Melissa

Security and trust center evidence

Try our easy to-use APIs & CRM data cleansing tools to improve your data quality and marketing

melissa.com MarketingLast verified 2 Nov 2026

Vendor website Are you Melissa?

FedRAMPVerified

DPFVerified

Melissa has 2 registry-verified rows in the CertReports index, last verified 2 Nov 2026. The strongest row is FedRAMP: FedRAMP Authorized. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Melissa is listed in the FedRAMP registry as FedRAMP Authorized, authorized since 14 Sep 2023 with an audit by Schellman Compliance, LLC, as of 20 Sep 2026. Under the EU-US Data Privacy Framework, Melissa is listed in the registry as active, covering the EU-US and UK Extension certifications, certified since 26 May 2017 with a current expiry of 19 Aug 2027, as of 17 Sep 2026. No public evidence found for a SOC 2 report for Melissa as of 17 Sep 2026. No public evidence found for ISO/IEC 27001 certification for Melissa as of 17 Sep 2026. No public evidence found for a HIPAA business associate agreement or PCI DSS validation for Melissa as of 17 Sep 2026.

FedRAMP: listed in the FedRAMP registry as Authorized since 14 Sep 2023 (auditor: Schellman Compliance, LLC), as of 20 Sep 2026.
EU-US Data Privacy Framework: listed as active (EU-US, UK Extension), certified since 26 May 2017, expires 19 Aug 2027, as of 17 Sep 2026.
SOC 2, ISO/IEC 27001, HIPAA BAA, PCI DSS: no public evidence found, as of 17 Sep 2026.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 20 Sep 2026; it is regenerated whenever a row changes.

Among marketing vendors

2verified rows

Category median 0, across 181 indexed marketing vendors. Melissa has more verified rows than 96 percent of them.

apicrm-datadata-cleansingdata-quality

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, SOC 2, GDPR, PCI DSS, ISO 27001, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.