Skip to main content
SAP logo

SAP

Security and trust center evidence

SAP SE, is a German multinational software company based in Walldorf, Baden-Württemberg, that is the world's largest vendor of enterprise

sap.comFinance and accountingLast verified 2 Nov 2026
Vendor website Are you SAP?

Summary

ISO/IEC 27001 mark, CertReports state Reported as of 26 Oct 2026ISO 27001ReportedCSA STAR mark, CertReports state Verified as of 26 Oct 2026CSA STARVerifiedEU-US Data Privacy Framework mark, CertReports state Expired as of 2 Nov 2026DPFExpiredDORA critical ICT provider designation mark, CertReports state Verified as of 2 Nov 2026DORA CTPPVerified

SAP has 2 registry-verified rows and 1 third-party reported row, and 1 expired in the CertReports index, last verified 2 Nov 2026. The strongest row is ISO/IEC 27001: CSA STAR Level 2 certification on the registry, which is built on an ISO/IEC 27001 certification. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

As of 2 Nov 2026, CertReports holds 2 registry-verified rows and 1 expired row for SAP, drawn from the CSA STAR registry, the Data Privacy Framework list and dora_ctpp. SAP is listed in the CSA STAR registry for CSA STAR (STAR Level 2 certification), dated 25 Jun 2016. SAP previously appeared with EU-US Data Privacy Framework evidence, but the listing is no longer active and CertReports found no renewal as of 2 Nov 2026. No public evidence was found for SOC 2, HIPAA, GDPR and PCI DSS as of 2 Nov 2026; that is a gap in the public record, not a finding of non-coverage, and the vendor can supply it under NDA.

  • CSA STAR: STAR Level 2 certification, verified as of 26 Oct 2026
  • DORA critical ICT provider designation: Designated critical ICT third-party provider under DORA Article 31 as SAP SE (ESAs list of 18 November 2025), verified as of 2 Nov 2026
  • EU-US Data Privacy Framework: Inactive, expired as of 2 Nov 2026

Facts only, each dated; nothing here is inferred, scored or advised.

Among finance and accounting vendors

2verified rows

Category median 1, across 176 indexed finance and accounting vendors. SAP has more verified rows than 89 percent of them.

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, SOC 2, GDPR, FedRAMP, PCI DSS, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Subprocessors

No subprocessor list captured yet.

Change history

  1. 29 Sep 2026CSA STAR evidence addedA CSA STAR row entered the index with state Verified.
  2. 29 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Reported.
  3. 22 Sep 2026DORA critical ICT provider designation evidence addedA DORA critical ICT provider designation row entered the index with state Verified.
  4. 18 Sep 2026First indexed by CertReports3 evidence rows across 1 framework entered the index.

Evidence against regulations

All regulations for SAP

How much of each regulation’s vendor requirements SAP’s public evidence reaches.

Reviewing a vendor on public evidence

All articles