Gem

Security and trust center evidence

Talent engagement platform

gem.com RecruitingLast verified 26 Oct 2026

Request the report Are you Gem?

SOC 2Vendor-stated

DPFVerified

Gem has 1 registry-verified row and 1 vendor-stated row in the CertReports index, last verified 26 Oct 2026. The strongest row is SOC 2: Vendor states SOC 2 Type II on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Gem states on its trust centre that it holds a SOC 2 Type II report, as of 18 Sep 2026 (Vanta). This SOC 2 record is a vendor statement rather than a registry listing, as of 18 Sep 2026. Gem is listed in the EU-US Data Privacy Framework registry as active for the EU-US, Swiss-US, and UK Extension certifications, as of 17 Sep 2026. That Data Privacy Framework listing began 5 Mar 2018 and is set to expire 13 May 2027, as of 17 Sep 2026. No public evidence was found for ISO/IEC, PCI DSS, HIPAA, or FedRAMP frameworks for Gem as of 18 Sep 2026.

Vendor states SOC 2 Type II on its trust centre, as of 18 Sep 2026 (Vanta).
EU-US Data Privacy Framework active (EU-US, SW-US, UK Extension), expires 13 May 2027, as of 17 Sep 2026.
No public evidence found for ISO/IEC, PCI DSS, HIPAA, or FedRAMP as of 18 Sep 2026.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.

Among recruiting vendors

1verified rows

Category median 0, across 70 indexed recruiting vendors. Gem has more verified rows than 54 percent of them.

candidate relationship managementrecruiting automationtalent engagementtalent pipeline

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, GDPR, FedRAMP, PCI DSS, ISO 27001, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Subprocessor list

Public · 18 subprocessors listed on the trust centre · as of 30 Sep 2026

Open

Public · as of 30 Sep 2026

Open

Subprocessors (18)

Amazon Web ServicesUnited States
Anthropic PBCUnited States
CS
Cerebras Systems, Inc.United States
DI
Deep InfraUnited States
EI
Elasticsearch Inc.United States
ET
Estuary Technologies, Inc.United States
FullStory, Inc.United States
Google WorkspaceUnited States
HE
HerokuUnited States
Merge API, Inc.United States
Microsoft CorporationUnited States
Mongo DB, Inc.United States
OpenAI Group PBCUnited States
PY
PylonUnited States
SentryUnited States
SnowflakeUnited States
ST
StripeUnited States
Twilio, Inc.United States

Security profile

Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.

Change history

18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Anthropic PBCAnthropic PBC appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Cerebras Systems, Inc.Cerebras Systems, Inc. appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Deep InfraDeep Infra appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Elasticsearch Inc.Elasticsearch Inc. appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Estuary Technologies, Inc.Estuary Technologies, Inc. appeared on the subprocessor list.
18 Sep 2026Subprocessor added: FullStory, Inc.FullStory, Inc. appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Google WorkspaceGoogle Workspace appeared on the subprocessor list.
18 Sep 2026Subprocessor added: HerokuHeroku appeared on the subprocessor list.