{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"medallia","name":"Medallia","domain":"medallia.com","category":"Education","one_liner":"Medallia is an American customer and employee experience management company based in Tysons, Virginia","trust_center_url":"https://trust.medallia.com/","security_page_url":null,"url":"https://certreports.com/vendors/medallia/security","last_verified_at":"2026-09-19T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"hipaa","framework_name":"HIPAA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states that it will sign a business associate agreement on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/hipaa","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"HIPAA","confidence":1}]},{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states SOC 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/soc-2","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"SOC 2","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/gdpr","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"fedramp","framework_name":"FedRAMP","state":"verified_registry","state_label":"Verified","sentence":"Listed in the FedRAMP Marketplace as of 19 Sep 2026.","kind":"authorization","status_text":"FedRAMP Authorized","issued_at":"2021-04-09","expires_at":null,"period_start":null,"period_end":null,"auditor":"Kratos","impact_level":"High","as_of":"2026-09-19","under_review":false,"source":"fedramp","url":"https://certreports.com/vendors/medallia/fedramp","evidence":[{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/FR1711262842","fetched_at":"2026-09-19 08:30:01.700532+00","content_hash":"b2bb3e031fda16f1f3201a5640ae64a639a15e4997f9d1ca43ef13a2942600e6","wayback_url":null,"quote":"Medallia, Inc. - Medallia GovCloud: FedRAMP Authorized","confidence":1},{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/FR1711262842","fetched_at":"2026-09-18 22:35:17.44827+00","content_hash":"db2d03fa40cba0e5287b9cc7361e71b7c30c7ca9d51efb7b540477105fb30c7b","wayback_url":null,"quote":"Medallia, Inc. - Medallia GovCloud: FedRAMP Authorized","confidence":1},{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/FR1711262842","fetched_at":"2026-09-17 15:44:39.301965+00","content_hash":"395e7ad35dd25d1c547414140161c47ec22827b7ffae3bdbbd5256c38a3b940f","wayback_url":null,"quote":"Medallia, Inc. - Medallia GovCloud: FedRAMP Authorized","confidence":1}]},{"framework":"pci-dss","framework_name":"PCI DSS","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a PCI DSS attestation of compliance on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states PCI DSS on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/pci-dss","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"PCI DSS","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27001 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"ISO/IEC 27001","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"verified_registry","state_label":"Verified","sentence":"Listed in the CSA STAR registry as of 17 Sep 2026.","kind":"self_assessment","status_text":"STAR Level 1 self-assessment (CAIQ)","issued_at":"2019-11-25","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/medallia/csa-star","evidence":[{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/medallia-inc","fetched_at":"2026-09-17 15:44:42.254747+00","content_hash":"e7f124247f5399c92ba048620a83c0b6cca1f9a2f97419f32566e462a3b1bda7","wayback_url":null,"quote":"medallia, inc.: STAR Level 1 self-assessment (CAIQ)","confidence":1}]},{"framework":"iso-27701","framework_name":"ISO/IEC 27701","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27701 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27701 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/iso-27701","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"ISO/IEC 27701","confidence":1}]},{"framework":"iso-42001","framework_name":"ISO/IEC 42001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 42001 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 42001 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/iso-42001","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"ISO/IEC 42001","confidence":1}]},{"framework":"iso-27017","framework_name":"ISO/IEC 27017","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27017 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27017:2015 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/security","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"ISO/IEC 27017:2015","confidence":1}]},{"framework":"iso-27018","framework_name":"ISO/IEC 27018","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27018 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27018:2019 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/security","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"ISO/IEC 27018:2019","confidence":1}]},{"framework":"hitrust","framework_name":"HITRUST","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an HITRUST certification on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states HITRUST on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/security","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"HITRUST","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 17 Sep 2026.","kind":"listing","status_text":"Active: EU-US Certification, SW-US Certification, UK Extension Certification","issued_at":"2017-07-27","expires_at":"2027-03-03","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/medallia/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/6332","fetched_at":"2026-09-17 15:49:29.331251+00","content_hash":"5dd60f56123c255c8c17bfe3da71276c412f873358c01bf168fc0759aa196d19","wayback_url":null,"quote":"Medallia, Inc.: Active: EU-US Certification, SW-US Certification, UK Extension Certification","confidence":1}]},{"framework":"ccpa","framework_name":"CCPA / CPRA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an CCPA / CPRA privacy notice on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states CCPA on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/medallia/security","evidence":[{"source_type":"trust_center","source_name":"Medallia trust centre (Drata)","url":"https://trust.medallia.com/","fetched_at":"2026-09-18 22:41:21.285511+00","content_hash":"971c5962f80f8fa657bb7ce3443cd148dbb046eb6f79ffa34c321fabe16f180a","wayback_url":null,"quote":"CCPA","confidence":1}]}],"brief":{"summary":"As of 17 Sep 2026, Medallia is listed in the FedRAMP registry as FedRAMP Authorized, with authorization issued 09 Apr 2025 and audited by Kratos. As of 17 Sep 2026, Medallia is listed in the CSA STAR registry at Level 1 self-assessment (CAIQ), issued 25 Nov 2019. As of 17 Sep 2026, Medallia is listed in the EU-US Data Privacy Framework registry as Active across EU-US Certification, SW-US Certification, and UK Extension Certification, originally issued 27 Jul 2017 and set to expire 03 Mar 2027. As of 17 Sep 2026, no public evidence found for SOC 2 for Medallia. As of 17 Sep 2026, no public evidence found for HIPAA for Medallia.","bullets":["FedRAMP: Authorized (registry-listed), issued 09 Apr 2025, auditor Kratos, as of 17 Sep 2026","CSA STAR: Level 1 self-assessment (CAIQ), registry-listed, issued 25 Nov 2019, as of 17 Sep 2026","EU-US Data Privacy Framework: Active (EU-US, SW-US, UK Extension), registry-listed, issued 27 Jul 2017, expires 03 Mar 2027, as of 17 Sep 2026"],"model":"claude-sonnet-5","generated_at":"2026-09-17 18:39:47.463417+00"},"legal_docs":[],"subprocessors":[],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-20T04:41:31.174Z"}