Snyk

Security and trust center evidence

Every AI-building team faces one question: can you trust what you're shipping? Snyk secures the code AI writes, the agents it runs, and the

snyk.io SecurityLast verified 2 Nov 2026

Request the report Are you Snyk?

SOC 2Vendor-stated

FedRAMPVerified

PCI DSSVendor-stated

ISO 27001Vendor-stated

ISO 27017Vendor-stated

Snyk has 1 registry-verified row and 4 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is SOC 2: Vendor states SOC 2 Type II on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

As of 18 Sep 2026, Snyk states on its trust centre that it holds a SOC 2 Type II report. As of 19 Sep 2026, Snyk is listed in the FedRAMP registry as Authorized, with the authorization issued 7 Apr 2025 and assessed by Coalfire Systems, Inc. As of 18 Sep 2026, Snyk states on its trust centre that it holds PCI DSS - SAQ A. As of 18 Sep 2026, Snyk states on its trust centre that it holds ISO 27001:2022. As of 18 Sep 2026, Snyk states on its trust centre that it holds ISO 27017:2015.

FedRAMP: Authorized, issued 7 Apr 2025, assessed by Coalfire Systems, Inc. (as of 19 Sep 2026)
SOC 2: vendor states it holds a SOC 2 Type II report on its trust centre (as of 18 Sep 2026)
PCI DSS - SAQ A: vendor states on its trust centre (as of 18 Sep 2026)

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.

Among security vendors

1verified rows

Category median 1, across 172 indexed security vendors. Snyk has more verified rows than 42 percent of them.

application securitycontainer securitydependency scanningsastvulnerability management

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, GDPR, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Subprocessor list

Public · 20 subprocessors listed on the trust centre · as of 30 Sep 2026

Open

Public · as of 30 Sep 2026

Open

Public trust centre documents

Public · ISO27001 ISO27017 Certificate · as of 18 Sep 2026

Open

Subprocessors (20)

Akamai Technologies, Inc.Engineering · The nature of the Akamai solution, for optimizing traffic management, means that Akamai processes Snyk’s customer data from the region closest to where the user is located.
AW
Amazon Web Services (AWS)IT · Data can be hosted in the U.S., EU or Australia at Customer’s election. May be accessed globally by Snyk employees.
Amplitude, Inc.Data analytics · Hosted in the U.S. May be accessed globally by Snyk employees.
Confluent, Inc.IT · Hosted in the U.S. May be accessed globally by Snyk employees.
CrowdStrike, Inc.Security · Hosted in the US or EU (Frankfurt, Germany). May be accessed globally by Snyk employees.
Datadog, Inc.Security · Hosted in the U.S. May be accessed globally by Snyk employees.
DBT Labs, Inc.Data analytics · Hosted in the U.S. May be accessed globally by Snyk employees.
Functional Software, Inc. (Sentry)Cloud monitoring · Hosted in the U.S. May be accessed globally by Snyk employees.
Google Cloud PlatformCloud provider · Hosted in the U.S. May be accessed globally by Snyk employees.
Google DriveDocument management · Hosted in the U.S. May be accessed globally by Snyk employees.
LookerData analytics · Hosted in the EU. May be accessed globally by Snyk employees.
MongoDBData storage and processing · Data can be hosted in the U.S., EU or Australia depending on Customer’s selection with respect to Customer’s hosting location.
OktaIT · Hosted in the U.S, EU or Australia at Customer’s election. May be accessed globally by Snyk employees.
OS
Orca Security UK LtdSecurity · Hosted in the EU. May be accessed globally by Snyk employees.
Salesforce.com, Inc.Sales · Hosted in the U.S. May be accessed globally by Snyk employees.
SL
Shoreline Labs, Inc. (d/b/a Nightfall)Security · Hosted in the U.S. May be accessed globally by Snyk employees.
Slack Technologies LimitedSlack services are hosted in the United States, but processing may occur globally wherever Snyk users access the services.
Snowflake, Inc.As embedded in the Snyk Services, data can be hosted in the U.S., EU or Australia depending on Customer’s selection with respect to Customer’s hosting location. May be accessed globally by Snyk employees. As used by Snyk for business intelligence and analytics purposes, data is hosted in the U.S., and may be accessed globally by Snyk employees.
SS
Sublime, Security Inc.Security · Hosted in the U.S. May be accessed globally by Snyk employees.
Twilio Ireland Limited (Segment.io)Sales · Hosted in the U.S. May be accessed globally by Snyk employees.

Security profile

Pen test cadence: annual
Data residency: EU, US

Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.

Change history

18 Sep 2026Subprocessor added: Slack Technologies LimitedSlack Technologies Limited appeared on the subprocessor list.
18 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Vendor-stated.
18 Sep 2026ISO/IEC 27017 evidence addedA ISO/IEC 27017 row entered the index with state Vendor-stated.
18 Sep 2026PCI DSS evidence addedA PCI DSS row entered the index with state Vendor-stated.
18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
18 Sep 2026Subprocessor added: Akamai Technologies, Inc.Akamai Technologies, Inc. appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Amazon Web Services (AWS)Amazon Web Services (AWS) appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Amplitude, Inc.Amplitude, Inc. appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Confluent, Inc.Confluent, Inc. appeared on the subprocessor list.
18 Sep 2026Subprocessor added: CrowdStrike, Inc.CrowdStrike, Inc. appeared on the subprocessor list.