specification: API Commons Trust Center
specificationVersion: '0.1'
provider: MATLAB
providerId: matlab
generated: '2026-09-14'
method: searched
source: https://www.mathworks.com/company/trust-center.html
url: https://www.mathworks.com/company/trust-center.html
note: >-
  probe-security-programs.py reported trust=none because the trust centre is at
  /company/trust-center.html rather than a /trust or /security path, and www.mathworks.com answers a
  default crawler UA with HTTP 403. Recorded here from the page itself.
certifications:
  - name: SOC 3
    status: published
    evidence: https://www.mathworks.com/content/dam/mathworks/policies/2024-soc-3-report.pdf
    note: The trust centre links a dated SOC 3 report for the MathWorks Cloud-Based Applications System; SOC 3 is the publicly distributable form of the SOC 2 examination.
  - name: SOC 2 Type II
    status: on-request
    evidence: https://www.mathworks.com/company/trust-center.html
    note: Stated as completed; the full report is released to customers through MathWorks Customer Support rather than published.
  - name: ISO 27001
    status: not-certified
    evidence: https://www.mathworks.com/company/trust-center.html
    note: >-
      MathWorks describes its information security programme as based on industry-standard frameworks
      including ISO 27001, but does NOT claim certification and the trust centre names no certificate.
      Recorded as not-certified deliberately — "based on" is not "certified to".
compliance_programs:
  - { name: GDPR, status: documented, artifact: GDPR subprocessor list (on request) }
  - { name: Data Processing Agreement, status: on-request }
  - { name: HECVAT, status: on-request, note: Higher Education Community Vendor Assessment Toolkit — the education-sector diligence questionnaire. }
  - { name: EU Standard Contractual Clauses, status: documented }
  - { name: UK International Data Transfer Addendum, status: documented }
not_claimed:
  - HIPAA
  - PCI DSS
  - FedRAMP
  - CSA STAR
  - ISO 27001 (certification)
documents:
  - { name: Information Security Practices, url: "https://www.mathworks.com/content/dam/mathworks/policies/mathworks-Information-security-practices.pdf" }
  - { name: Vulnerability Disclosure Policy, url: "https://www.mathworks.com/company/aboutus/policies_statements/vulnerability-disclosure-policy.html" }
  - { name: Privacy Policy, url: "https://www.mathworks.com/company/aboutus/policies_statements/privacy-policy.html" }
  - { name: Data Privacy FAQ, url: "https://www.mathworks.com/company/trust-center/privacy-faq.html" }
  - { name: Certifications and Representations, url: "https://www.mathworks.com/company/aboutus/policies_statements/cert_rep.html" }
incident_disclosure:
  published: true
  note: The trust centre links a public write-up of the May 2025 ransomware incident — disclosure of a real incident rather than only a policy.