Security and privacy at Amplitude

Amplitude maintains SOC 2 Type 2, ISO 27001, ISO 27017, and ISO 27018 certifications, and self-certifies under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. The platform supports your compliance obligations under GDPR and CCPA.

Use this page to find the underlying documentation, understand what each program covers, and reach the right team with a question.

Request compliance documentation

Amplitude publishes its audit reports and compliance documentation in the Customer Trust Portal. The portal holds:

• The SOC 2 Type II report.
• The Data Processing Addendum (DPA).
• ISO/IEC 27001, 27017, and 27018 certificates.
• Privacy-related documentation, including the EU-U.S. Data Privacy Framework FAQ.

Access to individual documents is gated. Request access through the portal, which handles the non-disclosure agreement before it releases a report.

What the SOC 2 report covers

The SOC 2 Type II report describes Amplitude's Digital Analytics Platform and the suitability of the design and operating effectiveness of controls relevant to security, availability, and confidentiality. Download the current report from the Customer Trust Portal.

How the DPA applies

The Data Processing Addendum forms part of the Amplitude Terms of Service, or of any other written or electronic agreement that governs your use of Amplitude. It applies to paying and non-paying customers alike. Read it at amplitude.com/terms/dpa, or download the countersigned version from the Customer Trust Portal.

Terms and privacy policy

Amplitude's Terms of Service incorporate the Data Processing Addendum and the Acceptable Use Policy.

The Privacy Notice describes how Amplitude collects, stores, uses, discloses, and otherwise processes information. It covers visitors to amplitude.com, including the Community Forum and Amplitude Academy, Amplitude's marketing activities, and customers who access and use Amplitude's products.

For a broader overview of Amplitude's security and privacy posture, go to Trust, Security and Privacy.

HIPAA and protected health information

Amplitude can enter a Business Associate Agreement (BAA) with customers on the Growth and Enterprise plans that process protected health information. A BAA isn't available on the Free or Plus plans. Contact your account team to start the process.

Report a security vulnerability

Amplitude runs a private bug bounty program on Bugcrowd. Submit findings through tracker.bugcrowd.com/amplitude, or email security@amplitude.com to request an invitation or ask about the reward system. Amplitude's machine-readable policy is published at amplitude.com/.well-known/security.txt.

Alongside the bug bounty, Amplitude operates these ongoing security procedures:

• Continuous automated vulnerability monitoring across production cloud infrastructure, plus automated scanning of source code and the application.
• Ad-hoc scanning and testing of new features and functionality.
• Annual third-party penetration testing of the application, using standard web application penetration testing methodology.
• A dedicated third-party penetration test of Amplitude's AI functionality.

Amplitude triages issues from any of these channels, prioritizes them by risk and impact, and remediates them within defined service-level agreements.

Contact the right team