{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"langchain","name":"LangChain","domain":"langchain.com","category":"AI tools","one_liner":"LangChain is a software framework that helps facilitate the integration of large language models (LLMs) into applications","trust_center_url":"https://trust.langchain.com/","security_page_url":null,"url":"https://certreports.com/vendors/langchain/security","last_verified_at":"2026-09-19T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"hipaa","framework_name":"HIPAA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states that it will sign a business associate agreement on its trust centre (Vanta) as of 19 Sep 2026.","kind":null,"status_text":"Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-19","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/langchain/hipaa","evidence":[{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-19 07:32:19.795859+00","content_hash":"ff6d0473bc0289006dd6e1925c670fe9e7619060106f6746875a37b71ab3d9e6","wayback_url":null,"quote":"HIPAA","confidence":1}]},{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 19 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 2 Type II on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-19","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/langchain/soc-2","evidence":[{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-19 07:32:19.795859+00","content_hash":"ff6d0473bc0289006dd6e1925c670fe9e7619060106f6746875a37b71ab3d9e6","wayback_url":null,"quote":"SOC 2 Type II","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 19 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-19","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/langchain/gdpr","evidence":[{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-19 07:32:19.795859+00","content_hash":"ff6d0473bc0289006dd6e1925c670fe9e7619060106f6746875a37b71ab3d9e6","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Vanta) as of 19 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-19","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/langchain/iso-27001","evidence":[{"source_type":"trust_center","source_name":"LangChain trust centre (Vanta)","url":"https://trust.langchain.com/","fetched_at":"2026-09-19 07:32:19.795859+00","content_hash":"ff6d0473bc0289006dd6e1925c670fe9e7619060106f6746875a37b71ab3d9e6","wayback_url":null,"quote":"ISO 27001:2022","confidence":1}]}],"brief":{"summary":"LangChain displays a HIPAA badge on its trust centre as of 19 Sep 2026, though the evidence does not confirm whether a business associate agreement is available. LangChain also states on its trust centre that it has a SOC 2 Type II report, as of 19 Sep 2026. LangChain states on its trust centre that it addresses the GDPR, as of 19 Sep 2026. LangChain further states on its trust centre that it holds ISO/IEC 27001:2022, as of 19 Sep 2026. Each of these HIPAA, SOC 2, GDPR and ISO/IEC 27001:2022 disclosures for LangChain is a vendor-stated claim on its trust centre rather than a registry listing, as of 19 Sep 2026.","bullets":["HIPAA: vendor displays a badge on its trust centre as of 19 Sep 2026; BAA availability not documented","SOC 2 Type II report: vendor-stated on trust centre, as of 19 Sep 2026","GDPR and ISO/IEC 27001:2022: vendor-stated on trust centre, as of 19 Sep 2026; no registry-listed evidence found"],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-19 10:40:41.154848+00"},"legal_docs":[{"kind":"privacy","url":"https://www.langchain.com/privacy-policy","availability":"public","detail":null,"as_of":"2026-09-19"},{"kind":"subprocessors","url":"https://trust.langchain.com/","availability":"public","detail":"11 subprocessors listed on the trust centre","as_of":"2026-09-19"}],"subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Cloud provider","location":"USA","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Anthropic","domain":"anthropic.com","purpose":"AI model inference","location":"USA","vendor_url":"https://certreports.com/vendors/anthropic/security"},{"name":"Baseten","domain":"baseten.co","purpose":"AI model inference","location":"USA","vendor_url":null},{"name":"Clickhouse","domain":"clickhouse.com","purpose":"Production Database","location":"USA or Netherlands","vendor_url":null},{"name":"Fireworks AI","domain":"fireworks.ai","purpose":"AI model inference","location":"USA","vendor_url":"https://certreports.com/vendors/fireworks-ai/security"},{"name":"Google Cloud Platform","domain":"google.com","purpose":"Cloud provider","location":"USA or Netherlands","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"OpenAI","domain":"openai.com","purpose":"AI model inference","location":"USA","vendor_url":"https://certreports.com/vendors/openai/security"},{"name":"Parallel Web Systems","domain":"parallel.ai","purpose":"Web Search","location":"USA","vendor_url":null},{"name":"Pylon","domain":"usepylon.com","purpose":"Customer Support Ticketing and Communication","location":"USA","vendor_url":"https://certreports.com/vendors/pylon-usepylon/security"},{"name":"Stripe","domain":"stripe.com","purpose":"Payment Processing","location":"USA","vendor_url":"https://certreports.com/vendors/stripe/security"},{"name":"Supabase","domain":"supabase.com","purpose":"Database provider","location":"US or Germany","vendor_url":"https://certreports.com/vendors/supabase/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-19T10:48:19.346Z"}