Medallia

Security and trust center evidence

Medallia is an American customer and employee experience management company based in Tysons, Virginia

medallia.com EducationLast verified 2 Nov 2026

Request the report Are you Medallia?

ISO 27001Vendor-stated

CSA STARVerified

Cyber EssentialsVendor-stated

ISO 27701Vendor-stated

ISO 42001Vendor-stated

ISO 27017Vendor-stated

ISO 27018Vendor-stated

HITRUSTVendor-stated

DPFVerified

CCPAVendor-stated

Medallia has 3 registry-verified rows and 12 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Medallia states on its trust centre that it holds SOC 2, GDPR, PCI DSS, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, HITRUST, and Cyber Essentials as of 10 Oct 2026. Medallia displays a HIPAA badge on its trust centre as of 10 Oct 2026, though BAA availability has not been captured. Medallia is listed in the FedRAMP registry as FedRAMP Authorized, issued 9 Apr 2021, as of 9 Oct 2026, audited by Kratos. Medallia is listed in the CSA STAR registry with a Level 1 self-assessment issued 25 Nov 2019, as of 5 Oct 2026, and in the EU-US Data Privacy Framework as active, issued 27 Jul 2017, expiring 3 Mar 2027, as of 5 Oct 2026. Medallia also states ISO/IEC 42001 and CCPA/CPRA alignment on its trust centre, as of 2 Oct 2026.

SOC 2, GDPR, PCI DSS, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, HITRUST, Cyber Essentials, ISO/IEC 42001, CCPA/CPRA: vendor states on trust centre, as of 10 Oct 2026 / 2 Oct 2026
FedRAMP: listed in registry as FedRAMP Authorized since 9 Apr 2021, as of 9 Oct 2026 (auditor Kratos)
CSA STAR (Level 1, issued 25 Nov 2019) and EU-US Data Privacy Framework (active, expires 3 Mar 2027): both as of 5 Oct 2026

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 10 Oct 2026; it is regenerated whenever a row changes.

Among education vendors

3verified rows

Category median 1, across 135 indexed education vendors. Medallia has more verified rows than 96 percent of them.

ai-analyticscustomer-experiencefeedback-managementsentiment-analysis

Compare with similar vendors

Pick your own comparison

Compliance grid

Legal artefacts

AI and data use policy

On request · Listed on the trust centre as "Responsible AI Statement" · as of 2 Oct 2026

Open

Subprocessor list

On request · Listed on the trust centre as "Subprocessors" · as of 2 Oct 2026

Open

Subprocessors

No subprocessor list captured yet.

Security profile

Displayed as a security profile from public statements, not as attestations, as of 2 Nov 2026.

Change history

9 Oct 2026Cyber Essentials evidence addedA Cyber Essentials row entered the index with state Vendor-stated.
18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
18 Sep 2026HIPAA evidence addedA HIPAA row entered the index with state Vendor-stated.
18 Sep 2026HITRUST evidence addedA HITRUST row entered the index with state Vendor-stated.
18 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Vendor-stated.
18 Sep 2026ISO/IEC 27017 evidence addedA ISO/IEC 27017 row entered the index with state Vendor-stated.
18 Sep 2026CCPA / CPRA evidence addedA CCPA / CPRA row entered the index with state Vendor-stated.
18 Sep 2026ISO/IEC 27701 evidence addedA ISO/IEC 27701 row entered the index with state Vendor-stated.
18 Sep 2026ISO/IEC 42001 evidence addedA ISO/IEC 42001 row entered the index with state Vendor-stated.
18 Sep 2026PCI DSS evidence addedA PCI DSS row entered the index with state Vendor-stated.