Segment vs Amplitude vs Mixpanel: Security & Compliance Comparison
Summary
- Segment holds 10 certifications. Amplitude holds 12 certifications. Mixpanel holds 7 certifications.
- Both are certified for: SOC 2, ISO 27001, GDPR, UK GDPR, EU-US DPF, Swiss-US DPF.
- Segment has but Amplitude and Mixpanel don't: ISO 27017, ISO 27018, CCPA, HIPAA.
- Amplitude has but Segment and Mixpanel don't: SOC 1, ISO 27017, ISO 27018, CCPA, HIPAA, DORA.
- Mixpanel has but Segment and Amplitude don't: ISO 27701.
Side-by-side: all 32 frameworks
| Framework | Segment | Amplitude | Mixpanel |
|---|---|---|---|
| Security & General Standards | |||
| SOC 2 | ✓SOC 2 listed with report on Segment Trust Center (security.segment.com) | ✓SOC 2 Type II report (2025-2026) listed on Amplitude Trust Center | ✓Native and active SOC 2 Type II attestation per mixpanel.com/legal/security-overview |
| SOC 3 | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| SOC 1 | ?Not documented on public trust center | ✓SOC 1 Type 2 report (valid through October 2026) listed on Trust Center | ?Not documented on public security overview |
| ISO 27001 | ✓ISO/IEC 27001 certified (Schellman) with SoA on Segment Trust Center | ✓ISO 27001 certificate listed on Amplitude Trust Center | ✓ISO 27001 certified per security overview |
| ISO 27017 | ✓ISO/IEC 27017:2015 listed on Segment Trust Center | ✓ISO 27017 included in Amplitude ISO 27001/27017/27018 certificate | ?Not documented for Mixpanel itself; hosting provider Google Cloud holds ISO 27017 |
| ISO 27018 | ✓ISO/IEC 27018:2019 listed on Segment Trust Center | ✓ISO 27018 included in Amplitude ISO 27001/27017/27018 certificate | ?Not documented for Mixpanel itself; hosting provider Google Cloud holds ISO 27018 |
| ISO 27701 | ?Not documented on public trust center | ?Not documented on public trust center | ✓ISO 27701 certified per security overview and third-party trust listings |
| ISO 42001 | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| ISO 9001 | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| CSA STAR | ?Not documented on public trust center | ?CAIQ available but CSA STAR registry listing not documented | ?Google Cloud holds CSA STAR; Mixpanel itself not documented |
| HITRUST | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| BSI C5 | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| Privacy & Data Transfer | |||
| GDPR | ✓GDPR listed on Segment Trust Center with DPA available | ✓GDPR compliance documented; global DPA available on Trust Center | ✓GDPR compliance commitment documented with tools for customer GDPR requirements |
| CCPA | ✓CCPA listed on Segment Trust Center | ✓CCPA compliance documented on security and privacy FAQ | ~CCPA obligations addressed in privacy documentation but explicit certification not documented |
| UK GDPR | ✓Not explicitly documented | ✓Not explicitly documented | ✓Not explicitly documented |
| LGPD | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| PIPEDA | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| DPDP Act | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| PIPL | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| EU-US DPF | ✓Twilio (Segment's parent) self-certifies under EU-US Data Privacy Framework | ✓EU-US Data Privacy Framework FAQ listed on Trust Center; Amplitude is DPF self-certified | ✓Not explicitly documented on public security overview |
| Swiss-US DPF | ✓Twilio self-certification covers Swiss-US Data Privacy Framework | ✓Covered under DPF self-certification but Swiss-US not explicitly broken out | ✓Not documented on public security overview |
| Global CBPR | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| Global PRP | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| Industry & Government | |||
| HIPAA | ✓HIPAA listed on Segment Trust Center | ✓Amplitude & HIPAA documentation available on Trust Center | ~Not documented; no public BAA/HIPAA support documentation found |
| PCI DSS | ?Twilio-wide PCI DSS Level 1 exists but not explicitly documented for Segment product | ?Not documented on public trust center | ?Hosting provider Google Cloud is PCI certified; Mixpanel itself not documented |
| FedRAMP | —Not listed on FedRAMP Marketplace | —Not listed on FedRAMP Marketplace | —Not listed on FedRAMP Marketplace |
| StateRAMP | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| DORA | ?Not documented on public trust center | ✓DORA FAQ and DORA Addendum published on Trust Center | ?Not documented on public security overview |
| CJIS | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| FINRA | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| IRAP | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
| Emerging & Strategic | |||
| NIST CSF | ?Not documented on public trust center | ?Not documented on public trust center | ?Not documented on public security overview |
✓ Certified~ Partial / conditional— Not certified? Not publicly documented
Need help choosing?
Join our waitlist for compliance alerts and expert comparisons.
Join the waitlist →