generated: '2026-08-13'
method: searched
probe: true
url: https://www.braze.com/docs/developer_guide/disclosures/security_qualifications
note: >-
  Braze runs no trust.braze.com (DNS does not resolve) and no /trust or /security page —
  probe-security-programs.py correctly returned trust=none. What Braze DOES publish is a
  Security Qualifications disclosure inside the developer docs, carrying named, dated,
  independently verifiable certifications. That is the substance a trust center exists to
  provide, so it is captured here with the probe results that led to it.
certifications:
- name: ISO 27001
  auditor: Schellman
  first_certified: '2018-12-18'
  renewed: '2025-08-29'
  expires: '2027-12-15'
  verification: Schellman certificate directory
- name: SOC 2 Type 2
  auditor: Schellman & Company, LLC
  trust_services_criteria: [Security, Availability]
  period: '2024-07-01 to 2025-06-30'
- name: TISAX
  level: AL3
  assessment_id: AMH9TZ-1
  scope_id: SNCM4K
  verification: ENX Association portal (current participants)
  covers: [GDPR Article 28 data protection, high availability, confidentiality]
- name: HIPAA
  note: Braze operates a dedicated HIPAA cluster compliant with the Security and Privacy rules; reviewed with outside counsel.
related_disclosures:
- {name: Subprocessors, url: 'https://www.braze.com/company/legal/subprocessors'}
- {name: Privacy Portal, url: 'https://www.braze.com/docs/user_guide/privacy_portal'}
- {name: Privacy Policy, url: 'https://www.braze.com/privacy/'}
evidence:
- {source: 'https://www.braze.com/docs/developer_guide/disclosures/security_qualifications', http_status: 200, keywords: [iso 27001, soc 2 type 2, tisax, hipaa, schellman]}
- {source: 'https://trust.braze.com/', http_status: 0, note: 'host does not resolve'}
- {source: 'https://www.braze.com/trust/', http_status: 404}
- {source: 'https://www.braze.com/security/', http_status: 404}
checked: '2026-08-13'