Appcues

Security and trust center evidence

Appcues is an AI-powered customer engagement platform that triggers in-app, email, and push experiences right when users are paying

appcues.com MarketingLast verified 26 Oct 2026

Request the report Are you Appcues?

Appcues has 1 registry-verified row and 4 vendor-stated rows in the CertReports index, last verified 26 Oct 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Appcues states on its trust centre that it displays a HIPAA badge, as of 18 Sep 2026, though this evidence does not confirm BAA availability. Appcues states on its trust centre that it holds a SOC 2 Type II report, as of 18 Sep 2026. Appcues states on its trust centre that it addresses GDPR, as of 18 Sep 2026. Appcues is listed in the EU-US Data Privacy Framework registry as active across the EU-US Certification, SW-US Certification and UK Extension Certification, originally issued 6 Mar 2018 and set to expire 1 Apr 2027, according to the registry as of 17 Sep 2026. Appcues states on its trust centre that it addresses CCPA / CPRA, as of 18 Sep 2026.

SOC 2: vendor states on its trust centre it holds a SOC 2 Type II report (as of 18 Sep 2026)
HIPAA: vendor states it displays a HIPAA badge on its trust centre; BAA availability not confirmed (as of 18 Sep 2026)
EU-US Data Privacy Framework: listed active (EU-US, SW-US, UK Extension), issued 6 Mar 2018, expires 1 Apr 2027 (registry as of 17 Sep 2026)

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 21 Sep 2026; it is regenerated whenever a row changes.

Among marketing vendors

1verified rows

Category median 0, across 181 indexed marketing vendors. Appcues has more verified rows than 57 percent of them.

customer engagementin-app messagingproduct onboardingpush notificationsuser activation

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for FedRAMP, PCI DSS, ISO 27001, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Subprocessor list

Public · 7 subprocessors listed on the trust centre · as of 30 Sep 2026

Open

Public · as of 30 Sep 2026

Open

Business associate agreement

On request · Listed on the trust centre as "Appcues Business Associate Agreement Addendum" · as of 30 Sep 2026

Open

Subprocessors (7)

AW
Amazon Web ServicesPrimary infrastructure provider for Appcues applications and services · USA & EU
CL
ClickHouseProvides managed database services. · USA & EU
CO
ConfluentInfrastructure provider, managing Apache Kafka as a service. · USA & EU
LA
LangfuseProvides monitoring and quality testing tools for optional Appcues AI features · USA & EU
MA
MailgunUsed for delivering emails as part of the Appcues out-of-product messaging product. · USA & EU
OpenAIProvides AI model services for optional Appcues AI features. · USA & EU
SN
SnowflakeAnalytics database for calculating aggregate statistics for production. · USA & EU

Security profile

Pen test cadence: annual
Data residency: EU, Germany, US
Trains on customer data: no

Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.

Change history

22 Sep 2026BAA availability changedBAA availability moved from unknown to on_request.
22 Sep 2026AI training policy changedTraining on customer data moved from unknown to no.
18 Sep 2026HIPAA evidence addedA HIPAA row entered the index with state Vendor-stated.
18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
18 Sep 2026Subprocessor added: ClickHouseClickHouse appeared on the subprocessor list.
18 Sep 2026CCPA / CPRA evidence addedA CCPA / CPRA row entered the index with state Vendor-stated.
18 Sep 2026Subprocessor added: LangfuseLangfuse appeared on the subprocessor list.
18 Sep 2026Subprocessor added: MailgunMailgun appeared on the subprocessor list.
18 Sep 2026Subprocessor added: OpenAIOpenAI appeared on the subprocessor list.