{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"optimizely","name":"Optimizely","domain":"optimizely.com","category":"Marketing","one_liner":"The first all-in-one operating system for marketing","trust_center_url":null,"security_page_url":null,"url":"https://certreports.com/vendors/optimizely/security","last_verified_at":"2026-11-02T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"expired","state_label":"Expired","sentence":"Certificate expiry unknown date passed; no renewal found as of 2 Nov 2026.","kind":"listing","status_text":"Inactive","issued_at":"2017-08-01","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-11-02","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/optimizely/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/6463","fetched_at":"2026-11-02 05:02:36.638879+00","content_hash":"8d8d78890d517501f8b529c14816d04d7f5da0b4972316930d7b6508f270bb1f","wayback_url":null,"quote":"Optimizely North America Inc.: Inactive","confidence":1},{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/6463","fetched_at":"2026-10-12 05:02:34.860661+00","content_hash":"0a5defadb18b62589c5cce75966dc4f5c3254dfe4519793bfe4e8ebe898d316b","wayback_url":null,"quote":"Optimizely North America Inc.: Active: EU-US Certification, UK Extension Certification, SW-US Certification","confidence":1},{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/6463","fetched_at":"2026-10-05 05:02:35.471895+00","content_hash":"7dea78a78b30f264abff77844e8e54c8d09029ae22b291895771ee407cd427fd","wayback_url":null,"quote":"Optimizely North America Inc.: Active: EU-US Certification, UK Extension Certification, SW-US Certification","confidence":1}]}],"brief":{"summary":"As of 19 Oct 2026, Optimizely's listing in the EU-US Data Privacy Framework registry is marked inactive, with the original certification issued 1 Aug 2017, indicating an expired status. As of 19 Oct 2026, no public evidence was found of a SOC 2 Type II report for Optimizely. As of 19 Oct 2026, no public evidence was found that Optimizely offers a BAA under HIPAA. As of 19 Oct 2026, no public evidence was found of PCI DSS validation for Optimizely. As of 19 Oct 2026, no public evidence was found of FedRAMP authorization or CSA STAR listing for Optimizely.","bullets":["EU-US DPF: expired, originally issued 1 Aug 2017 (as of 19 Oct 2026)","PCI DSS: no public evidence found (as of 19 Oct 2026)","SOC 2: no public evidence found (as of 19 Oct 2026)"],"model":"claude-sonnet-5","generated_at":"2026-10-19 05:44:13.981043+00"},"legal_docs":[],"documents":[],"statements":[],"security_profile":null,"regulations_url":"https://certreports.com/api/v1/vendors/optimizely/regulations/{regulation}","subprocessors":[],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-02T19:19:21.524Z"}