{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"expensify","name":"Expensify","domain":"expensify.com","category":"Finance and accounting","one_liner":"Expensify, Inc. is an American software company that develops an expense management system for personal and business use","trust_center_url":"https://trust.expensify.com/","security_page_url":null,"url":"https://certreports.com/vendors/expensify/security","last_verified_at":"2026-09-18T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states SOC 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/expensify/soc-2","evidence":[{"source_type":"trust_center","source_name":"Expensify trust centre (Vanta)","url":"https://trust.expensify.com/","fetched_at":"2026-09-18 23:03:50.906573+00","content_hash":"adc3e9912f1dee1379a54e59ce67dd8dafb1f4666e438cf8a9104e519ba18325","wayback_url":null,"quote":"SOC 2","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/expensify/gdpr","evidence":[{"source_type":"trust_center","source_name":"Expensify trust centre (Vanta)","url":"https://trust.expensify.com/","fetched_at":"2026-09-18 23:03:50.906573+00","content_hash":"adc3e9912f1dee1379a54e59ce67dd8dafb1f4666e438cf8a9104e519ba18325","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"pci-dss","framework_name":"PCI DSS","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a PCI DSS attestation of compliance on its trust centre (Vanta) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states PCI DSS 4.0.1 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/expensify/pci-dss","evidence":[{"source_type":"trust_center","source_name":"Expensify trust centre (Vanta)","url":"https://trust.expensify.com/","fetched_at":"2026-09-18 23:03:50.906573+00","content_hash":"adc3e9912f1dee1379a54e59ce67dd8dafb1f4666e438cf8a9104e519ba18325","wayback_url":null,"quote":"PCI DSS 4.0.1","confidence":1}]},{"framework":"soc-1","framework_name":"SOC 1","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 1 Type II report on its trust centre (Vanta) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states SOC 1 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/expensify/security","evidence":[{"source_type":"trust_center","source_name":"Expensify trust centre (Vanta)","url":"https://trust.expensify.com/","fetched_at":"2026-09-18 23:03:50.906573+00","content_hash":"adc3e9912f1dee1379a54e59ce67dd8dafb1f4666e438cf8a9104e519ba18325","wayback_url":null,"quote":"SOC 1","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 17 Sep 2026.","kind":"listing","status_text":"Active: UK Extension Certification, SW-US Certification, EU-US Certification","issued_at":"2016-11-29","expires_at":"2027-01-14","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/expensify/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/4755","fetched_at":"2026-09-17 15:48:38.979308+00","content_hash":"5fed0cb43d842fb9e4bc7f43e854806b975f3ff9a51b325a8972042ae0007b18","wayback_url":null,"quote":"Expensify, Inc.: Active: UK Extension Certification, SW-US Certification, EU-US Certification","confidence":1}]},{"framework":"ccpa","framework_name":"CCPA / CPRA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an CCPA / CPRA privacy notice on its trust centre (Vanta) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states CCPA on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/expensify/security","evidence":[{"source_type":"trust_center","source_name":"Expensify trust centre (Vanta)","url":"https://trust.expensify.com/","fetched_at":"2026-09-18 23:03:50.906573+00","content_hash":"adc3e9912f1dee1379a54e59ce67dd8dafb1f4666e438cf8a9104e519ba18325","wayback_url":null,"quote":"CCPA","confidence":1}]}],"brief":null,"legal_docs":[{"kind":"privacy","url":"https://expensify.com/privacy","availability":"public","detail":null,"as_of":"2026-09-18"},{"kind":"subprocessors","url":"https://trust.expensify.com/","availability":"public","detail":"32 subprocessors listed on the trust centre","as_of":"2026-09-18"}],"subprocessors":[{"name":"Airship","domain":null,"purpose":"Customer Notification