generated: '2026-08-12'
method: searched
probe: true
url: https://compliance.salesforce.com/en/services/marketing-cloud-intelligence
trust_hub: https://trust.salesforce.com/
ownership_note: >-
  Salesforce acquired Datorama in August 2018 and runs it as Marketing Cloud Intelligence, so the
  trust surface is Salesforce's — but it is not generic: the Salesforce compliance site publishes a
  service page named "Marketing Cloud - Intelligence" and four audit documents whose titles name
  this product explicitly as "MC Intelligence (fka Datorama)". Only certifications actually listed
  under that service page are recorded here.
probed: '2026-08-12'
http_status: 200
service_scope: Marketing Cloud - Intelligence
documents_total: 55
documents_enumerated: 10
enumeration_note: >-
  The service's document table is client-side paginated at 10 rows per page; only page 1 was read,
  so this is a floor, not a complete list.
certifications:
- SOC 2
- SOC 3
- C5 (ISAE 3000)
- UK Cyber Essentials
- UK Cyber Essentials Plus
- Spain ENS High
- EU Processor Binding Corporate Rules
datorama_named_documents:
- {name: 'SOC 2 Report - MC Intelligence (fka Datorama)', updated: '2026-06-16', infrastructure: [AWS, Azure]}
- {name: 'SOC 3 Report - MC Intelligence (fka Datorama)', updated: '2026-06-16', infrastructure: [AWS, Azure]}
- {name: 'DR Summary - MC Intelligence (fka Datorama)'}
- {name: 'Vulnerability/Penetration Report Summary - MC Intelligence (fka Datorama)'}
other_documents_listed:
- {name: 'SOC 2 Report - MCE,Intelligence,Advertising,MC Einstein,Personalization,MC Next', updated: '2026-06-16', infrastructure: [AWS, Hyperforce]}
- {name: 'C5 (ISAE 3000) Report - Marketing Cloud', updated: '2026-06-28', infrastructure: [First party, AWS, Hyperforce]}
- {name: 'UK Cyber Essentials Certificate', updated: '2026-06-22'}
- {name: 'UK Cyber Essentials Plus Certificate', updated: '2026-06-22'}
- {name: 'Spain ENS High - Corporate Services', updated: '2026-06-09'}
- {name: 'Spain ENS High - Marketing Cloud Next', updated: '2026-06-09'}
- {name: 'Salesforce EU Processor Binding Corporate Rules', updated: '2026-05-06'}
- {name: 'Salesforce Enterprise Resilience/BCP Summary', updated: '2026-07-23'}
not_asserted:
  note: >-
    The compliance site's global category taxonomy also names ISO 27001/27017/27018, HIPAA, PCI DSS,
    FedRAMP, CSA STAR, HITRUST, TISAX, IRAP and others. Those are the catalog's site-wide vocabulary
    and were NOT shown on the Marketing Cloud - Intelligence document list that was read, so they
    are deliberately not claimed for this product here.
access:
  gated: false
  note: >-
    The service page and document titles are public. Downloading individual audit reports requires a
    login on compliance.salesforce.com.
status_page: https://status.salesforce.com/products/Datorama
status_page_vanity: https://trust.datorama.com
evidence:
- {source: 'https://compliance.salesforce.com/en/services/marketing-cloud-intelligence', http_status: 200, keywords: [SOC 2, SOC 3, C5, Cyber Essentials, ENS, Binding Corporate Rules], fetched: '2026-08-12'}
- {source: 'https://trust.salesforce.com/', http_status: 200, fetched: '2026-08-12'}
- {source: 'https://trust.datorama.com', http_status: 200, fetched: '2026-08-12', note: '301s to status.salesforce.com/products/Datorama'}
probe_result:
  script: 0-working/probe-security-programs.py
  run: '2026-08-12'
  result: 'trust=none'
  note: >-
    The mechanical probe found nothing on the datorama.com domain because it redirects to a
    salesforce.com marketing page. This file is the searched upgrade over that null result.