{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"langchain","name":"LangChain","domain":"langchain.com","category":"AI infrastructure","one_liner":"LangChain is a software framework that helps facilitate the integration of large language models (LLMs) into applications","trust_center_url":"https://trust.langchain.com/","security_page_url":null,"url":"https://certreports.com/vendors/langchain/security","last_verified_at":"2026-10-26T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"hipaa","framework_name":"HIPAA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states that it will sign a business associate agreement on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/langchain/hipaa","evidence":[{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-21 22:57:47.047143+00","content_hash":"9d1e7fd961d7f5e2a8cee386412a68ed2e8bc20fd1e9c4d45c34314cfcbc25e2","wayback_url":null,"quote":"HIPAA","confidence":1},{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-19 07:32:19.795859+00","content_hash":"ff6d0473bc0289006dd6e1925c670fe9e7619060106f6746875a37b71ab3d9e6","wayback_url":null,"quote":"HIPAA","confidence":1}]},{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 21 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 2 Type II on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/langchain/soc-2","evidence":[{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-21 22:57:47.047143+00","content_hash":"9d1e7fd961d7f5e2a8cee386412a68ed2e8bc20fd1e9c4d45c34314cfcbc25e2","wayback_url":null,"quote":"SOC 2 Type II","confidence":1},{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-19 07:32:19.795859+00","content_hash":"ff6d0473bc0289006dd6e1925c670fe9e7619060106f6746875a37b71ab3d9e6","wayback_url":null,"quote":"SOC 2 Type II","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/langchain/gdpr","evidence":[{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-21 22:57:47.047143+00","content_hash":"9d1e7fd961d7f5e2a8cee386412a68ed2e8bc20fd1e9c4d45c34314cfcbc25e2","wayback_url":null,"quote":"GDPR","confidence":1},{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-19 07:32:19.795859+00","content_hash":"ff6d0473bc0289006dd6e1925c670fe9e7619060106f6746875a37b71ab3d9e6","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/langchain/iso-27001","evidence":[{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-21 22:57:47.047143+00","content_hash":"9d1e7fd961d7f5e2a8cee386412a68ed2e8bc20fd1e9c4d45c34314cfcbc25e2","wayback_url":null,"quote":"ISO 27001:2022","confidence":1},{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-19 07:32:19.795859+00","content_hash":"ff6d0473bc0289006dd6e1925c670fe9e7619060106f6746875a37b71ab3d9e6","wayback_url":null,"quote":"ISO 27001:2022","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"verified_registry","state_label":"Verified","sentence":"Listed in the CSA STAR registry as of 26 Oct 2026.","kind":"self_assessment","status_text":"STAR Level 1 self-assessment (CAIQ)","issued_at":"2025-11-25","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-10-26","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/langchain/csa-star","evidence":[{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/langchain-inc","fetched_at":"2026-10-26 05:00:05.217959+00","content_hash":"0c3d16dcbd77d639d256c2f5de5eac7c995deb3d9c8ecb697f3919e064cfa0fd","wayback_url":null,"quote":"langchain, inc.: STAR Level 1 self-assessment (CAIQ)","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/langchain-inc","fetched_at":"2026-10-19 05:00:04.207159+00","content_hash":"6ebb0150315154b32c59fd3d2a81bb4bc4a9c9dabf7b485b5276104bdf852acb","wayback_url":null,"quote":"langchain, inc.: STAR Level 1 self-assessment (CAIQ)","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/langchain-inc","fetched_at":"2026-10-12 05:00:04.718981+00","content_hash":"be2cb50e52128b9a1c5b016c9a48d1831b9215e7effe345b5df6a034ef5f2e29","wayback_url":null,"quote":"langchain, inc.: STAR Level 1 self-assessment (CAIQ)","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/langchain-inc","fetched_at":"2026-10-05 05:00:04.451025+00","content_hash":"3b3fda577efc5eb9a00af6a8040caf609c1fc2a294d846b2dcab0e8c2303b261","wayback_url":null,"quote":"langchain, inc.: STAR Level 1 self-assessment (CAIQ)","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/langchain-inc","fetched_at":"2026-09-29 03:46:22.312905+00","content_hash":"aadfa82b54b7f12b294435b40c81a3cac63c4874bc052d39b123e12485fa29d0","wayback_url":null,"quote":"langchain, inc.: STAR Level 1 self-assessment (CAIQ)","confidence":1}]}],"brief":{"summary":"LangChain states on its trust centre that it holds a SOC 2 Type II report, as of 21 Sep 2026. LangChain states on its trust centre that it holds ISO/IEC 27001:2022 certification, as of 21 Sep 2026. LangChain states on its trust centre that it complies with GDPR, as of 21 Sep 2026. LangChain displays a HIPAA badge on its trust