Descript

Security and trust center evidence

Descript is the AI video and audio editor that makes editing as easy as editing

descript.com Media and contentLast verified 2 Nov 2026

Request the report Are you Descript?

SOC 2Vendor-stated

GDPRVendor-stated

DPFExpired

Descript has 2 vendor-stated rows, and 1 expired in the CertReports index, last verified 2 Nov 2026. The strongest row is SOC 2: Vendor states SOC 2 Type II on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Descript states on its trust centre, as of 21 Sep 2026, that it has a SOC 2 Type II report. Descript also states on its trust centre, as of 21 Sep 2026, that it complies with GDPR. The EU-US Data Privacy Framework listing for Descript is marked inactive, per the Data Privacy Framework registry as of 12 Oct 2026, with no issuance date on record. No public evidence found for ISO/IEC 27001, PCI DSS, FedRAMP, or HIPAA frameworks for Descript as of 12 Oct 2026. Reviewers should treat the SOC 2 and GDPR statements as vendor-asserted rather than independently verified, per the trust centre record dated 21 Sep 2026.

SOC 2: vendor states it has a SOC 2 Type II report on its trust centre as of 21 Sep 2026.
GDPR: vendor states compliance on its trust centre as of 21 Sep 2026.
EU-US Data Privacy Framework: listed inactive per the Data Privacy Framework registry as of 12 Oct 2026.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 13 Oct 2026; it is regenerated whenever a row changes.

Among media and content vendors

0verified rows

Category median 0, across 63 indexed media and content vendors. Descript has no registry-verified row yet, like 54 percent of them; its evidence is vendor-stated or reported.

audio editingpodcast productiontranscriptionvideo editing

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, FedRAMP, PCI DSS, ISO 27001, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

No DPA, BAA or subprocessor list has been captured from a public page yet. Registry rows above do not depend on this. Check the vendor trust centre.

Subprocessors

No subprocessor list captured yet.

Change history

12 Oct 2026EU-US Data Privacy Framework evidence addedA EU-US Data Privacy Framework row entered the index with state Expired.
22 Sep 2026First indexed by CertReports2 evidence rows across 2 frameworks entered the index.

Similar vendors with evidence

Related by product tags and the Media and content category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.