Delivery","location":"US","vendor_url":null},{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Cloud Infrastructure Provider","location":"US","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Ashby","domain":"ashbyhq.com","purpose":"Recruiting","location":"US","vendor_url":"https://certreports.com/vendors/ashby/security"},{"name":"Calendly","domain":null,"purpose":"Meeting Scheduling","location":"US","vendor_url":null},{"name":"Checkbook","domain":null,"purpose":"Payment Processor","location":"US","vendor_url":null},{"name":"Clearbit","domain":null,"purpose":"Account Configuration","location":"US","vendor_url":null},{"name":"CloudFactory","domain":null,"purpose":"Receipt Scanning","location":"Nepal","vendor_url":null},{"name":"Cloudflare","domain":"cloudflare.com","purpose":"Cloud Security and Infrastructure","location":"US; Globally for CDN","vendor_url":"https://certreports.com/vendors/cloudflare/security"},{"name":"Cloudtask","domain":null,"purpose":"Sales and Support","location":"US","vendor_url":null},{"name":"Collective Solutions","domain":null,"purpose":"Receipt Scanning","location":"Honduras","vendor_url":null},{"name":"DocuSign","domain":"docusign.com","purpose":"Document Management","location":"US","vendor_url":"https://certreports.com/vendors/docusign/security"},{"name":"Evocative","domain":null,"purpose":"Data Center Provider","location":"US","vendor_url":null},{"name":"FullStory","domain":"fullstory.com","purpose":"Product and design","location":null,"vendor_url":"https://certreports.com/vendors/fullstory/security"},{"name":"GitHub","domain":"github.com","purpose":"Version Control","location":"US","vendor_url":null},{"name":"Gong","domain":"gong.io","purpose":"Sales","location":null,"vendor_url":null},{"name":"Google Drive","domain":"google.com","purpose":"Document management","location":"US","vendor_url":null},{"name":"Google Workspace","domain":"google.com","purpose":"Identity provider","location":"US","vendor_url":null},{"name":"HubSpot","domain":"hubspot.com","purpose":"CRM","location":"US","vendor_url":"https://certreports.com/vendors/hubspot/security"},{"name":"Ketch Privacy Orchestrator","domain":"ketch.com","purpose":"Privacy rights management","location":"US","vendor_url":null},{"name":"Mailgun","domain":"mailgun.com","purpose":"Email sending","location":"US","vendor_url":"https://certreports.com/vendors/mailgun/security"},{"name":"OpenAI","domain":"openai.com","purpose":"LLM model provider","location":"US","vendor_url":"https://certreports.com/vendors/openai/security"},{"name":"Plaid","domain":"plaid.com","purpose":"Transaction import","location":"US;EU;UK","vendor_url":null},{"name":"Sentry","domain":"sentry.io","purpose":"Application monitoring","location":"US","vendor_url":null},{"name":"Slack","domain":"slack.com","purpose":"Internal chat system","location":"US","vendor_url":"https://certreports.com/vendors/slack-technologies/security"},{"name":"Stripe","domain":"stripe.com","purpose":"Credit card billing","location":"US","vendor_url":"https://certreports.com/vendors/stripe/security"},{"name":"Switch","domain":null,"purpose":"Data Center Provider","location":"US","vendor_url":null},{"name":"The Bancorp Bank, N.A.","domain":null,"purpose":"Payment Processor","location":"US","vendor_url":null},{"name":"Twilio","domain":"twilio.com","purpose":"Text message provider","location":"US","vendor_url":"https://certreports.com/vendors/twilio/security"},{"name":"Typeform","domain":"typeform.com","purpose":"Customer questionnaires","location":"US","vendor_url":null},{"name":"Vanta","domain":"vanta.com","purpose":"Security","location":"US","vendor_url":"https://certreports.com/vendors/vanta/security"},{"name":"Zapier","domain":"zapier.com","purpose":"Internal automation system","location":"US","vendor_url":"https://certreports.com/vendors/zapier/security"},{"name":"Zoom","domain":"zoom.com","purpose":"Video conferencing","location":"US","vendor_url":"https://certreports.com/vendors/zoom/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-19T02:21:53.671Z"}