Algolia Trust Center

specification: API Commons Trust Center
specificationVersion: '0.1'
provider: Algolia
providerId: algolia
generated: '2026-09-23'
method: probed
source: https://trust.algolia.com
description: Algolia publishes a Vanta-hosted Trust Center at trust.algolia.com. It is the canonical destination for Algolia's
  compliance posture - the older marketing page at /distributed-secure/security-compliance/ now 301s to it, and www.algolia.com/security
  serves the same Trust Center application.
trust_center:
  url: https://trust.algolia.com
  http_status: 200
  title: Algolia Trust Center
  canonical: https://trust.algolia.com
  vendor: Vanta
  vendor_evidence: content-location header points at https://assets.vanta.com/static/index-trust-report.<hash>.html
  redirects_from:
  - url: https://www.algolia.com/distributed-secure/security-compliance/
    status: 301
    target: https://trust.algolia.com/
  - url: https://www.algolia.com/security
    status: 200
    note: Serves the same Vanta Trust Center application.
certifications: []
compliance_notes:
  read: false
  named: []
  reason: NOT recorded, deliberately. The Vanta Trust Center renders its certification list client-side - the served HTML
    is a 6.4 KB application shell with the certification data fetched by JavaScript, and the Vanta API endpoint behind it
    returns 401 Unauthorized to an anonymous caller. The supporting Algolia article (support.algolia.com/hc/en-us/articles/4406981951889
    "What is Algolia's product compliance?") returns HTTP 403 to automated fetches behind a Cloudflare bot challenge. Algolia's
    own llms.txt asserts "SOC2, GDPR, HIPAA compliance details" behind that link, but that is a marketing summary line and
    not a machine-readable attestation, so no certification name is asserted in this artifact. A human in a browser can read
    the list; an agent cannot.
  probed:
  - url: https://trust.algolia.com
    status: 200
    note: JS-rendered SPA shell; no certification names in the served HTML.
  - url: https://api.vanta.com/v1/trust-centers/35qkoispbisbf5si15k7o
    status: 401
    note: Unauthorized.
  - url: https://support.algolia.com/hc/en-us/articles/4406981951889-What-is-Algolia-s-product-compliance-
    status: 403
    note: Cloudflare bot challenge.
compliance_program:
  published: true
  evidence: A dedicated, canonical, vendor-operated Trust Center reachable at a first-party subdomain, with a 301 from the
    provider's own security page. That establishes a published compliance program even though the individual attestations
    were not machine-readable.
related_security_documentation:
- name: Shared responsibility model
  url: https://www.algolia.com/doc/guides/security/security-best-practices/in-depth/shared-responsibility.md
  note: States Algolia is responsible for "remaining compliant with standards and certifications" and for "letting you know
    about potential vulnerabilities", and documents SAML SSO and AES256 encryption (Algolia Vault) as Enterprise add-ons.
- name: Security best practices
  url: https://www.algolia.com/doc/guides/security/security-best-practices
- name: Algolia Vault
  url: https://www.algolia.com/doc/guides/security/algolia-vault
  note: AES256 encryption at rest, Enterprise add-on.
- name: API key restrictions
  url: https://www.algolia.com/doc/guides/security/api-keys/in-depth/api-key-restrictions
policies:
  terms_of_service:
    url: https://www.algolia.com/policies/terms/
    status: 200
  privacy_policy:
    url: https://www.algolia.com/policies/privacy/
    status: 200
  sla:
    url: https://www.algolia.com/policies/sla/
    status: 200