--- title: Security and privacy at Amplitude description: "Amplitude's certifications and compliance programs, where to request SOC 2 and ISO reports, how to report a vulnerability, and who to contact for security or privacy questions." product: general lang: en last_updated: 2026-11-10 token_estimate: 1345 --- # Security and privacy at Amplitude Amplitude maintains SOC 2 Type 2, ISO 27001, ISO 27017, and ISO 27018 certifications, and self-certifies under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. The platform supports your compliance obligations under GDPR and CCPA. > For AI agents: a documentation index is available at [/docs/llms.txt](/docs/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`. Use this page to find the underlying documentation, understand what each program covers, and reach the right team with a question. ## Plan availability Data encryption and Security certifications are available on all plans. Go to [Amplitude pricing](https://amplitude.com/pricing) for plan details. _Availability reflects the latest Amplitude plans. If your organization is on an older plan, your access may differ. Check your plan under [Plans & Billing in your organization settings](/docs/admin/account-management/account-settings#organizational-settings), or contact your Amplitude account representative._ ## Request compliance documentation Amplitude publishes its audit reports and compliance documentation in the [Customer Trust Portal](https://trust.amplitude.com). The portal holds: - The SOC 2 Type II report. - The Data Processing Addendum (DPA). - ISO/IEC 27001, 27017, and 27018 certificates. - Privacy-related documentation, including the EU-U.S. Data Privacy Framework FAQ. Access to individual documents is gated. Request access through the portal, which handles the non-disclosure agreement before it releases a report. ### What the SOC 2 report covers The SOC 2 Type II report describes Amplitude's Digital Analytics Platform and the suitability of the design and operating effectiveness of controls relevant to security, availability, and confidentiality. Download the current report from the [Customer Trust Portal](https://trust.amplitude.com). ### How the DPA applies The Data Processing Addendum forms part of the [Amplitude Terms of Service](https://amplitude.com/terms), or of any other written or electronic agreement that governs your use of Amplitude. It applies to paying and non-paying customers alike. Read it at [amplitude.com/terms/dpa](https://www.amplitude.com/terms/dpa), or download the countersigned version from the [Customer Trust Portal](https://trust.amplitude.com). ### Terms and privacy policy Amplitude's Terms of Service incorporate the [Data Processing Addendum](https://www.amplitude.com/terms/dpa) and the [Acceptable Use Policy](https://www.amplitude.com/aup). The [Privacy Notice](https://amplitude.com/privacy) describes how Amplitude collects, stores, uses, discloses, and otherwise processes information. It covers visitors to [amplitude.com](https://amplitude.com/), including the Community Forum and Amplitude Academy, Amplitude's marketing activities, and customers who access and use Amplitude's products. > **Note:** > > Read Amplitude's [Terms of Service](https://amplitude.com/terms) and [Privacy Notice](https://amplitude.com/privacy) in full to understand Amplitude's policies and practices for information collected through the website and the product. For a broader overview of Amplitude's security and privacy posture, go to [Trust, Security and Privacy](https://amplitude.com/security-and-privacy). ## HIPAA and protected health information Amplitude can enter a Business Associate Agreement (BAA) with customers on the Growth and Enterprise plans that process protected health information. A BAA isn't available on the Free or Plus plans. Contact your account team to start the process. ## Report a security vulnerability Amplitude runs a private bug bounty program on Bugcrowd. Submit findings through [tracker.bugcrowd.com/amplitude](https://tracker.bugcrowd.com/amplitude), or email [security@amplitude.com](mailto:security@amplitude.com) to request an invitation or ask about the reward system. Amplitude's machine-readable policy is published at [amplitude.com/.well-known/security.txt](https://amplitude.com/.well-known/security.txt). Alongside the bug bounty, Amplitude operates these ongoing security procedures: - Continuous automated vulnerability monitoring across production cloud infrastructure, plus automated scanning of source code and the application. - Ad-hoc scanning and testing of new features and functionality. - Annual third-party penetration testing of the application, using standard web application penetration testing methodology. - A dedicated third-party penetration test of Amplitude's AI functionality. Amplitude triages issues from any of these channels, prioritizes them by risk and impact, and remediates them within defined service-level agreements. ## Contact the right team | Topic | Contact | | --- | --- | | Security and compliance questions | [security@amplitude.com](mailto:security@amplitude.com) | | Security questionnaires | [securityquestionnaires@amplitude.com](mailto:securityquestionnaires@amplitude.com) | | Privacy questions | [privacy@amplitude.com](mailto:privacy@amplitude.com) | | Vulnerability reports | [tracker.bugcrowd.com/amplitude](https://tracker.bugcrowd.com/amplitude) | | Ethics and fraud concerns | [Amplitude's reporting hotline](https://www.whistleblowerservices.com/AMPL), or 1-866-641-0775 |