How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
Boomi
GDPR evidence
Boomi is the leading cloud-based integration platform as a service (iPaaS) that enables businesses to connect applications, data, and
No public evidenceBoomi and GDPR
CertReports found no public GDPR evidence for Boomi as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
Vendor-statedVendor states ISO/IEC 27701:2019 on its trust centre
as of 1 Nov 2026 · confidence 80%| Source | Captured | Quote | Links |
|---|---|---|---|
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 1 Nov 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 31 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 29 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 27 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 25 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 23 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 21 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 19 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 17 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 15 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 13 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 11 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 9 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 7 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 5 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 3 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 1 Oct 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 29 Sep 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 27 Sep 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 25 Sep 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 21 Sep 2026 | ISO/IEC 27701:2019 | |
Boomi trust centre (Drata) Vendor trust centre · HTTP 200 | 18 Sep 2026 | ISO/IEC 27701:2019 |
VerifiedActive: EU-US Certification, UK Extension Certification, SW-US Certification
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 6 Dec 2024
- Expires or valid through
- 22 Jan 2027
- Scope
- In the regular course of business, Boomi LP will often collect, store and use personal data for legitimate business purposes, using this information to support and enhance our relationship with customers and employees. Customer Data Customer data is collected directly from the customer through their interactions, use and experiences with our website, products and services. Boomi may also obtain personal data indirectly from our Business Partners and third-party sources. Customer personal data is used to provide our customers with our products and services, improve our products and services, tailor customer experience with Boomi, personalise our products and services and make recommendations to customers, advertise and market to customers, and to comply with applicable laws. Customer personal data is also used to improve the safety of our website, products and services, which includes detecting, preventing and responding to fraud and security risks that could harm our customers or Boomi. We may share customer personal data with our affiliated companies, and Business Partners to perform work for us, including completing any transaction, providing customers with the latest information about our products and services, offering customers our latest promotions. These third party sources vary over time and may include: • Data brokers from which we purchase demographic data to supplement the information we have collected about customers. • Communication services, including email providers and social networks, when customers give permission to access their information on such third party services or networks. • Partners with which we offer co-branded products or services, or engage in joint marketing activities. • Publicly available sources, such as open government databases. HR Data Boomi processes HR personal data for the purpose of managing employment relationships, including the provision of employment related services: personnel administration and management, payroll services (for example, we need bank account details in order to pay salaries), provision of employee benefits, managing performance and individual career development, monitoring adherence to Boomi's Code of Conduct, applicable company policies, standards, controls and procedures. Boomi processes HR personal data to assist in conducting business more effectively and efficiently (for example, data analysis, collecting and assessing feedback, identifying usage trends and determine the effectiveness of our Culture Code and applicable compliance training). We may deploy specific technologies for the purposes of enabling global-level HR analysis, workforce planning, diversity monitoring, monitoring ongoing adherence to company policies and procedures which may include authorised use and access of Boomi IT systems (i.e., how you use the systems, content, etc.) in order to identify any unusual or malicious behaviour as well as for site management and security, accounting purposes or financial planning. We may also subsequently further process HR personal data to investigate potential violations of law or alleged breaches of our company policies, standards and procedures. We maintain a global directory of employees that will contain contact details (such as name, job position, Boomi office location, work email address, photo and contact number). This information will be visible to authorized Boomi personnel to facilitate global communication, collaboration and teamwork. HR data may be shared with third parties such as: • Boomi Affiliated Companies • Third party service providers • Other third parties where necessary to comply with legal obligations, sale or restructuring of business operations, protecting vital interests of another person, or where we have otherwise obtained data subject consent.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Boomi: Active: EU-US Certification, UK Extension Certification, SW-US Certification | Live pagesha256 a342ede84f |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Boomi GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 22 Sep 2026DPA changedThe data processing agreement URL changed.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Cloud and hosting category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Understand GDPR evidence
All articlesExplainers
The EU-US Data Privacy Framework, explained for vendor reviews
Solomon Amos · 7 Sep 2026 · 10 min read