Summary
Lob has 1 registry-verified row and 4 vendor-stated rows, and 1 expired in the CertReports index, last verified 26 Oct 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
Lob displays a HIPAA badge on its trust centre as of 26 Sep 2026, though the evidence reviewed does not confirm BAA availability. Lob states on its trust centre that it has a SOC 2 report, as of 26 Sep 2026. Lob also states on its trust centre that it complies with GDPR and CCPA/CPRA, as of 26 Sep 2026. Lob is listed in the CSA STAR registry as of 17 Sep 2026, with a Level 1 self-assessment (CAIQ) submitted 26 Aug 2019. Lob's EU-US Data Privacy Framework listing shows an inactive, expired status as of 17 Sep 2026, with the original certification issued 9 Dec 2018.
- HIPAA - badge displayed on trust centre, BAA availability not confirmed (as of 26 Sep 2026)
- SOC 2 - vendor states on its trust centre (as of 26 Sep 2026)
- EU-US Data Privacy Framework - expired, inactive, originally issued 9 Dec 2018 (as of 17 Sep 2026)
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 26 Sep 2026; it is regenerated whenever a row changes.
Among marketing vendors
1verified rows
Category median 0, across 181 indexed marketing vendors. Lob has more verified rows than 57 percent of them.
customer communicationsdirect mailmarketing automationoffline marketing
Compare with similar vendors
Pick your own comparisonCompliance grid
HIPAAVendor-statedVendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)
as of 30 Sep 20262 sources
SOC 2Vendor-statedVendor states SOC 2 on its trust centre
as of 30 Sep 20262 sources
GDPRVendor-statedVendor states GDPR on its trust centre
as of 30 Sep 20262 sources
CSA STARVerifiedSTAR Level 1 self-assessment (CAIQ)
as of 26 Oct 20266 sources
EU-US Data Privacy FrameworkExpiredInactive
as of 26 Oct 20261 source
CCPA / CPRAVendor-statedVendor states CCPA on its trust centre
as of 30 Sep 20262 sources
Legal artefacts
Subprocessors
No subprocessor list captured yet.
Security profile
- Pen test cadence
- annual
Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.
Change history
- 18 Sep 2026CCPA / CPRA evidence addedA CCPA / CPRA row entered the index with state Vendor-stated.
- 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
- 18 Sep 2026HIPAA evidence addedA HIPAA row entered the index with state Vendor-stated.
- 18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
Similar vendors with evidence
Related by product tags and the Marketing category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
Outgage
Marketing
Create, deliver and measure unforgettable Direct Mail experiences that motivate your audience to engage more than ever
Click2Mail
Marketing
Click2Mail's easy to use integrated direct mail tools enable businesses of all sizes to send marketing mail, business mail, personal mail
Attentive Mobile
Marketing
Learn more about Attentive—the SMS and email platform that brings your customer interactions to life with advanced
Simon Data
Marketing
Simon AI is the Agentic Marketing platform trusted by enterprise
Evidence against regulations
All regulations for LobHow much of each regulation’s vendor requirements Lob’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read