{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"float","name":"float","domain":"float.com","category":"Project management","one_liner":"The #1 rated resource management","trust_center_url":"https://trust.float.com/","security_page_url":null,"url":"https://certreports.com/vendors/float/security","last_verified_at":"2026-11-02T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type I report on its trust centre (Vanta) as of 30 Sep 2026.","kind":"type1","status_text":"Vendor states SOC 2 Type I on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/float/soc-2","evidence":[{"source_type":"trust_center","source_name":"float trust centre (Vanta)","url":"https://trust.float.com/","fetched_at":"2026-09-29 02:07:06.391282+00","content_hash":"a8cb25716a11557277bdf82891432e284566b7fc0471495fcc7c6a577133322d","wayback_url":null,"quote":"SOC 2 Type I","confidence":1},{"source_type":"trust_center","source_name":"float trust centre (Vanta)","url":"https://trust.float.com/","fetched_at":"2026-09-18 23:04:27.742994+00","content_hash":"f97d83663c35e7ed001c0a19d2291b985f8fe9485398244ecba776d9baf2b9e2","wayback_url":null,"quote":"SOC 2 Type I","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 30 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/float/gdpr","evidence":[{"source_type":"trust_center","source_name":"float trust centre (Vanta)","url":"https://trust.float.com/","fetched_at":"2026-09-29 02:07:06.391282+00","content_hash":"a8cb25716a11557277bdf82891432e284566b7fc0471495fcc7c6a577133322d","wayback_url":null,"quote":"GDPR","confidence":1},{"source_type":"trust_center","source_name":"float trust centre (Vanta)","url":"https://trust.float.com/","fetched_at":"2026-09-18 23:04:27.742994+00","content_hash":"f97d83663c35e7ed001c0a19d2291b985f8fe9485398244ecba776d9baf2b9e2","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 2 Nov 2026.","kind":"listing","status_text":"Active: SW-US Certification, EU-US Certification","issued_at":"2019-03-10","expires_at":"2027-10-14","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-11-02","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/float/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/955","fetched_at":"2026-11-02 05:00:25.974776+00","content_hash":"d72f6d05a6d90613ff1c8da71706062a3359ca1f796bef529cff56998c2e4c7a","wayback_url":null,"quote":"Pixel Paddock LLC (DBA Float): Active: SW-US Certification, EU-US Certification","confidence":1},{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/955","fetched_at":"2026-10-12 05:00:26.175907+00","content_hash":"8cee8e9efa4b683f883607fc46de5ad2e429b250dd8b4f9eca01fa405fafa963","wayback_url":null,"quote":"Pixel Paddock LLC (DBA Float): Inactive","confidence":1}]}],"brief":{"summary":"float states on its trust centre that it has a SOC 2 Type I report, as of 30 Sep 2026. float states on its trust centre that it addresses GDPR, as of 30 Sep 2026. float is listed in the EU-US Data Privacy Framework registry as active for SW-US Certification and EU-US Certification, issued 10 Mar 2019 and expiring 14 Oct 2027, as of 19 Oct 2026. No public evidence found for PCI DSS as of 19 Oct 2026, so no PCI DSS listing is confirmed. No public evidence found for HIPAA as of 19 Oct 2026, so no BAA offering is confirmed.","bullets":["SOC 2: vendor states SOC 2 Type I report on its trust centre (as of 30 Sep 2026)","GDPR: vendor states on its trust centre (as of 30 Sep 2026)","EU-US DPF: listed as active, issued 10 Mar 2019, expires 14 Oct 2027 (as of 19 Oct 2026)"],"model":"claude-sonnet-5","generated_at":"2026-10-19 05:48:38.77931+00"},"legal_docs":[{"kind":"dpa","url":"https://trust.float.com/","availability":"public","detail":"Listed on the trust centre as \"Data Processing Agreement\"","as_of":"2026-09-30"},{"kind":"subprocessors","url":"https://trust.float.com/","availability":"public","detail":"19 subprocessors listed on the trust