Boomi

Security and trust center evidence

Boomi is the leading cloud-based integration platform as a service (iPaaS) that enables businesses to connect applications, data, and

boomi.com Cloud and hostingLast verified 2 Nov 2026

Request the report Are you Boomi?

ISO 27001Vendor-stated

CSA STARVerified

Cyber EssentialsVendor-stated

ISO 27701Vendor-stated

ISO 42001Vendor-stated

SOC 1Vendor-stated

SOC 3Vendor-stated

ISO 27017Vendor-stated

ISO 27018Vendor-stated

Boomi has 3 registry-verified rows and 14 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Boomi is listed in the FedRAMP registry as FedRAMP Authorized, issued 12 Aug 2019, with the assessment performed by A-LIGN Compliance and Security, Inc. dba A-LIGN, as of 19 Sep 2026. Boomi states on its trust centre that it holds a SOC 2 Type 2 report, based on evidence collected via Drata as of 18 Sep 2026. Boomi also states on its trust centre that it holds ISO/IEC 27001:2022, based on evidence collected via Drata as of 18 Sep 2026. Boomi is listed in the CSA STAR registry with a Level 2 attestation issued 11 Sep 2024, as of 17 Sep 2026. Boomi displays a HIPAA badge on its trust centre as of 18 Sep 2026, but BAA availability has not yet been captured in the evidence reviewed.

FedRAMP: listed as FedRAMP Authorized, issued 12 Aug 2019, assessor A-LIGN (as of 19 Sep 2026).
SOC 2 Type 2 and ISO/IEC 27001:2022: vendor states on its trust centre (as of 18 Sep 2026).
HIPAA: vendor displays a badge on its trust centre, but BAA availability is not confirmed in the evidence (as of 18 Sep 2026).

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.

Among cloud and hosting vendors

3verified rows

Category median 0, across 145 indexed cloud and hosting vendors. Boomi has more verified rows than 94 percent of them.

api managementdata connectivityintegrationipaas

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for GDPR. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Data processing agreement

On request · Listed on the trust centre as "Data Processing Agreement" · as of 2 Nov 2026

Open

AI and data use policy

On request · Listed on the trust centre as "AI System Development and Evaluation Policy" · as of 2 Nov 2026

Open

Subprocessor list

On request · Listed on the trust centre as "Subprocessors" · as of 2 Nov 2026

Open

Subprocessors

No subprocessor list captured yet.

Security profile

Pen test cadence: report available

Displayed as a security profile from public statements, not as attestations, as of 2 Nov 2026.

Change history

22 Sep 2026DPA changedThe data processing agreement URL changed.
18 Sep 2026Cyber Essentials Plus evidence addedA Cyber Essentials Plus row entered the index with state Vendor-stated.
18 Sep 2026GovRAMP evidence addedA GovRAMP row entered the index with state Vendor-stated.
18 Sep 2026HIPAA evidence addedA HIPAA row entered the index with state Vendor-stated.
18 Sep 2026IRAP evidence addedA IRAP row entered the index with state Vendor-stated.
18 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Vendor-stated.
18 Sep 2026ISO/IEC 27017 evidence addedA ISO/IEC 27017 row entered the index with state Vendor-stated.
18 Sep 2026Cyber Essentials evidence addedA Cyber Essentials row entered the index with state Vendor-stated.
18 Sep 2026ISO/IEC 27701 evidence addedA ISO/IEC 27701 row entered the index with state Vendor-stated.
18 Sep 2026ISO/IEC 42001 evidence addedA ISO/IEC 42001 row entered the index with state Vendor-stated.

Similar vendors with evidence

Related by product tags and the Cloud and hosting category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.