{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"postman","name":"Postman","domain":"postman.com","category":"Developer tools","one_liner":"Postman is an API platform for building and using","trust_center_url":"https://security.postman.com/","security_page_url":null,"url":"https://certreports.com/vendors/postman/security","last_verified_at":"2026-09-18T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"hipaa","framework_name":"HIPAA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states that it will sign a business associate agreement on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/postman/hipaa","evidence":[{"source_type":"trust_center","source_name":"Postman trust centre (Drata)","url":"https://security.postman.com/","fetched_at":"2026-09-18 22:40:17.916357+00","content_hash":"3d6fbaa3ad679f9e82b9046c45ad374a01f0b17e595cb923de43090f9019d304","wayback_url":null,"quote":"HIPAA","confidence":1}]},{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states SOC 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/postman/soc-2","evidence":[{"source_type":"trust_center","source_name":"Postman trust centre (Drata)","url":"https://security.postman.com/","fetched_at":"2026-09-18 22:40:17.916357+00","content_hash":"3d6fbaa3ad679f9e82b9046c45ad374a01f0b17e595cb923de43090f9019d304","wayback_url":null,"quote":"SOC 2","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/postman/gdpr","evidence":[{"source_type":"trust_center","source_name":"Postman trust centre (Drata)","url":"https://security.postman.com/","fetched_at":"2026-09-18 22:40:17.916357+00","content_hash":"3d6fbaa3ad679f9e82b9046c45ad374a01f0b17e595cb923de43090f9019d304","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"pci-dss","framework_name":"PCI DSS","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a PCI DSS attestation of compliance on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states PCI DSS on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/postman/pci-dss","evidence":[{"source_type":"trust_center","source_name":"Postman trust centre (Drata)","url":"https://security.postman.com/","fetched_at":"2026-09-18 22:40:17.916357+00","content_hash":"3d6fbaa3ad679f9e82b9046c45ad374a01f0b17e595cb923de43090f9019d304","wayback_url":null,"quote":"PCI DSS","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/postman/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Postman trust centre (Drata)","url":"https://security.postman.com/","fetched_at":"2026-09-18 22:40:17.916357+00","content_hash":"3d6fbaa3ad679f9e82b9046c45ad374a01f0b17e595cb923de43090f9019d304","wayback_url":null,"quote":"ISO 27001","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"verified_registry","state_label":"Verified","sentence":"Listed in the CSA STAR registry as of 17 Sep 2026.","kind":"self_assessment","status_text":"STAR Level 1 self-assessment (CAIQ)","issued_at":"2022-06-28","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/postman/csa-star","evidence":[{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/postman-inc","fetched_at":"2026-09-17 15:44:42.254747+00","content_hash":"e7f124247f5399c92ba048620a83c0b6cca1f9a2f97419f32566e462a3b1bda7","wayback_url":null,"quote":"postman, inc.: STAR Level 1 self-assessment (CAIQ)","confidence":1}]},{"framework":"iso-42001","framework_name":"ISO/IEC 42001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 42001 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 42001:2023 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/postman/iso-42001","evidence":[{"source_type":"trust_center","source_name":"Postman trust centre (Drata)","url":"https://security.postman.com/","fetched_at":"2026-09-18 22:40:17.916357+00","content_hash":"3d6fbaa3ad679f9e82b9046c45ad374a01f0b17e595cb923de43090f9019d304","wayback_url":null,"quote":"ISO/IEC 42001:2023","confidence":1}]},{"framework":"soc-3","framework_name":"SOC 3","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a public SOC 3 report on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states SOC 3 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/postman/security","evidence":[{"source_type":"trust_center","source_name":"Postman trust centre (Drata)","url":"https://security.postman.com/","fetched_at":"2026-09-18 22:40:17.916357+00","content_hash":"3d6fbaa3ad679f9e82b9046c45ad374a01f0b17e595cb923de43090f9019d304","wayback_url":null,"quote":"SOC 3","confidence":1}]},{"framework":"iso-27017","framework_name":"ISO/IEC 27017","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27017 certificate