generated: '2026-08-04'
method: searched
source: https://www.threatdown.com/legal/trust-and-compliance/
trust_center:
  published: true
  url: https://www.threatdown.com/legal/trust-and-compliance/
  name: ThreatDown Trust and Compliance
  hosted: first-party
  note: >-
    A first-party legal/trust page on threatdown.com, not a hosted trust portal
    (no SafeBase, Conveyor, Vanta or Drata instance was found on any Malwarebytes or
    ThreatDown host). There is no self-serve document request flow or NDA-gated
    evidence room; reports are obtained through sales/support.
certifications:
- name: SOC 2 Type II
  standard: AICPA Trust Services Criteria
  criteria:
  - Security
  - Availability
  - Confidentiality
  auditor: Schellman & Company
  evidence: >-
    "audited by a third-party auditing firm (Schellman & Company) against Trust
    Services Criteria (TSC) for Security, Availability, and Confidentiality"
  source: https://www.threatdown.com/legal/trust-and-compliance/
- name: ISO/IEC 27001
  standard: ISO/IEC 27001 Information Security Management System
  auditor: Schellman Compliance
  evidence: >-
    "undergone an independent audit by Schellman Compliance, a recognized third-party
    auditing firm"
  verification_url: https://www.schellman.com/certificate-directory
  source: https://www.threatdown.com/legal/trust-and-compliance/
- name: PCI DSS
  standard: Payment Card Industry Data Security Standard
  attestation: Attestation of Compliance (AoC)
  auditor: Qualified Security Assessor (QSA), not named on the page
  evidence: >-
    "Malwarebytes engages with a Qualified Security Assessor (QSA) for its Attestation
    of Compliance (AoC)"
  source: https://www.threatdown.com/legal/trust-and-compliance/
frameworks:
- name: NIST Cybersecurity Framework
  role: security program foundation, not a certification
  evidence: >-
    "We built our cybersecurity practices on the same framework that the US government
    relies on to protect the nation's critical infrastructure"
not_claimed:
- HIPAA
- FedRAMP
- ISO/IEC 27017
- ISO/IEC 27018
- Cyber Essentials
- TISAX
- StateRAMP
gaps:
- >-
  No certificate numbers, audit periods, or report validity dates are published, so the
  currency of the SOC 2 and ISO 27001 attestations cannot be verified from the public page.
- >-
  No machine-readable trust artifact (no /.well-known/api-catalog, no OSCAL, no
  compliance JSON) is published anywhere on the estate.
x-evidence:
  fetched: '2026-08-04'
  url: https://www.threatdown.com/legal/trust-and-compliance/
  http_status: 200