Skip to main content
Pendo logo

Pendo

Security and trust center evidence

Pendo feeds product context to the apps and AI agents you build or buy, so you can understand your users, act where it counts, and drive

pendo.ioAnalyticsLast verified 2 Nov 2026
Request the report Are you Pendo?

Summary

HIPAA mark, CertReports state Vendor-stated as of 30 Sep 2026HIPAAVendor-statedSOC 2 mark, CertReports state Verified as of 2 Nov 2026SOC 2VerifiedGDPR mark, CertReports state Vendor-stated as of 30 Sep 2026GDPRVendor-statedPCI DSS mark, CertReports state Vendor-stated as of 30 Sep 2026PCI DSSVendor-statedSOC 3 mark, CertReports state Verified as of 2 Nov 2026SOC 3VerifiedEU-US Data Privacy Framework mark, CertReports state Expired as of 2 Nov 2026DPFExpiredCCPA / CPRA mark, CertReports state Vendor-stated as of 30 Sep 2026CCPAVendor-statedTX-RAMP mark, CertReports state Vendor-stated as of 30 Sep 2026TX-RAMPVendor-stated

Pendo has 2 registry-verified rows and 5 vendor-stated rows, and 1 expired in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Pendo has a SOC 2 Type II report, evidenced by a public SOC 3 report for the period ending 31 Dec 2025 and issued 1 Jul 2026 (SOC 2, as of 29 Sep 2026). The same SOC 3 report is published on the vendor's trust centre (SOC 3, as of 29 Sep 2026). Pendo is listed as active in the EU-US Data Privacy Framework registry under SW-US, EU-US and UK Extension certifications, issued 14 Oct 2017 and expiring 17 Nov 2026 (EU-US Data Privacy Framework, as of 17 Sep 2026). Pendo displays a HIPAA badge on its trust centre (HIPAA, as of 29 Sep 2026). Pendo also states on its trust centre that it holds GDPR, PCI DSS - SAQ D; SP, CCPA / CPRA and TX-RAMP coverage (GDPR, PCI DSS, CCPA / CPRA, TX-RAMP, as of 29 Sep 2026).

  • SOC 2 Type II report evidenced via public SOC 3, period ending 31 Dec 2025 (SOC 2 / SOC 3, as of 29 Sep 2026).
  • EU-US Data Privacy Framework: active SW-US, EU-US, UK Extension certifications, expires 17 Nov 2026 (as of 17 Sep 2026).
  • HIPAA badge displayed on trust centre; BAA availability not evidenced (HIPAA, as of 29 Sep 2026).

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 29 Sep 2026; it is regenerated whenever a row changes.

Among analytics vendors

2verified rows

Category median 0, across 275 indexed analytics vendors. Pendo has more verified rows than 93 percent of them.

adoption trackingengagementproduct analyticsuser behavior

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for FedRAMP, ISO 27001, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Subprocessors (9)

Security profile

Pen test cadence
annual

Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.

Change history

  1. 2 Nov 2026EU-US Data Privacy Framework state changedState moved from Verified to Expired.
  2. 25 Sep 2026SOC 2 state changedState moved from Vendor-stated to Verified.
  3. 25 Sep 2026SOC 3 evidence addedA SOC 3 row entered the index with state Verified.
  4. 18 Sep 2026PCI DSS evidence addedA PCI DSS row entered the index with state Vendor-stated.
  5. 18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
  6. 18 Sep 2026TX-RAMP evidence addedA TX-RAMP row entered the index with state Vendor-stated.
  7. 18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
  8. 18 Sep 2026Subprocessor added: Anthropic ClaudeAnthropic Claude appeared on the subprocessor list.
  9. 18 Sep 2026Subprocessor added: Core10Core10 appeared on the subprocessor list.
  10. 18 Sep 2026CCPA / CPRA evidence addedA CCPA / CPRA row entered the index with state Vendor-stated.

Similar vendors with evidence

Related by product tags and the Analytics category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.

Kubit logo

Kubit

Analytics

Optimize Agent Actions with User

SOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedDPF mark, CertReports state Expired
2 stated2 Nov 2026
Chameleon Intelligent Tech logo

Chameleon Intelligent Tech

Analytics

Chameleon builds context on your product, identifies friction, creates in-app guidance, and monitors outcomes, so your product keeps

SOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedDPF mark, CertReports state ExpiredCCPA mark, CertReports state Vendor-stated
3 stated2 Nov 2026
Mixpanel logo

Mixpanel

Analytics

Mixpanel is event analytics for builders that need answers.

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedCSA STAR mark, CertReports state VerifiedISO 27701 mark, CertReports state Vendor-stated
2 verified · 6 stated2 Nov 2026
Amplitude logo

Amplitude

Analytics

Digital Analytics Platform

SOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedSOC 1 mark, CertReports state Vendor-statedISO 27017 mark, CertReports state Vendor-statedISO 27018 mark, CertReports state Vendor-stated
1 verified · 7 stated2 Nov 2026

Evidence against regulations

All regulations for Pendo

How much of each regulation’s vendor requirements Pendo’s public evidence reaches.

Reviewing a vendor on public evidence

All articles