on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27017:2015 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/postman/security","evidence":[{"source_type":"trust_center","source_name":"Postman trust centre (Drata)","url":"https://security.postman.com/","fetched_at":"2026-09-18 22:40:17.916357+00","content_hash":"3d6fbaa3ad679f9e82b9046c45ad374a01f0b17e595cb923de43090f9019d304","wayback_url":null,"quote":"ISO/IEC 27017:2015","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 17 Sep 2026.","kind":"listing","status_text":"Active: EU-US Certification, UK Extension Certification, SW-US Certification","issued_at":"2023-10-31","expires_at":"2026-10-21","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/postman/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/6399","fetched_at":"2026-09-17 15:49:32.92678+00","content_hash":"bce65cb40c3a69a4d68c40fe00570e8b263d39178af17b4feef3f4718e8f0c7a","wayback_url":null,"quote":"Postman, Inc.: Active: EU-US Certification, UK Extension Certification, SW-US Certification","confidence":1}]},{"framework":"ccpa","framework_name":"CCPA / CPRA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an CCPA / CPRA privacy notice on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states CCPA on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/postman/security","evidence":[{"source_type":"trust_center","source_name":"Postman trust centre (Drata)","url":"https://security.postman.com/","fetched_at":"2026-09-18 22:40:17.916357+00","content_hash":"3d6fbaa3ad679f9e82b9046c45ad374a01f0b17e595cb923de43090f9019d304","wayback_url":null,"quote":"CCPA","confidence":1}]},{"framework":"txramp","framework_name":"TX-RAMP","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an TX-RAMP certification on its trust centre (Drata) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states TX-RAMP on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"drata","url":"https://certreports.com/vendors/postman/security","evidence":[{"source_type":"trust_center","source_name":"Postman trust centre (Drata)","url":"https://security.postman.com/","fetched_at":"2026-09-18 22:40:17.916357+00","content_hash":"3d6fbaa3ad679f9e82b9046c45ad374a01f0b17e595cb923de43090f9019d304","wayback_url":null,"quote":"TX-RAMP","confidence":1}]}],"brief":{"summary":"Postman displays a HIPAA badge on its trust centre; BAA availability is not confirmed in the evidence, as of 18 Sep 2026. Postman states on its trust centre that it has a SOC 2 report, and separately states SOC 3, as of 18 Sep 2026. Postman states on its trust centre that it holds ISO/IEC 27001, ISO/IEC 27017:2015 and ISO/IEC 42001:2023, as of 18 Sep 2026. Postman is listed in the CSA STAR registry with a STAR Level 1 self-assessment (CAIQ) dated 28 Jun 2022, as of 17 Sep 2026, and is listed in the EU-US Data Privacy Framework registry as Active for the EU-US Certification, UK Extension Certification and SW-US Certification, issued 31 Oct 2023 with a listed expiry of 21 Oct 2026, as of 17 Sep 2026. Postman also states GDPR, PCI DSS, CCPA/CPRA and TX-RAMP on its trust centre, as of 18 Sep 2026.","bullets":["SOC 2 and SOC 3 stated on trust centre; ISO/IEC 27001, 27017:2015 and 42001:2023 also stated, as of 18 Sep 2026.","Listed in EU-US Data Privacy Framework registry (Active), issued 31 Oct 2023, expiry listed 21 Oct 2026, as of 17 Sep 2026; listed in CSA STAR registry (Level 1 CAIQ) dated 28 Jun 2022, as of 17 Sep 2026.","HIPAA badge stated on trust centre - BAA availability not confirmed, as of 18 Sep 2026. GDPR, PCI DSS, CCPA/CPRA and TX-RAMP also stated, as of 18 Sep 2026."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-19 11:45:37.168479+00"},"legal_docs":[{"kind":"subprocessors","url":"https://security.postman.com/","availability":"public","detail":"6 subprocessors listed on the trust centre","as_of":"2026-09-18"}],"subprocessors":[{"name":"ClickHouse Cloud","domain":null,"purpose":null,"location":null,"vendor_url":null},{"name":"Gemini Enterprise Platform to provide Google","domain":null,"purpose":null,"location":null,"vendor_url":null},{"name":"Google Gemini Enterprise Platform","domain":null,"purpose":null,"location":null,"vendor_url":null},{"name":"Password Security Infrastructure and Cloud","domain":null,"purpose":null,"location":null,"vendor_url":null},{"name":"Postman has engaged and will deploy Google","domain":null,"purpose":null,"location":null,"vendor_url":null},{"name":"To provide Google","domain":null,"purpose":null,"location":null,"vendor_url":null}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-20T01:13:10.220Z"}