Exterro
Security and trust center evidence
Turn data risk into confidence with Exterro's AI-driven platform for eDiscovery, digital forensics, data privacy, security &
Summary
SOC 2Vendor-stated
FedRAMPVerified
ISO 27001Vendor-stated
Cyber EssentialsVendor-stated
HITRUSTVendor-stated
DPFExpired
TISAXVendor-statedExterro has 1 registry-verified row and 5 vendor-stated rows, and 1 expired in the CertReports index, last verified 2 Nov 2026. The strongest row is SOC 2: Vendor states SOC 2 on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
Exterro is listed in the FedRAMP registry as FedRAMP Authorized, with an authorization date of 20 Apr 2021 and Coalfire Systems, Inc. as assessor, as of 25 Sep 2026. Exterro states on its trust centre that it holds SOC 2 and ISO/IEC 27001:2022, as of 25 Sep 2026. Exterro states on its trust centre that it holds UK Cyber Essentials 3.2, HITRUST and TISAX, as of 25 Sep 2026. Exterro's EU-US Data Privacy Framework registry listing is inactive, following an original certification date of 13 Oct 2016, as of 17 Sep 2026. The FedRAMP authorization is registry-verified, while the SOC 2, ISO/IEC 27001, Cyber Essentials, HITRUST and TISAX statements are vendor claims from the trust centre, as of 25 Sep 2026.
- FedRAMP: Authorized, listed in registry, authorized 20 Apr 2021 (Coalfire Systems, Inc.), as of 25 Sep 2026
- SOC 2, ISO/IEC 27001:2022, Cyber Essentials 3.2, HITRUST, TISAX: vendor states on its trust centre, as of 25 Sep 2026
- EU-US Data Privacy Framework: registry listing inactive since 13 Oct 2016 certification, as of 17 Sep 2026
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 25 Sep 2026; it is regenerated whenever a row changes.
Among legal tech vendors
1verified rows
Category median 1, across 44 indexed legal tech vendors. Exterro has more verified rows than 48 percent of them.
data privacydigital forensicsediscoverylegal governance
Compare with similar vendors
Pick your own comparisonCompliance grid
- SOC 2Vendor-stated
Vendor states SOC 2 on its trust centre
as of 30 Sep 20262 sources - FedRAMPVerified
FedRAMP Authorized
as of 2 Nov 202647 sources · Coalfire Systems, Inc. - ISO/IEC 27001Vendor-stated
Vendor states ISO 27001:2022 on its trust centre
as of 30 Sep 20262 sources - Cyber EssentialsVendor-stated
Vendor states UK Cyber Essentials 3.2 on its trust centre
as of 30 Sep 20262 sources - HITRUSTVendor-stated
Vendor states HITRUST on its trust centre
as of 30 Sep 20262 sources - EU-US Data Privacy FrameworkExpired
Inactive
as of 2 Nov 20261 source - TISAXVendor-stated
Vendor states TiSAX on its trust centre
as of 30 Sep 20262 sources
Legal artefacts
Subprocessors (8)
Amazon Web ServicesPublic Cloud Infrastructure · US, EU, CA Regions
Atlassian ConfluenceCollaboration · United States- CACannyProduct Feedback · United States
Google, IncGoogle Cloud Platform (GCP) · United States, EU
Microsoft AzurePublic Cloud Infrastructure · United States
SalesforceAccount Management, Customer Relationship Support, and Customer Support Ticketing · United States- SWSendSafely WebsiteSecure File Transfer and Message Exchange · United States
SnowflakeData Analytics · United States
Security profile
- Pen test cadence
- annual
Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.
Change history
- 18 Sep 2026Cyber Essentials evidence addedA Cyber Essentials row entered the index with state Vendor-stated.
- 18 Sep 2026HITRUST evidence addedA HITRUST row entered the index with state Vendor-stated.
- 18 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Vendor-stated.
- 18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
- 18 Sep 2026TISAX evidence addedA TISAX row entered the index with state Vendor-stated.
- 18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Atlassian ConfluenceAtlassian Confluence appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: CannyCanny appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Google, IncGoogle, Inc appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Microsoft AzureMicrosoft Azure appeared on the subprocessor list.
Similar vendors with evidence
Related by product tags and the Legal tech category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
AccessData
Compliance and GRC
Turn data risk into confidence with Exterro's AI-driven platform for eDiscovery, digital forensics, data privacy, security &
KLDiscovery Ontrack
Legal tech
KLDiscovery delivers AI-driven eDiscovery software and services supporting litigation, investigations, and regulatory matters for legal
Nuix
Analytics
Nuix Ltd is an Australian technology company that produces investigative analytics and intelligence software for extracting knowledge from
CS Disco
Legal tech
DISCO's AI-driven legal software and services raise the bar by offering cloud-based solutions developed by lawyers for
Evidence against regulations
All regulations for ExterroHow much of each regulation’s vendor requirements Exterro’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read