Evervault

Security and trust center evidence

Evervault specializes in data encryption and confidential computing, helping customers address data security and compliance across various

evervault.com Compliance and GRCLast verified 2 Nov 2026

Request the report Are you Evervault?

Evervault has 2 registry-verified rows and 3 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Evervault states on its trust centre that it holds SOC 2, as of 21 Sep 2026, without a published SOC 2 Type II report in these rows. Evervault states on its trust centre that it holds GDPR, as of 21 Sep 2026. A HIPAA badge appears on Evervault's trust centre, as of 21 Sep 2026, though BAA availability is not yet captured in this evidence. Evervault is listed in the Visa Global Registry as PCI DSS validated through 30 Nov 2026, as of 19 Oct 2026, issued 19 Sep 2013 and audited by CMC Cyber Security Limited Company. Evervault is also listed in the CSA STAR registry at Level 1 self-assessment (CAIQ), as of 19 Oct 2026, issued 3 Jan 2024.

PCI DSS: listed in Visa Global Registry, validated through 30 Nov 2026 (as of 19 Oct 2026), auditor CMC Cyber Security Limited Company.
SOC 2: vendor states on its trust centre as of 21 Sep 2026; no report evidence supplied.
HIPAA: badge displayed on trust centre as of 21 Sep 2026; BAA availability not yet captured.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 21 Oct 2026; it is regenerated whenever a row changes.

Among compliance and grc vendors

2verified rows

Category median 1, across 179 indexed compliance and grc vendors. Evervault has more verified rows than 89 percent of them.

complianceconfidential computingdata encryptiondata protection

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for FedRAMP, ISO 27001, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Subprocessor list

Public · 14 subprocessors listed on the trust centre · as of 21 Sep 2026

Open

Public · as of 21 Sep 2026

Open

Data processing agreement

On request · Listed on the trust centre as "Evervault Data Processing Agreement Jan 2026" · as of 21 Sep 2026

Open

Subprocessors (14)

3I
3DSecure.ioFailover provider for 3D-Secure authentications · EU
AL
AlgunaInvoicing · US
Amazon Web ServicesUS East, EU West
Auth0US
CS
Clone SystemsVulnerability Scanning · EU
CloudflareUS, Global
DatadogCloud monitoring · US
Evervault Inc. (USA)Engineering and support personnel · US
GitHubVersion control · US, EU
Google WorkspaceUS, EU
HubspotMarketing · US, EU
SendGridEmail Service · US, EU
VercelCloud provider · US
VA
Visa Acceptance SolutionsPayments Services · US, EU

Security profile

Pen test cadence: annual

Displayed as a security profile from public statements, not as attestations, as of 21 Sep 2026.

Change history

19 Oct 2026PCI DSS auditor changedAuditor changed from Insside Information Inteligente SRL to CMC Cyber Security Limited Company.
12 Oct 2026PCI DSS auditor changedAuditor changed from Prescient Security, LLC to Insside Information Inteligente SRL.
22 Sep 2026DPA changedThe data processing agreement URL changed.
18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
18 Sep 2026HIPAA evidence addedA HIPAA row entered the index with state Vendor-stated.
18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
18 Sep 2026Subprocessor added: 3DSecure.io3DSecure.io appeared on the subprocessor list.
18 Sep 2026Subprocessor added: AlgunaAlguna appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Auth0Auth0 appeared on the subprocessor list.

Similar vendors with evidence

Related by product tags and the Compliance and GRC category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.