generated: '2026-08-14'
method: searched
probe: true
url: https://trust.bigtincan.com/
domain_note: >-
  Showpad's trust center is served on bigtincan.com, not showpad.com. This is a parent-brand
  case confirmed from Showpad's own site: the "Visit Trust Center" button on
  https://www.showpad.com/security links directly to https://trust.bigtincan.com/, and
  Showpad's own navigation carries a "Showpad x Bigtincan" entry. The trust center names
  Showpad explicitly as a covered brand alongside Bigtincan.
security_page: https://www.showpad.com/security
certifications:
  - name: SOC 2 Type II
    scope: Showpad and Bigtincan
    source: https://trust.bigtincan.com/
  - name: ISO 27001
    scope: Showpad and Bigtincan
    source: https://trust.bigtincan.com/
  - name: ISO 27701
    scope: Showpad
    source: https://trust.bigtincan.com/
quote: >-
  "Showpad currently maintains ISO27001 and ISO27701 certificates as well as SOC 2 Type II
  reports. Bigtincan currently maintains ISO27001 certificates and SOC 2 Type II Reports."
encryption:
  at_rest: AES 256
  in_transit: TLS 1.2 or higher
  source: https://trust.bigtincan.com/
privacy:
  gdpr_page: https://www.showpad.com/gdpr
  privacy_principles: https://www.showpad.com/privacy-principles
  privacy_policy: https://www.showpad.com/privacy-policy
  data_security_page: https://www.showpad.com/product/data-security-and-privacy
identity_controls:
  sso: SAML 2.0 single sign-on
  provisioning: SCIM provisioning to sync accounts from an identity provider
  permissions: Granular permissions down to the file level; read-only licenses
evidence:
  - source: https://www.showpad.com/security
    http_status: 200
    kind: security-page
    keywords: [trust center, responsible disclosure, sso, scim]
  - source: https://trust.bigtincan.com/
    http_status: 200
    kind: trust-center
    keywords: [soc 2, iso 27001, iso 27701, showpad, bigtincan]
not_claimed:
  - HIPAA
  - PCI DSS
  - FedRAMP
  - IRAP
  - CSA STAR
not_claimed_note: >-
  ISAE 3402 Type I appears in older Showpad press releases but is NOT listed on the current
  trust center, so it is not recorded as a live certification.
subdomain_false_positives:
  - host: trust.showpad.com
    result: HTTP 200 but redirects to a Showpad tenant login (/login?redirect=...) — a customer
      instance, not a trust center.
  - host: security.showpad.com
    result: HTTP 200 but redirects to a Showpad tenant login — a customer instance.