Proofpoint

Security and trust center evidence

Proofpoint, Inc. is an American enterprise cybersecurity company based in Sunnyvale, California that provides software as a service and

proofpoint.com SecurityLast verified 1 Nov 2026

Vendor website Are you Proofpoint?

FedRAMPVerified

CSA STARVerified

DPFExpired

Proofpoint has 2 registry-verified rows, and 1 expired in the CertReports index, last verified 1 Nov 2026. The strongest row is FedRAMP: FedRAMP Authorized. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Proofpoint is listed in the FedRAMP registry as FedRAMP Authorized, as of 19 Sep 2026. The FedRAMP authorization was issued 15 Jan 2020 with Schellman Compliance, LLC as the assessing organization, per the registry as of 19 Sep 2026. The FedRAMP registry entry does not record an expiration date for Proofpoint's authorization, as of 19 Sep 2026. Proofpoint is listed in the CSA STAR registry with a STAR Level 1 self-assessment (CAIQ), issued 13 Apr 2022, as of 17 Sep 2026. Proofpoint's EU-US Data Privacy Framework listing is marked Inactive as of 17 Sep 2026.

FedRAMP Authorized, listed in FedRAMP registry, issued 15 Jan 2020, assessed by Schellman Compliance, LLC, no expiry recorded (as of 19 Sep 2026)
CSA STAR Level 1 self-assessment (CAIQ), listed in CSA STAR registry, issued 13 Apr 2022 (as of 17 Sep 2026)
EU-US Data Privacy Framework: Inactive as of 17 Sep 2026

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.

Among security vendors

2verified rows

Category median 1, across 172 indexed security vendors. Proofpoint has more verified rows than 76 percent of them.

data loss preventionemail securityphishing detectionthreat protection

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, SOC 2, GDPR, PCI DSS, ISO 27001, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.