-03T09:04:50.995Z"}