{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"navan","name":"Navan","domain":"navan.com","category":"Travel and hospitality","one_liner":"Streamline your corporate travel management and expense processes in one","trust_center_url":"https://trust.navan.com/","security_page_url":null,"url":"https://certreports.com/vendors/navan/security","last_verified_at":"2026-11-02T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Drata) as of 21 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 2 Type 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"drata","url":"https://certreports.com/vendors/navan/soc-2","evidence":[{"source_type":"trust_center","source_name":"Navan trust centre (Drata)","url":"https://trust.navan.com/","fetched_at":"2026-09-21 22:56:58.243843+00","content_hash":"54155d59c7794479144d5cb0a52a4a339a8c3f1b45cb711e2251178c79aecba4","wayback_url":null,"quote":"SOC 2 Type 2","confidence":1},{"source_type":"trust_center","source_name":"Navan trust centre (Drata)","url":"https://trust.navan.com/","fetched_at":"2026-09-19 07:33:17.167532+00","content_hash":"16e00e06e3a562acaef2ff82105fdac96206b7b7706e2c38807cf341d0546f07","wayback_url":null,"quote":"SOC 2 Type 2","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Drata) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"drata","url":"https://certreports.com/vendors/navan/gdpr","evidence":[{"source_type":"trust_center","source_name":"Navan trust centre (Drata)","url":"https://trust.navan.com/","fetched_at":"2026-09-21 22:56:58.243843+00","content_hash":"54155d59c7794479144d5cb0a52a4a339a8c3f1b45cb711e2251178c79aecba4","wayback_url":null,"quote":"GDPR","confidence":1},{"source_type":"trust_center","source_name":"Navan trust centre (Drata)","url":"https://trust.navan.com/","fetched_at":"2026-09-19 07:33:17.167532+00","content_hash":"16e00e06e3a562acaef2ff82105fdac96206b7b7706e2c38807cf341d0546f07","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"pci-dss","framework_name":"PCI DSS","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a PCI DSS attestation of compliance on its trust centre (Drata) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states PCI DSS on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"drata","url":"https://certreports.com/vendors/navan/pci-dss","evidence":[{"source_type":"trust_center","source_name":"Navan trust centre (Drata)","url":"https://trust.navan.com/","fetched_at":"2026-09-21 22:56:58.243843+00","content_hash":"54155d59c7794479144d5cb0a52a4a339a8c3f1b45cb711e2251178c79aecba4","wayback_url":null,"quote":"PCI DSS","confidence":1},{"source_type":"trust_center","source_name":"Navan trust centre (Drata)","url":"https://trust.navan.com/","fetched_at":"2026-09-19 07:33:17.167532+00","content_hash":"16e00e06e3a562acaef2ff82105fdac96206b7b7706e2c38807cf341d0546f07","wayback_url":null,"quote":"PCI DSS","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Drata) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27001 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"drata","url":"https://certreports.com/vendors/navan/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Navan trust centre (Drata)","url":"https://trust.navan.com/","fetched_at":"2026-09-21 22:56:58.243843+00","content_hash":"54155d59c7794479144d5cb0a52a4a339a8c3f1b45cb711e2251178c79aecba4","wayback_url":null,"quote":"ISO/IEC 27001","confidence":1},{"source_type":"trust_center","source_name":"Navan trust centre (Drata)","url":"https://trust.navan.com/","fetched_at":"2026-09-19 07:33:17.167532+00","content_hash":"16e00e06e3a562acaef2ff82105fdac96206b7b7706e2c38807cf341d0546f07","wayback_url":null,"quote":"ISO/IEC 27001","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"verified_registry","state_label":"Verified","sentence":"Listed in the CSA STAR registry as of 26 Oct 2026.","kind":"self_assessment","status_text":"STAR Level 1 self-assessment (CAIQ)","issued_at":"2025-04-22","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-10-26","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/navan/csa-star","evidence":[{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/navan-inc","fetched_at":"2026-10-26 05:00:05.217959+00","content_hash":"0c3d16dcbd77d639d256c2f5de5eac7c995deb3d9c8ecb697f3919e064cfa0fd","wayback_url":null,"quote":"navan inc: STAR Level 1 self-assessment (CAIQ)","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/navan-inc","fetched_at":"2026-10-19 05:00:04.207159+00","content_hash":"6ebb0150315154b32c59fd3d2a81bb4bc4a9c9dabf7b485b5276104bdf852acb","wayback_url":null,"quote":"navan inc: STAR Level 1 self-assessment (CAIQ)","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/navan-inc","fetched_at":"2026-10-12 05:00:04.718981+00","content_hash":"be2cb50e52128b9a1c5b016c9a48d1831b9215e7effe345b5df6a034ef5f2e29","wayback_url":null,"quote":"navan inc: STAR Level 1 self-assessment (CAIQ)","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/navan-inc","fetched_at":"2026-10-05 05:00:04.451025+00","content_hash":"3b3fda577efc5eb9a00af6a8040caf609c1fc2a294d846b2dcab0e8c2303b261","wayback_url":null,"quote":"navan inc: STAR Level 1 