Skip to main content
Commvault Systems logo

Commvault Systems

Security and trust center evidence

Only Commvault continuously recovers and restores the data powering your enterprise and agents to a clean, trusted

commvault.comCloud storageLast verified 2 Nov 2026
Request the report Are you Commvault Systems?

Summary

HIPAA mark, CertReports state Vendor-stated as of 21 Sep 2026HIPAAVendor-statedSOC 2 mark, CertReports state Vendor-stated as of 21 Sep 2026SOC 2Vendor-statedFedRAMP mark, CertReports state Vendor-stated as of 21 Sep 2026FedRAMPVendor-statedPCI DSS mark, CertReports state Vendor-stated as of 21 Sep 2026PCI DSSVendor-statedISO/IEC 27001 mark, CertReports state Vendor-stated as of 21 Sep 2026ISO 27001Vendor-statedCSA STAR mark, CertReports state Vendor-stated as of 21 Sep 2026CSA STARVendor-statedEU-US Data Privacy Framework mark, CertReports state Verified as of 2 Nov 2026DPFVerifiedTX-RAMP mark, CertReports state Vendor-stated as of 21 Sep 2026TX-RAMPVendor-statedIRAP mark, CertReports state Vendor-stated as of 21 Sep 2026IRAPVendor-stated

Commvault Systems has 1 registry-verified row and 8 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Commvault Systems states on its trust centre that it displays a HIPAA badge, though BAA availability has not yet been captured, as of 21 Sep 2026. Commvault also states on its trust centre that it holds a SOC 2 Type II report, is FedRAMP High Authorized, holds PCI DSS, and follows ISO 27001:2022, all as of 21 Sep 2026. The vendor further states on its trust centre that it holds CSA STAR Level 2, TX-RAMP, and IRAP, as of 21 Sep 2026. Separately, Commvault is listed in the DPF registry as active for EU-US, Swiss-US, and UK Extension certifications, with participation dated 17 Jun 2019 and valid through 9 Jan 2027, as of 26 Oct 2026. All framework claims other than the DPF registry listing rely on vendor statements rather than independent verification, as of 21 Sep 2026.

  • HIPAA: vendor states HIPAA badge on trust centre; BAA availability not confirmed, as of 21 Sep 2026.
  • SOC 2: vendor states it holds a SOC 2 Type II report, as of 21 Sep 2026; also states FedRAMP High Authorized, PCI DSS, ISO 27001:2022, CSA STAR Level 2, TX-RAMP, and IRAP on trust centre.
  • EU-US Data Privacy Framework: listed in DPF registry as active (EU-US, Swiss-US, UK Extension), participation dated 17 Jun 2019 through 9 Jan 2027, as of 26 Oct 2026.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 1 Nov 2026; it is regenerated whenever a row changes.

Among cloud storage vendors

1verified rows

Category median 1, across 51 indexed cloud storage vendors. Commvault Systems has more verified rows than 43 percent of them.

data backupdata protectiondisaster recoveryransomware recovery

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for GDPR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Subprocessors (13)

Security profile

Pen test cadence
annual

Displayed as a security profile from public statements, not as attestations, as of 21 Sep 2026.

Change history

  1. 18 Sep 2026CSA STAR evidence addedA CSA STAR row entered the index with state Vendor-stated.
  2. 18 Sep 2026FedRAMP evidence addedA FedRAMP row entered the index with state Vendor-stated.
  3. 18 Sep 2026HIPAA evidence addedA HIPAA row entered the index with state Vendor-stated.
  4. 18 Sep 2026IRAP evidence addedA IRAP row entered the index with state Vendor-stated.
  5. 18 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Vendor-stated.
  6. 18 Sep 2026PCI DSS evidence addedA PCI DSS row entered the index with state Vendor-stated.
  7. 18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
  8. 18 Sep 2026TX-RAMP evidence addedA TX-RAMP row entered the index with state Vendor-stated.
  9. 18 Sep 2026Subprocessor added: Amazon Web Services (AWS)Amazon Web Services (AWS) appeared on the subprocessor list.
  10. 18 Sep 2026Subprocessor added: ClumioClumio appeared on the subprocessor list.

Similar vendors with evidence

Related by product tags and the Cloud storage category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.

afi.ai logo

afi.ai

Cloud storage

Intelligent data protection, purpose-built for cloud

DPF mark, CertReports state Verified
1 verified2 Nov 2026
Druva logo

Druva

Cloud storage

The Druva Data Resiliency Cloud is the only at-scale SaaS platform designed for your multi-cloud

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedFedRAMP mark, CertReports state VerifiedPCI DSS mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-stated
2 verified · 8 stated2 Nov 2026
Global Data Vault logo

Global Data Vault

Cloud storage

Global Data Vault is now

DPF mark, CertReports state Expired
2 Nov 2026
Axcient logo

Axcient

Cloud storage

Our mission is to cure data loss, providing Managed Service Providers (MSPs) with tailor-made Business Continuity and Disaster Recovery

CSA STAR mark, CertReports state VerifiedDPF mark, CertReports state Expired
1 verified2 Nov 2026

Evidence against regulations

All regulations for Commvault Systems

How much of each regulation’s vendor requirements Commvault Systems’s public evidence reaches.

Reviewing a vendor on public evidence

All articles