Amplitude
Product analytics and digital optimization platform for behavioral analytics and experimentation.
| Security & General Standards | |
|---|---|
| SOC 2 Type II | ✓ SOC 2 Type II report (2025-2026) listed on Amplitude Trust Center |
| SOC 3 | ? Not documented on public trust center |
| SOC 1 Type II | ✓ SOC 1 Type 2 report (valid through October 2026) listed on Trust Center |
| ISO 27001 (Information Security Management) | ✓ ISO 27001 certificate listed on Amplitude Trust Center |
| ISO 27017 (Cloud Security) | ✓ ISO 27017 included in Amplitude ISO 27001/27017/27018 certificate |
| ISO 27018 (Cloud Privacy) | ✓ ISO 27018 included in Amplitude ISO 27001/27017/27018 certificate |
| ISO 27701 (Privacy Information Management) | ? Not documented on public trust center |
| ISO 42001 (AI Management Systems) | ? Not documented on public trust center |
| ISO 9001 (Quality Management) | ? Not documented on public trust center |
| CSA STAR (Cloud Security Alliance) | ? CAIQ available but CSA STAR registry listing not documented |
| HITRUST CSF | ? Not documented on public trust center |
| BSI C5 (German Cloud Security) | ? Not documented on public trust center |
| Privacy & Data Transfer | |
| GDPR (EU) | ✓ GDPR compliance documented; global DPA available on Trust Center |
| CCPA / CPRA (California) | ✓ CCPA compliance documented on security and privacy FAQ |
| UK GDPR | ✓ Not explicitly documented |
| LGPD (Brazil) | ? Not documented on public trust center |
| PIPEDA (Canada) | ? Not documented on public trust center |
| DPDP Act (India) | ? Not documented on public trust center |
| PIPL (China) | ? Not documented on public trust center |
| EU-US Data Privacy Framework | ✓ EU-US Data Privacy Framework FAQ listed on Trust Center; Amplitude is DPF self-certified |
| Swiss-US Data Privacy Framework | ✓ Covered under DPF self-certification but Swiss-US not explicitly broken out |
| Global CBPR (APEC) | ? Not documented on public trust center |
| Global PRP (APEC) | ? Not documented on public trust center |
| Industry & Government | |
| HIPAA (US Healthcare) | ✓ Amplitude & HIPAA documentation available on Trust Center |
| PCI DSS (Payment Card Industry) | ? Not documented on public trust center |
| FedRAMP (US Federal) | — Not listed on FedRAMP Marketplace |
| StateRAMP / TX-RAMP (US State) | ? Not documented on public trust center |
| DORA (EU Finance) | ✓ DORA FAQ and DORA Addendum published on Trust Center |
| CJIS (US Law Enforcement) | ? Not documented on public trust center |
| FINRA (US Broker-Dealers) | ? Not documented on public trust center |
| IRAP (Australian Government) | ? Not documented on public trust center |
| Emerging & Strategic | |
| NIST CSF (Cybersecurity Framework) | ? Not documented on public trust center |
Data last verified: September 2026
Is this data outdated?
Spotted an error or a recent change in Amplitude's posture? Submit a correction.
Submit a correction →