{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"statsig","name":"Statsig","domain":"statsig.com","category":"Developer tools","one_liner":"Statsig is your modern product development platform, with an integrated toolkit for experimentation, feature management, product analytics","trust_center_url":"https://trust.amplitude.com/","security_page_url":null,"url":"https://certreports.com/vendors/statsig/security","last_verified_at":"2026-09-21T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on custom as of 21 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 2 Type II on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"custom","url":"https://certreports.com/vendors/statsig/soc-2","evidence":[{"source_type":"trust_center","source_name":"Statsig trust centre (Custom)","url":"https://trust.amplitude.com/","fetched_at":"2026-09-21 22:21:56.297615+00","content_hash":"38d791cfe57cc0482daff75f206307f127266ef514b0443e801cbd4462b31705","wayback_url":null,"quote":"SOC 2 Type II","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on custom as of 21 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"custom","url":"https://certreports.com/vendors/statsig/gdpr","evidence":[{"source_type":"trust_center","source_name":"Statsig trust centre (Custom)","url":"https://trust.amplitude.com/","fetched_at":"2026-09-21 22:21:56.297615+00","content_hash":"38d791cfe57cc0482daff75f206307f127266ef514b0443e801cbd4462b31705","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on custom as of 21 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"custom","url":"https://certreports.com/vendors/statsig/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Statsig trust centre (Custom)","url":"https://trust.amplitude.com/","fetched_at":"2026-09-21 22:21:56.297615+00","content_hash":"38d791cfe57cc0482daff75f206307f127266ef514b0443e801cbd4462b31705","wayback_url":null,"quote":"ISO 27001","confidence":1}]},{"framework":"soc-1","framework_name":"SOC 1","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 1 Type II report on custom as of 21 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 1 Type II on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"custom","url":"https://certreports.com/vendors/statsig/security","evidence":[{"source_type":"trust_center","source_name":"Statsig trust centre (Custom)","url":"https://trust.amplitude.com/","fetched_at":"2026-09-21 22:21:56.297615+00","content_hash":"38d791cfe57cc0482daff75f206307f127266ef514b0443e801cbd4462b31705","wayback_url":null,"quote":"SOC 1 Type II","confidence":1}]},{"framework":"iso-27017","framework_name":"ISO/IEC 27017","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27017 certificate on custom as of 21 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27017 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"custom","url":"https://certreports.com/vendors/statsig/security","evidence":[{"source_type":"trust_center","source_name":"Statsig trust centre (Custom)","url":"https://trust.amplitude.com/","fetched_at":"2026-09-21 22:21:56.297615+00","content_hash":"38d791cfe57cc0482daff75f206307f127266ef514b0443e801cbd4462b31705","wayback_url":null,"quote":"ISO 27017","confidence":1}]},{"framework":"iso-27018","framework_name":"ISO/IEC 27018","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27018 certificate on custom as of 21 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27018 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"custom","url":"https://certreports.com/vendors/statsig/security","evidence":[{"source_type":"trust_center","source_name":"Statsig trust centre (Custom)","url":"https://trust.amplitude.com/","fetched_at":"2026-09-21 22:21:56.297615+00","content_hash":"38d791cfe57cc0482daff75f206307f127266ef514b0443e801cbd4462b31705","wayback_url":null,"quote":"ISO 27018","confidence":1}]},{"framework":"ccpa","framework_name":"CCPA / CPRA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an CCPA / CPRA privacy notice on custom as of 21 Sep 2026.","kind":null,"status_text":"Vendor states CCPA on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"custom","url":"https://certreports.com/vendors/statsig/security","evidence":[{"source_type":"trust_center","source_name":"Statsig trust centre (Custom)","url":"https://trust.amplitude.com/","fetched_at":"2026-09-21 22:21:56.297615+00","content_hash":"38d791cfe57cc0482daff75f206307f127266ef514b0443e801cbd4462b31705","wayback_url":null,"quote":"CCPA","confidence":1}]}],"brief":{"summary":"Statsig, a developer tools vendor, states SOC 2 Type II on its trust centre as of 21 Sep 2026. Statsig states SOC 1 Type II on its trust centre as of 21 Sep 2026, alongside its SOC 2 Type II claim. Statsig states GDPR on its trust centre as of 21 Sep 2026, covering its handling of personal data. Statsig states CCPA/CPRA on its trust centre as of 21 Sep 2026, covering California consumer privacy requirements. As of 21 Sep 2026, Statsig also states ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018 on its trust centre, covering information security and cloud privacy management.","bullets":["SOC 2 Type II: vendor-stated on trust centre, no report evidence captured (as of 21 Sep 2026).","ISO/IEC 27001, 27017 and 27018: vendor-stated only (as of 21 Sep 2026).","GDPR and CCPA/CPRA: vendor-stated privacy claims, no DPA or audit evidence captured (as of 21 Sep 2026)."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-22 10:07:27.033181+00"},"legal_docs":[{"kind":"subprocessors","url":"https://trust.amplitude.com/","availability":"public","detail":"9 subprocessors listed on the trust centre","as_of":"2026-09-21"}],"documents":[],"statements":[],"security_profile":{"iso42001":null,"trains_on_customer_data":null,"data_residency_regions":[],"pen_test_cadence":null,"as_of":"2026-09-21"},"regulations_url":"https://certreports.com/api/v1/vendors/statsig/regulations/{regulation}","subprocessors":[{"name":"amazonwebservices.com","domain":"amazonwebservices.com","purpose":"Cloud hosting and infrastructure provider; generative AI technology used to enhance Amplitude's AI features (AWS Bedrock).","location":"United States, Germany","vendor_url":null},{"name":"Datadog","domain":"datadoghq.com","purpose":"Logging and operational monitoring.","location":"United States","vendor_url":"https://certreports.com/vendors/datadog/security"},{"name":"Fivetran","domain":"fivetran.com","purpose":"Cloud-based data movement platform.","location":"United States, Germany","vendor_url":"https://certreports.com/vendors/fivetran/security"},{"name":"Google","domain":"google.com","purpose":"Generative AI technology, delivered via Google Vertex AI, used to enhance Amplitude’s AI features; cloud hosting and infrastructure provider for the Statsig-branded Amplitude Services (US only).","location":"United States, EU","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"Microsoft","domain":"microsoft.com","purpose":"Cloud service Provider for the Statsig-branded Amplitude Services.","location":"United States","vendor_url":"https://certreports.com/vendors/microsoft/security"},{"name":"MongoDB","domain":"mongodb.com","purpose":"Database provider for the Statsig-branded Amplitude Services.","location":"United States","vendor_url":"https://certreports.com/vendors/mongodb/security"},{"name":"OpenAI","domain":"openai.com","purpose":"Generative AI technology used to enhance Amplitude’s AI features.","location":"United States, EU","vendor_url":"https://certreports.com/vendors/openai/security"},{"name":"Snowflake","domain":"snowflake.com","purpose":"Data warehousing services (if Customer has purchased an applicable add-on service or is using AI Feedback).","location":"United States, Germany (for AI Feedback only)","vendor_url":"https://certreports.com/vendors/snowflake/security"},{"name":"Wiz","domain":"wiz.io","purpose":"Security vulnerability management and detection.","location":"United States, Germany","vendor_url":"https://certreports.com/vendors/wiz/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-22T10:07:42.584Z"}