Skip to main content
Zipline logo

Zipline

Security and trust center evidence

With retail operations software from Zipline, you fulfill all your goals by unifying your entire

getzipline.comLast verified 2 Nov 2026
Request the report Are you Zipline?

Summary

HIPAA mark, CertReports state Vendor-stated as of 30 Sep 2026HIPAAVendor-statedSOC 2 mark, CertReports state Vendor-stated as of 30 Sep 2026SOC 2Vendor-statedGDPR mark, CertReports state Vendor-stated as of 30 Sep 2026GDPRVendor-statedEU-US Data Privacy Framework mark, CertReports state Verified as of 2 Nov 2026DPFVerifiedCCPA / CPRA mark, CertReports state Vendor-stated as of 30 Sep 2026CCPAVendor-stated

Zipline has 1 registry-verified row and 4 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Zipline states on its trust centre that it has a SOC 2 Type II report, as of 25 Sep 2026. Zipline is listed in the EU-US Data Privacy Framework registry with active EU-US, UK Extension and SW-US certifications valid from 26 Feb 2025 through 27 Jan 2027, as of 17 Sep 2026. Zipline states on its trust centre that it meets GDPR requirements, as of 25 Sep 2026. Zipline states on its trust centre that it meets CCPA/CPRA requirements, as of 25 Sep 2026. Zipline displays a HIPAA badge on its trust centre as a claim, as of 25 Sep 2026, though BAA availability has not been confirmed.

  • SOC 2 Type II - vendor-stated on trust centre, not independently verified (25 Sep 2026)
  • EU-US Data Privacy Framework - listed active (EU-US, UK Extension, SW-US), valid through 27 Jan 2027 (17 Sep 2026)
  • HIPAA - vendor displays badge as a claim on trust centre; BAA availability not confirmed (25 Sep 2026)

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 25 Sep 2026; it is regenerated whenever a row changes.

Evidence count

1verified rows

retail operationsstore executiontask managementteam communication

Compliance grid

No public evidence yet for FedRAMP, PCI DSS, ISO 27001, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Subprocessors (14)

  • Amazon Web Services logo
    Amazon Web ServicesCDN and File Storage · United States, EU, Singapore
  • CD
    Crunchy DataDatabase Hosting · United States, EU, Singapore
  • Datadog logo
    DatadogLogging, Monitoring, and Alerting · United States and EU
  • EL
    elasticSearch · United States, EU, Singapore
  • Fivetran logo
    FivetranData Analytics · United States
  • Google Cloud Platform logo
    Google Cloud PlatformData Warehousing and Analytics · United States and EU
  • HE
    HerokuApplication Hosting · United States, EU, Singapore
  • Intercom logo
    IntercomLive Chat Customer Support · United States
  • LA
    LangFuseAI Observability · United States
  • ME
    MetabaseData Analytics · United States and EU
  • OpenAI logo
    OpenAIInference and Summarization of Content · United States
  • RE
    RedisIn-memory Data Caching · United States, EU, Singapore
  • Sentry logo
    SentryLogging, Monitoring, and Alerting · United States
  • SparkPost logo
    SparkPostEmail Delivery · United States and EU

Security profile

Pen test cadence
annual

Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.

Change history

  1. 22 Sep 2026DPA changedThe data processing agreement URL changed.
  2. 18 Sep 2026CCPA / CPRA evidence addedA CCPA / CPRA row entered the index with state Vendor-stated.
  3. 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
  4. 18 Sep 2026HIPAA evidence addedA HIPAA row entered the index with state Vendor-stated.
  5. 18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
  6. 18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
  7. 18 Sep 2026Subprocessor added: Crunchy DataCrunchy Data appeared on the subprocessor list.
  8. 18 Sep 2026Subprocessor added: DatadogDatadog appeared on the subprocessor list.
  9. 18 Sep 2026Subprocessor added: FivetranFivetran appeared on the subprocessor list.
  10. 18 Sep 2026Subprocessor added: Google Cloud PlatformGoogle Cloud Platform appeared on the subprocessor list.

Evidence against regulations

All regulations for Zipline

How much of each regulation’s vendor requirements Zipline’s public evidence reaches.

Reviewing a vendor on public evidence

All articles