Skip to main content
Mixpanel logo

Mixpanel

Regulatory evidence

Mixpanel is event analytics for builders that need answers.

mixpanel.comAnalyticsLast verified 2 Nov 2026

Mixpanel against third-party requirements

For each regulation, how many of the requirements it places on your vendors Mixpanel’s public evidence reaches. Open one for every item with its date and source.

Documents on the trust centre

What the vendor lists, typed; public items can be read now, the rest are available on request.

17 documents listed on Mixpanel’s trust centre

trust.mixpanel.com
  • Architecture or data-flow diagram
    • Mixpanel Data Flow Chart.pdfon request · seen 30 Sep 2026
  • SOC 2 bridge letter
    • Mixpanel SOC 2 Bridge Letter 09.11.2026.pdfon request · seen 30 Sep 2026
  • Business continuity and disaster recovery plan
    • Business Continuity Planon request · seen 30 Sep 2026
  • Incident response plan
    • Security Incident Response Planon request · seen 30 Sep 2026
  • ISO certificate
    • Mixpanel ISO 27001:2022 Compliance Certificate FINAL 6.25.2026.pdfon request · seen 30 Sep 2026
    • Mixpanel ISO 27701:2019 Compliance Certificate FINAL 6.25.2026.pdfon request · seen 30 Sep 2026
  • Penetration test report
    • Mixpanel 2025 Penetration Test HackerOne Executive Summary Retest Report.pdfon request · seen 30 Sep 2026
    • Mixpanel 2025 Penetration Test HackerOne Executive Summary Report.pdfon request · seen 30 Sep 2026
  • Security policy or overview
    • Communications Security Policyon request · seen 30 Sep 2026
    • Encryption Policyon request · seen 30 Sep 2026
    • Information Security Policyon request · seen 30 Sep 2026
    • Mixpanel Workstation Security Policy.pdfon request · seen 30 Sep 2026
    • Operations Security Policyon request · seen 30 Sep 2026
    • Physical Security Policyon request · seen 30 Sep 2026
    • Vendor/Third-Party Security Policy and Guidelineson request · seen 30 Sep 2026
    • Vulnerability Management Policyon request · seen 30 Sep 2026
  • SOC 2 report
    • Mixpanel SOC 2 ISAE Type 2 Report w. HIPAA Mapping 04.30.26.pdfon request · seen 30 Sep 2026

What the vendor says

Answers the vendor publishes to questions buyers ask, quoted with the link to where it says so.

  • Where data is hosted or processed

    Where are Mixpanel’s data centers?

    “Mixpanel persistently stores customer data in one of its three data centers. For customers not participating in India or EU residency, data is stored in the United States on the Google Cloud Platform in the US-Central 1 region (Iowa, United States). For customers participating in the EU residency program, data is stored in the Google Cloud Platform’s europe-west4 (Eemshaven, Netherlands) data center region. For cu...”

    Regions named: EU, US, Netherlands, Indiaas of 30 Sep 2026Source

  • Encryption

    Does Mixpanel encrypt customer data?

    “When a user visits a website or application with Mixpanel instrumented, the details of their interactions are captured and sent to Mixpanel through API calls secured over HTTPS/HTTP, based on how Mixpanel is configured by the customer. All of our other APIs and websites use HTTPS exclusively. All data transferred over HTTPS is encrypted. Mixpanel uses NIST Suite B compliant cipher suites to secure data in transit...”

    as of 30 Sep 2026Source

  • Encryption

    Are customer passwords encrypted?

    “Customer passwords are hashed using the PBKDF2 algorithm with a SHA256 hash, a password stretching mechanism recommended by NIST.”

    as of 30 Sep 2026Source

  • Incident and breach notification

    When and how will I be notified of a suspected breach?

    “In keeping with GDPR requirements, Mixpanel will notify customers within 72 hours of a suspected breach via e-mail.”

    as of 30 Sep 2026Source

  • Data retention and deletion

    Can Mixpanel delete customer data?

    “Mixpanel supports account holders’ ability to request the deletion or export of end user data. Requests can be submitted through either a form found in a Mixpanel project or through a personal data export and deletion API. Additional information can be found here: https://help.mixpanel.com/hc/en-us/articles/360000881023”

    as of 30 Sep 2026Source

All articles

This maps third-party obligations to the vendor evidence that may support them. It is not legal advice and never a statement that a vendor or its customers comply; confirm scope and sufficiency with your counsel or auditor. “No public evidence” means nothing public was found at the last check. Citations link to the official text.