Basis Theory

Security and trust center evidence

More than a token vaultâBasis Theory routes, tokenizes, and optimizes your payments to drive conversion, resilience, and

basistheory.com PaymentsLast verified 1 Nov 2026

Request the report Are you Basis Theory?

SOC 2Vendor-stated

PCI DSSVerified

ISO 27001Vendor-stated

ISO 27701Vendor-stated

SOC 3Vendor-stated

DPFVerified

Basis Theory has 2 registry-verified rows and 4 vendor-stated rows in the CertReports index, last verified 1 Nov 2026. The strongest row is SOC 2: Vendor states SOC2 type 2 on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Basis Theory is listed in the Visa Global Registry as PCI DSS validated, as of 26 Oct 2026, with the entry covering validation from 8 Jul 2020 through 30 Jun 2027 and naming CYBERCUBE SERVICES PVT. LTD. as the auditor. Basis Theory states on its trust centre, as of 28 Oct 2026, that it holds a SOC 2 Type II report and a SOC 3 report. Basis Theory states on its trust centre, as of 28 Oct 2026, that it holds ISO/IEC 27001 and ISO/IEC 27701. Basis Theory is listed in the EU-US Data Privacy Framework registry, as of 26 Oct 2026, with active EU-US, Swiss-US and UK Extension certifications issued 25 Oct 2024 and running through 18 Sep 2027. No public evidence of a HIPAA BAA was found for Basis Theory as of 26 Oct 2026.

PCI DSS: listed in the Visa Global Registry, validated through 30 Jun 2027 (as of 26 Oct 2026).
SOC 2 Type II, SOC 3, ISO/IEC 27001 and ISO/IEC 27701: vendor states on its trust centre (as of 28 Oct 2026).
EU-US Data Privacy Framework: listed in registry, active through 18 Sep 2027 (as of 26 Oct 2026).

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 28 Oct 2026; it is regenerated whenever a row changes.

Among payments vendors

2verified rows

Category median 1, across 737 indexed payments vendors. Basis Theory has more verified rows than 97 percent of them.

payment routingpci-compliancetokenizationvault

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, GDPR, FedRAMP, CSA STAR, Cyber Essentials, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Subprocessor list

On request · Listed on the trust centre as "Subprocessors" · as of 1 Nov 2026

Open

Subprocessors

No subprocessor list captured yet.

Security profile

Pen test cadence: report available

Displayed as a security profile from public statements, not as attestations, as of 1 Nov 2026.

Change history

26 Oct 2026PCI DSS auditor changedAuditor changed from International Certificate Authority of Management System to CYBERCUBE SERVICES PVT. LTD..
26 Oct 2026PCI DSS renewedExpiry moved from 2026-12-31 to 2027-06-30.
19 Oct 2026PCI DSS auditor changedAuditor changed from Baker Tilly Advisory Group, LP to International Certificate Authority of Management System.
29 Sep 2026EU-US Data Privacy Framework renewedExpiry moved from 2026-10-02 to 2027-09-18.
18 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Vendor-stated.
18 Sep 2026SOC 3 evidence addedA SOC 3 row entered the index with state Vendor-stated.
18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
18 Sep 2026ISO/IEC 27701 evidence addedA ISO/IEC 27701 row entered the index with state Vendor-stated.