Expensify

Security and trust center evidence

Expensify, Inc. is an American software company that develops an expense management system for personal and business use

expensify.com Finance and accountingLast verified 26 Oct 2026

Request the report Are you Expensify?

Expensify has 2 registry-verified rows and 4 vendor-stated rows in the CertReports index, last verified 26 Oct 2026. The strongest row is SOC 2: Vendor states SOC 2 on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Expensify states on its trust centre that it holds SOC 2, as of 30 Sep 2026. Expensify states on its trust centre that it holds SOC 1, as of 30 Sep 2026. Expensify states on its trust centre that it holds GDPR and CCPA/CPRA compliance, as of 30 Sep 2026. Expensify is listed in the Visa Global Registry as PCI DSS validated through 30 Apr 2027, issued on 13 Mar 2008 and audited by Network Intelligence Pvt. Ltd., as of 26 Oct 2026. Expensify is listed in the EU-US Data Privacy Framework registry as active for UK Extension Certification, SW-US Certification, and EU-US Certification, issued on 29 Nov 2016 and expiring on 14 Jan 2027, as of 26 Oct 2026.

PCI DSS - listed in Visa Global Registry, validated through 30 Apr 2027 (as of 26 Oct 2026)
SOC 2 - vendor states it holds SOC 2 (as of 30 Sep 2026)
EU-US DPF - listed as active, expires 14 Jan 2027 (as of 26 Oct 2026)

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 26 Oct 2026; it is regenerated whenever a row changes.

Among finance and accounting vendors

2verified rows

Category median 1, across 176 indexed finance and accounting vendors. Expensify has more verified rows than 89 percent of them.

corporate spendexpense managementreceipt scanningreimbursement

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, FedRAMP, ISO 27001, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Subprocessor list

Public · 32 subprocessors listed on the trust centre · as of 30 Sep 2026

Open

Public · as of 30 Sep 2026

Open

Subprocessors (32)

AI
AirshipCustomer Notification Delivery · US
Amazon Web ServicesCloud Infrastructure Provider · US
AshbyRecruiting · US
CA
CalendlyMeeting Scheduling · US
CH
CheckbookPayment Processor · US
CL
ClearbitAccount Configuration · US
CL
CloudFactoryReceipt Scanning · Nepal
CloudflareCloud Security and Infrastructure · US; Globally for CDN
CL
CloudtaskSales and Support · US
CS
Collective SolutionsReceipt Scanning · Honduras
DocuSignDocument Management · US
EV
EvocativeData Center Provider · US
FullStoryProduct and design
GitHubVersion Control · US
GongSales
Google DriveDocument management · US
Google WorkspaceIdentity provider · US
HubSpotCRM · US
KP
Ketch Privacy OrchestratorPrivacy rights management · US
MailgunEmail sending · US
OpenAILLM model provider · US
PlaidTransaction import · US;EU;UK
SentryApplication monitoring · US
SlackInternal chat system · US
StripeCredit card billing · US
SW
SwitchData Center Provider · US
TB
The Bancorp Bank, N.A.Payment Processor · US
TwilioText message provider · US
TypeformCustomer questionnaires · US
VantaSecurity · US
ZapierInternal automation system · US
ZoomVideo conferencing · US

Security profile

Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.

Change history

26 Oct 2026PCI DSS renewedExpiry moved from 2027-03-31 to 2027-04-30.
26 Oct 2026PCI DSS auditor changedAuditor changed from SISA to Network Intelligence Pvt. Ltd..
19 Oct 2026PCI DSS state changedState moved from Vendor-stated to Verified.
19 Oct 2026PCI DSS auditor changedAuditor changed from unknown to SISA.
18 Sep 2026Subprocessor added: OpenAIOpenAI appeared on the subprocessor list.
18 Sep 2026Subprocessor added: PlaidPlaid appeared on the subprocessor list.
18 Sep 2026Subprocessor added: SentrySentry appeared on the subprocessor list.
18 Sep 2026CCPA / CPRA evidence addedA CCPA / CPRA row entered the index with state Vendor-stated.
18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
18 Sep 2026PCI DSS evidence addedA PCI DSS row entered the index with state Vendor-stated.

Similar vendors with evidence

Related by product tags and the Finance and accounting category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.