self-assessment (CAIQ)","confidence":1},{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/navan-inc","fetched_at":"2026-09-29 03:46:22.312905+00","content_hash":"aadfa82b54b7f12b294435b40c81a3cac63c4874bc052d39b123e12485fa29d0","wayback_url":null,"quote":"navan inc: STAR Level 1 self-assessment (CAIQ)","confidence":1}]},{"framework":"soc-1","framework_name":"SOC 1","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 1 Type II report on its trust centre (Drata) as of 21 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 1 Type 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"drata","url":"https://certreports.com/vendors/navan/security","evidence":[{"source_type":"trust_center","source_name":"Navan trust centre (Drata)","url":"https://trust.navan.com/","fetched_at":"2026-09-21 22:56:58.243843+00","content_hash":"54155d59c7794479144d5cb0a52a4a339a8c3f1b45cb711e2251178c79aecba4","wayback_url":null,"quote":"SOC 1 Type 2","confidence":1},{"source_type":"trust_center","source_name":"Navan trust centre (Drata)","url":"https://trust.navan.com/","fetched_at":"2026-09-19 07:33:17.167532+00","content_hash":"16e00e06e3a562acaef2ff82105fdac96206b7b7706e2c38807cf341d0546f07","wayback_url":null,"quote":"SOC 1 Type 2","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 2 Nov 2026.","kind":"listing","status_text":"Active: EU-US Certification, UK Extension Certification","issued_at":"2018-09-13","expires_at":"2027-07-02","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-11-02","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/navan/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/4479","fetched_at":"2026-11-02 05:01:48.73368+00","content_hash":"166d005a33019fff53536ac48a62ed521e12cccc1eada947342d194873f9b06d","wayback_url":null,"quote":"Navan, Inc.: Active: EU-US Certification, UK Extension Certification","confidence":1}]}],"brief":{"summary":"Navan states on its trust centre that it holds SOC 2 Type 2 and SOC 1 Type 2 reports, as of 21 Sep 2026. Navan states on its trust centre that it holds ISO/IEC 27001 certification and PCI DSS compliance, as of 21 Sep 2026. Navan states on its trust centre that it complies with GDPR, as of 21 Sep 2026. Navan is listed in the CSA STAR registry with a Level 1 self-assessment (CAIQ) issued 22 Apr 2025, as of 29 Sep 2026. Navan is listed in the EU-US Data Privacy Framework registry as active, with EU-US and UK Extension certifications issued 13 Sep 2018 and set to expire 2 Jul 2027, as of 29 Sep 2026.","bullets":["SOC 2 Type 2 and SOC 1 Type 2 - vendor-stated on trust centre, as of 21 Sep 2026","CSA STAR - Level 1 self-assessment listed in registry, issued 22 Apr 2025, as of 29 Sep 2026","EU-US Data Privacy Framework - listed in registry as active, certifications issued 13 Sep 2018, expiring 2 Jul 2027, as of 29 Sep 2026"],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-10-02 05:36:58.718161+00"},"legal_docs":[{"kind":"ai_policy","url":"https://trust.navan.com/","availability":"on_request","detail":"Listed on the trust centre as \"AI System Development and Evaluation Policy\"","as_of":"2026-09-21"},{"kind":"dpa","url":"https://trust.navan.com/","availability":"on_request","detail":"Listed on the trust centre as \"Data Processing Agreement\"","as_of":"2026-09-21"}],"documents":[{"type":"ai_policy","title":"AI System Development and Evaluation Policy","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"dpa","title":"Data Processing Agreement","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"insurance","title":"Certificate of Insurance (COI)","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"iso_certificate","title":"ISO 27001:2022","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"iso_certificate","title":"ISO/IEC 27001","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"pci_aoc","title":"PCI DSS","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Application Penetration Testing","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"questionnaire","title":"CAIQ","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Access Control Policy","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Disk Encryption","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Secure Development Training","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"soc1_report","title":"SOC 1 Report","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"soc1_report","title":"SOC 1 Type 2","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"SOC 2 Report","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"SOC 2 Type 2","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"},{"type":"subprocessor_list","title":"Subprocessors","availability":"on_request","source_url":"https://trust.navan.com/","last_seen":"2026-09-21"}],"statements":[],"security_profile":{"iso42001":null,"trains_on_customer_data":null,"data_residency_regions":[],"pen_test_cadence":"report available","as_of":"2026-09-21"},"regulations_url":"https://certreports.com/api/v1/vendors/navan/regulations/{regulation}","subprocessors":[],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-03T18:55:52.611Z"}