centre, as of 21 Sep 2026, though the evidence does not confirm BAA availability. LangChain is listed in the CSA STAR registry with a Level 1 self-assessment (CAIQ) issued 25 Nov 2025, as of 29 Sep 2026.","bullets":["SOC 2 Type II and ISO/IEC 27001:2022 - vendor-stated on trust centre, as of 21 Sep 2026","GDPR - vendor-stated on trust centre, as of 21 Sep 2026","HIPAA badge displayed, as of 21 Sep 2026, BAA availability not confirmed; CSA STAR Level 1 self-assessment listed in registry, issued 25 Nov 2025, as of 29 Sep 2026"],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-10-02 05:36:58.726966+00"},"legal_docs":[{"kind":"subprocessors","url":"https://trust.langchain.com/","availability":"public","detail":"11 subprocessors listed on the trust centre","as_of":"2026-09-21"},{"kind":"privacy","url":"https://www.langchain.com/privacy-policy","availability":"public","detail":null,"as_of":"2026-09-21"}],"documents":[{"type":"business_continuity","title":"Business Continuity and Disaster Recovery Plan (EN)","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"incident_response","title":"Security Incident Response Plan","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"iso_certificate","title":"ISO 27001 Certificate 2026.pdf","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"iso_soa","title":"ISO 27001 Statement of Applicability (2026).pdf","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"2026 LangSmith Pentest Exec Summary.pdf","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Access Control Policy","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"BYOC LangSmith Security Overview.pdf","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Cryptography Policy (EN)","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Human Resource Security Policy (EN)","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Information Security & Governance Policy","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Infrastructure & Operations Security Policy","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"LangSmith Engine - Security Overview","availability":"public","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Physical Security Policy (EN)","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Secure Development Policy (EN)","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"2025 SOC 2 Type 2 LangChain Audit Report.pdf","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"2026 SOC 2 Type II","availability":"on_request","source_url":"https://trust.langchain.com/","last_seen":"2026-09-21"}],"statements":[{"topic":"model_training","question":"Do LangChain Services use customer data to train AI models","answer":"No. Customers are responsible for bringing their own models to our platform. Please check with your LLM provider to understand what data they are using to train their models.","value":"no","regions":[],"source_url":"https://trust.langchain.com/faq?s=0t1xbef1t3pvtqedclxitn","as_of":"2026-09-21"}],"security_profile":{"iso42001":null,"trains_on_customer_data":"no","data_residency_regions":[],"pen_test_cadence":"annual","as_of":"2026-09-21"},"regulations_url":"https://certreports.com/api/v1/vendors/langchain/regulations/{regulation}","subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Cloud provider","location":"USA","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Anthropic","domain":"anthropic.com","purpose":"AI model inference","location":"USA","vendor_url":"https://certreports.com/vendors/anthropic/security"},{"name":"Baseten","domain":"baseten.co","purpose":"AI model inference","location":"USA","vendor_url":null},{"name":"Clickhouse","domain":"clickhouse.com","purpose":"Production Database","location":"USA or Netherlands","vendor_url":null},{"name":"Fireworks AI","domain":"fireworks.ai","purpose":"AI model inference","location":"USA","vendor_url":"https://certreports.com/vendors/fireworks-ai/security"},{"name":"Google Cloud Platform","domain":"google.com","purpose":"Cloud provider","location":"USA or Netherlands","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"OpenAI","domain":"openai.com","purpose":"AI model inference","location":"USA","vendor_url":"https://certreports.com/vendors/openai/security"},{"name":"Parallel Web Systems","domain":"parallel.ai","purpose":"Web Search","location":"USA","vendor_url":null},{"name":"Pylon","domain":"usepylon.com","purpose":"Customer Support Ticketing and Communication","location":"USA","vendor_url":"https://certreports.com/vendors/pylon-usepylon/security"},{"name":"Stripe","domain":"stripe.com","purpose":"Payment Processing","location":"USA","vendor_url":"https://certreports.com/vendors/stripe/security"},{"name":"Supabase","domain":"supabase.com","purpose":"Database provider","location":"US or Germany","vendor_url":"https://certreports.com/vendors/supabase/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-03T18:56:14.863Z"}