Netlify

Security and trust center evidence

Create with AI or code, deploy instantly on production

netlify.com Developer toolsLast verified 2 Nov 2026

Request the report Are you Netlify?

ISO 27001Vendor-stated

ISO 27018Vendor-stated

DPFVerified

CCPAVendor-stated

Netlify has 1 registry-verified row and 7 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Netlify states on its trust centre that it holds a SOC 2 report, as of 19 Sep 2026. Netlify displays a HIPAA badge on its trust centre, with BAA availability not yet captured, as of 19 Sep 2026. Netlify also states GDPR, PCI DSS, ISO/IEC 27001, ISO/IEC 27018:2019, and CCPA/CPRA on its trust centre, as of 19 Sep 2026. Netlify is listed in the EU-US Data Privacy Framework registry as active for the SW-US Certification, EU-US Certification, and UK Extension Certification, issued 13 Feb 2020 and expiring 17 Dec 2026, as of 17 Sep 2026. Aside from the EU-US Data Privacy Framework registry listing, as of 17 Sep 2026, all other frameworks for Netlify reflect vendor statements on its trust centre, as of 19 Sep 2026, rather than independent verification.

SOC 2, HIPAA, GDPR, PCI DSS, ISO/IEC 27001, ISO/IEC 27018:2019, CCPA/CPRA: vendor-stated on trust centre only (as of 19 Sep 2026); HIPAA badge does not confirm BAA availability
EU-US DPF: active registry listing (SW-US, EU-US, UK Extension Certifications), issued 13 Feb 2020, expiring 17 Dec 2026 (as of 17 Sep 2026)
Only the DPF listing is registry-verified; remaining frameworks are unverified vendor claims

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.

Among developer tools vendors

1verified rows

Category median 0, across 220 indexed developer tools vendors. Netlify has more verified rows than 64 percent of them.

ci/cddeploymentjamstackstatic site hosting

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for FedRAMP, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Data processing agreement

On request · Listed on the trust centre as "Data Processing Agreement" · as of 30 Sep 2026

Open

Subprocessor list

Public · 74 subprocessors listed on the trust centre · as of 2 Nov 2026

Open

Subprocessors (74)

AS
AI Servces
AS
AI Services
AI
Altinity, Inc / Clickhouse
AW
Amazon Web Services (AWS)
AI
Amplitude, Inc.
AN
Analytics
AN
Anthropic
AX
Axiom
BA
Billing and invoicing
BI
Business Intelligence
CR
CRM
CD
Customer data platform
DS
Data Services
DA
Database
DH
Database Hosting
DI
Datadog, Inc.
DR
Domain Registration
DD
Dynatrace DevCycle
ES
Email Services
ER
Error Reporting
FF
Feature Flagging
FI
Fivetran Inc.
GU
Global, US
HC
Hosting, compute, storage, backup
IA
Identity and Access Management
IS
Infrastructure Service Provider
KA
Kapa.AI
LA
Log Analysis
LT
logging, tracing, and monitoring
MA
Managed authoritative DNS
NC
Name.com
NE
Neon
NS
NS1
OP
OpenAI
OP
OpenRouter
OR
Orb
PP
Payment Processing
SI
Salesforce, Inc.
SE
Segment
SE
SendGrid
SC
Sigma Computing, Inc.
SS
Smartbear Software, Inc / Bugsnag
SI
Snowflake, Inc.
S2
SP-20160229.1
S2
SP-20160510.1
S2
SP-20160815.1
S2
SP-20180312.1
S2
SP-20180619.1
S2
SP-20181214.1
S2
SP-20190312.1
S2
SP-20191031.1
S2
SP-20200419.1
S2
SP-20201028.1
S2
SP-20210331.1
S2
SP-20210406.1
S2
SP-20211101.1
S2
SP-20220806.1
S2
SP-20220810.1
S2
SP-20230127.1
S2
SP-20230306.1
S2
SP-20230417.1
S2
SP-20240304.1
S2
SP-20240414.1
S2
SP-20240601.1
S2
SP-20240808.1
S2
SP-20240930.1
S2
SP-20250422.1
S2
SP-20250829.1
S2
SP-20260806.1
SF
Spam Filtering
ST
Stripe
US
US
WA
Warehousing
WI
WorkOS, Inc.

Security profile

Pen test cadence: report available

Displayed as a security profile from public statements, not as attestations, as of 2 Nov 2026.

Change history

1 Oct 2026Subprocessor added: AxiomAxiom appeared on the subprocessor list.
1 Oct 2026Subprocessor added: Amplitude, Inc.Amplitude, Inc. appeared on the subprocessor list.
1 Oct 2026Subprocessor added: AnalyticsAnalytics appeared on the subprocessor list.
1 Oct 2026Subprocessor added: AnthropicAnthropic appeared on the subprocessor list.
1 Oct 2026Subprocessor added: Amazon Web Services (AWS)Amazon Web Services (AWS) appeared on the subprocessor list.
1 Oct 2026Subprocessor added: Altinity, Inc / ClickhouseAltinity, Inc / Clickhouse appeared on the subprocessor list.
1 Oct 2026Subprocessor added: AI ServcesAI Servces appeared on the subprocessor list.
1 Oct 2026Subprocessor added: AI ServicesAI Services appeared on the subprocessor list.
1 Oct 2026Subprocessor added: Billing and invoicingBilling and invoicing appeared on the subprocessor list.
1 Oct 2026Subprocessor added: Business IntelligenceBusiness Intelligence appeared on the subprocessor list.

Similar vendors with evidence

Related by product tags and the Developer tools category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.