centre","as_of":"2026-09-30"},{"kind":"privacy","url":"https://www.float.com/privacy/","availability":"public","detail":null,"as_of":"2026-09-30"}],"documents":[{"type":"dpa","title":"Data Processing Agreement","availability":"public","source_url":"https://trust.float.com/","last_seen":"2026-09-30"},{"type":"pentest_report","title":"Annual Pen Test","availability":"on_request","source_url":"https://trust.float.com/","last_seen":"2026-09-30"},{"type":"soc2_report","title":"SOC2 Type 1","availability":"on_request","source_url":"https://trust.float.com/","last_seen":"2026-09-30"}],"statements":[],"security_profile":{"iso42001":null,"trains_on_customer_data":null,"data_residency_regions":[],"pen_test_cadence":"annual","as_of":"2026-09-30"},"regulations_url":"https://certreports.com/api/v1/vendors/float/regulations/{regulation}","subprocessors":[{"name":"Aiven","domain":"aiven.io","purpose":"Data storage and streaming for application operations","location":"United States","vendor_url":null},{"name":"Amplitude","domain":"amplitude.com","purpose":"Data analytics","location":null,"vendor_url":"https://certreports.com/vendors/amplitude/security"},{"name":"Anthropic","domain":"anthropic.com","purpose":"Used for data analysis","location":"US","vendor_url":"https://certreports.com/vendors/anthropic/security"},{"name":"AWS","domain":"aws.com","purpose":"Cloud provider","location":null,"vendor_url":null},{"name":"Braintree","domain":"braintreepayments.com","purpose":"Used for taking payments for Float.","location":"United States","vendor_url":"https://certreports.com/vendors/braintree/security"},{"name":"CloudAQMP","domain":"cloudamqp.com","purpose":"Data streaming for platform operation","location":"United States","vendor_url":null},{"name":"Datadog","domain":"datadoghq.com","purpose":"Used for platform operation stability monitoring.","location":"United States","vendor_url":"https://certreports.com/vendors/datadog/security"},{"name":"Gong","domain":"gong.io","purpose":"Sales engagement management","location":"United States","vendor_url":"https://certreports.com/vendors/gong/security"},{"name":"Google Cloud Platform","domain":"google.com","purpose":"Application operation","location":"United States","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"Google Workspace","domain":"google.com","purpose":"Emails and documentation","location":"United States","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"HubSpot","domain":"hubspot.com","purpose":"Marketing","location":null,"vendor_url":"https://certreports.com/vendors/hubspot/security"},{"name":"Intercom","domain":"intercom.com","purpose":"Support operations","location":"United States","vendor_url":"https://certreports.com/vendors/intercom/security"},{"name":"Launch Darkly","domain":"launchdarkly.com","purpose":"Platform operation","location":"United States","vendor_url":"https://certreports.com/vendors/launchdarkly/security"},{"name":"Mailer Lite","domain":"mailerlite.com","purpose":"Customer communications","location":"United States","vendor_url":"https://certreports.com/vendors/mailerlite-inc/security"},{"name":"MongoDB Atlas","domain":"mongodb.com","purpose":"Database services for platform operations","location":"United States","vendor_url":"https://certreports.com/vendors/mongodb/security"},{"name":"Notion","domain":"notion.com","purpose":"Internal documentation, planning and issue tracking.","location":"United States","vendor_url":null},{"name":"PostHog","domain":"posthog.com","purpose":"Used to get product feedback from customers.","location":"United States","vendor_url":"https://certreports.com/vendors/posthog/security"},{"name":"Recurly","domain":"recurly.com","purpose":"Customer billing and notifications","location":"United States","vendor_url":"https://certreports.com/vendors/recurly/security"},{"name":"Rollbar","domain":"rollbar.com","purpose":"Used for platform operation stability monitoring.","location":"United States","vendor_url":"https://certreports.com/vendors/rollbar/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-02T19:20:18.658Z"}