Rally
Security and trust center evidence
Agentic User Research Infrastructure
Summary
Rally has 4 vendor-stated rows in the CertReports index, last verified 30 Sep 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
Rally states on its trust centre that it holds SOC 2, as of 27 Sep 2026, though the report type is not specified. Rally displays a HIPAA badge on its trust centre, as of 27 Sep 2026, though BAA availability is not yet captured in current evidence. Rally states on its trust centre that it complies with GDPR, as of 27 Sep 2026. Rally states on its trust centre that it complies with CCPA/CPRA, as of 27 Sep 2026. No public evidence was found for ISO/IEC 27001 for Rally as of 27 Sep 2026.
- SOC 2: vendor states on its trust centre, as of 27 Sep 2026 - report type not specified.
- HIPAA: vendor displays a badge on its trust centre, as of 27 Sep 2026 - BAA availability not yet captured.
- GDPR and CCPA/CPRA: vendor states on its trust centre, as of 27 Sep 2026.
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 27 Sep 2026; it is regenerated whenever a row changes.
Among design tools vendors
0verified rows
Category median 0, across 34 indexed design tools vendors. Rally has no registry-verified row yet, like 53 percent of them; its evidence is vendor-stated or reported.
agentic researchresearch recruitinguser researchux research
Compare with similar vendors
Pick your own comparisonCompliance grid
- HIPAAVendor-stated
Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)
as of 30 Sep 20262 sources
SOC 2Vendor-statedVendor states SOC 2 on its trust centre
as of 30 Sep 20262 sources- GDPRVendor-stated
Vendor states GDPR on its trust centre
as of 30 Sep 20262 sources - CCPA / CPRAVendor-stated
Vendor states CCPA on its trust centre
as of 30 Sep 20262 sources
Legal artefacts
Subprocessors (21)
Amazon Web ServicesPrimary Cloud Provider · US
AnthropicLLM Provider · US- DatadogApplication Monitoring · US
- ELElasticElasticSearch Cloud Provider · US
Google CloudLLM Provider (Gemini) · US
IntercomCustomer support · US- KNKnockNotifications API · US
LangchainAI Observability · US
MailgunEmail Service Provider · US- MuxVideo Live Streaming Infrastructure API · US
NylasEmail and Calendar API for Google and Microsoft · US- ONOneSchemaCSV Importing API · US
OpenAILLM Provider · US
PosthogProduct Usage Logging · US
PostmarkEmail Service Provider · US- PYPylonCustomer Support Ticketing and Requests · US
Recall.aiMeeting Bot API · US- TETemporalWorkflow Orchestration · US
TremendousGift Card API · US- TwilioSMS Sending · US
- WOWorkOSSSO API · US
Security profile
Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.
Change history
- 18 Sep 2026First indexed by CertReports4 evidence rows across 4 frameworks entered the index.
Evidence against regulations
All regulations for RallyHow much of each regulation’s vendor requirements Rally’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read