BigCommerce
Security and trust center evidence
BigCommerce, founded in 2009, is a leading open software-as-a-service (SaaS) ecommerce platform that empowers merchants of all sizes to
Summary
SOC 2Vendor-stated
GDPRVendor-stated
PCI DSSVerified
ISO 27001Vendor-stated
CSA STARVerified
ISO 27701Vendor-statedISO 42001Vendor-statedSOC 1Vendor-statedSOC 3Vendor-stated
ISO 27017Vendor-stated
ISO 27018Vendor-statedISO 22301Vendor-stated
CCPAVendor-stated
TX-RAMPVendor-statedBigCommerce has 2 registry-verified rows and 12 vendor-stated rows in the CertReports index, last verified 3 Nov 2026. The strongest row is SOC 2: Vendor states SOC 2 on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
BigCommerce is listed in the Visa Global Registry as PCI DSS validated through 30 Sep 2027, with the entry issued on 7 Feb 2025 and audited by Foregenix Ltd., as of 19 Oct 2026. BigCommerce is listed in the CSA STAR registry with a Level 1 self-assessment (CAIQ) dated 12 Aug 2023, as of 19 Oct 2026. BigCommerce states on its trust centre that it holds SOC 1, SOC 2, and SOC 3 reports, as of 19 Oct 2026. BigCommerce states on its trust centre that it holds ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019, ISO/IEC 27701, ISO/IEC 42001, and ISO 22301, as of 19 Oct 2026. BigCommerce states on its trust centre that it addresses GDPR, CCPA/CPRA, and TX-RAMP, and no public evidence found for HIPAA, as of 19 Oct 2026.
- PCI DSS - listed in Visa Global Registry, valid through 30 Sep 2027 (as of 19 Oct 2026)
- SOC 2 - states it holds a SOC 2 report (as of 19 Oct 2026)
- ISO/IEC 27001:2022 - states it holds on its trust centre (as of 19 Oct 2026)
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Oct 2026; it is regenerated whenever a row changes.
Among e-commerce vendors
2verified rows
Category median 1, across 128 indexed e-commerce vendors. BigCommerce has more verified rows than 92 percent of them.
merchant toolsonline storesaas platformshopping cart
Compare with similar vendors
Pick your own comparisonCompliance grid
- SOC 2Vendor-stated
Vendor states SOC 2 on its trust centre
as of 3 Nov 202623 sources - GDPRVendor-stated
Vendor states GDPR on its trust centre
as of 3 Nov 202623 sources - PCI DSSVerified
Listed on the Visa Global Registry as PCI DSS validated through 2027-09-30
as of 2 Nov 20264 sources · Foregenix Ltd. - ISO/IEC 27001Vendor-stated
Vendor states ISO/IEC 27001:2022 on its trust centre
as of 3 Nov 202623 sources - CSA STARVerified
STAR Level 1 self-assessment (CAIQ)
as of 26 Oct 20266 sources - ISO/IEC 27701Vendor-stated
Vendor states ISO/IEC 27701 on its trust centre
as of 3 Nov 202623 sources - ISO/IEC 42001Vendor-stated
Vendor states ISO/IEC 42001 on its trust centre
as of 3 Nov 202623 sources - SOC 1Vendor-stated
Vendor states SOC 1 on its trust centre
as of 3 Nov 202623 sources - SOC 3Vendor-stated
Vendor states SOC 3 on its trust centre
as of 3 Nov 202623 sources - ISO/IEC 27017Vendor-stated
Vendor states ISO/IEC 27017:2015 on its trust centre
as of 3 Nov 202623 sources - ISO/IEC 27018Vendor-stated
Vendor states ISO/IEC 27018:2019 on its trust centre
as of 3 Nov 202623 sources - ISO 22301Vendor-stated
Vendor states ISO 22301 on its trust centre
as of 3 Nov 202623 sources - CCPA / CPRAVendor-stated
Vendor states CCPA on its trust centre
as of 3 Nov 202623 sources - TX-RAMPVendor-stated
Vendor states TX-RAMP on its trust centre
as of 3 Nov 202623 sources
No public evidence yet for HIPAA, FedRAMP, Cyber Essentials. This does not mean the vendor lacks them; it means nothing public was found at the last check.
Legal artefacts
Subprocessors
No subprocessor list captured yet.
Security profile
- Pen test cadence
- report available
Displayed as a security profile from public statements, not as attestations, as of 3 Nov 2026.
Change history
- 19 Oct 2026PCI DSS renewedExpiry moved from 2027-05-31 to 2027-09-30.
- 19 Oct 2026PCI DSS auditor changedAuditor changed from Coalfire Systems, Inc to Foregenix Ltd..
- 12 Oct 2026PCI DSS renewedExpiry moved from 2026-10-31 to 2027-05-31.
- 12 Oct 2026PCI DSS auditor changedAuditor changed from CYBERCUBE SERVICES PVT. LTD. to Coalfire Systems, Inc.
- 29 Sep 2026PCI DSS auditor changedAuditor changed from Coalfire Systems, Inc to CYBERCUBE SERVICES PVT. LTD..
- 22 Sep 2026DPA changedThe data processing agreement URL changed.
- 18 Sep 2026CCPA / CPRA evidence addedA CCPA / CPRA row entered the index with state Vendor-stated.
- 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
- 18 Sep 2026ISO 22301 evidence addedA ISO 22301 row entered the index with state Vendor-stated.
- 18 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Vendor-stated.
Similar vendors with evidence
Related by product tags and the E-commerce category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
Volusion
E-commerce
Our ecommerce web design solutions will help you create your online store w/ a FREE 14-day trial of our shopping cart
3dcart
E-commerce
Learn how to find the best eCommerce
Ecwid
E-commerce
Launch your online store easily—no tech skills
eVance
E-commerce
Our Offers All-In-One ecommerce solutions ZERO CAPITAL INVESTMENT Why buy eCommerce software, when you can pay as you go? OLB is a leading
Evidence against regulations
All regulations for BigCommerceHow much of each regulation’s vendor requirements BigCommerce’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read