Culture Amp
Security and trust center evidence
Empower your teams and fuel positive change with performance, development, and employee engagement tools – all-in-one intuitive employee
Summary
SOC 2Vendor-stated
GDPRVendor-stated
ISO 27001Vendor-stated
CSA STARVerified
ISO 42001Vendor-stated
CCPAVendor-stated
IRAPVendor-statedCulture Amp has 1 registry-verified row and 6 vendor-stated rows in the CertReports index, last verified 26 Oct 2026. The strongest row is SOC 2: Vendor states SOC 2 on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
Culture Amp states SOC 2 on its trust centre as of 21 Sep 2026. Culture Amp is listed in the CSA STAR registry with a Level 1 self-assessment (CAIQ) and Trusted Cloud Provider status, originally issued 22 Nov 2024, as of 29 Sep 2026. Culture Amp states ISO/IEC 27001 and GDPR on its trust centre as of 21 Sep 2026. Culture Amp also states ISO/IEC 42001:2023 and IRAP on its trust centre as of 21 Sep 2026. Culture Amp also states CCPA compliance on its trust centre as of 21 Sep 2026.
- SOC 2 - vendor-stated on trust centre (21 Sep 2026), no independent report in evidence
- CSA STAR - listed in registry, Level 1 self-assessment (CAIQ) and Trusted Cloud Provider status issued 22 Nov 2024 (as of 29 Sep 2026)
- HIPAA - no public evidence found
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 2 Oct 2026; it is regenerated whenever a row changes.
Among hr and hris vendors
1verified rows
Category median 0, across 94 indexed hr and hris vendors. Culture Amp has more verified rows than 56 percent of them.
employee engagementemployee surveyspeople analyticsperformance management
Compare with similar vendors
Pick your own comparisonCompliance grid
- SOC 2Vendor-stated
Vendor states SOC 2 on its trust centre
as of 21 Sep 20262 sources - GDPRVendor-stated
Vendor states GDPR on its trust centre
as of 21 Sep 20262 sources - ISO/IEC 27001Vendor-stated
Vendor states ISO/IEC 27001 on its trust centre
as of 21 Sep 20262 sources - CSA STARVerified
STAR Level 1 self-assessment (CAIQ), Trusted Cloud Provider
as of 26 Oct 20265 sources - ISO/IEC 42001Vendor-stated
Vendor states ISO/IEC 42001:2023 on its trust centre
as of 21 Sep 20262 sources - CCPA / CPRAVendor-stated
Vendor states CCPA on its trust centre
as of 21 Sep 20262 sources - IRAPVendor-stated
Vendor states IRAP on its trust centre
as of 21 Sep 20262 sources
No public evidence yet for HIPAA, FedRAMP, PCI DSS, Cyber Essentials, ISO 27701. This does not mean the vendor lacks them; it means nothing public was found at the last check.
Legal artefacts
Subprocessors
No subprocessor list captured yet.
Security profile
- Pen test cadence
- report available
Displayed as a security profile from public statements, not as attestations, as of 21 Sep 2026.
Change history
- 29 Sep 2026CSA STAR state changedState moved from Vendor-stated to Verified.
- 19 Sep 2026First indexed by CertReports7 evidence rows across 7 frameworks entered the index.
Similar vendors with evidence
Related by product tags and the HR and HRIS category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
15Five
HR and HRIS
15Five is the performance management platform that creates effective managers, highly engaged employees, and top-performing
Quantum Workplace
Collaboration
Build thriving teams with Quantum Workplace's HR
Lattice
HR and HRIS
Modern people management platform.
Mesh
HR and HRIS
Performance management platform that fits the way you work
Evidence against regulations
All regulations for Culture AmpHow much of each regulation’s vendor requirements Culture Amp’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read