Benchling Trust Center

generated: '2026-08-15'
method: searched
source: https://www.benchling.com/trust (HTTP 200), plus https://securitytrust.benchling.com/ (HTTP 200,
  the gated Trust Portal) and https://www.benchling.com/information-security-policy (HTTP 200).
description: 'Benchling runs a real trust center with named third-party attestations, which matters for
  this provider more than for most: its customers are pharma and biotech companies whose lab records fall
  under FDA 21 CFR Part 11 and GxP, so the compliance page is part of the product, not marketing. Certifications
  are named on the public page; the underlying reports sit behind a gated Trust Portal. Note what is NOT
  here — no security.txt, no published vulnerability disclosure policy and no bug bounty, so a researcher
  who finds a flaw has no documented route in beyond trust@benchling.com.'
trust_center:
  url: https://www.benchling.com/trust
  status: 200
  portal: https://securitytrust.benchling.com/
  portal_status: 200
  portal_note: Gated trust portal hosting the security whitepaper and the underlying audit reports; document
    access requires a request.
  contact: trust@benchling.com
certifications:
- SOC 2 Type 2
- ISO/IEC 27001:2022
- ISO/IEC 27017:2015
- ISO/IEC 27018:2025
regulatory_frameworks:
- name: FDA 21 CFR Part 11
  type: compliance
  note: Electronic records and electronic signatures. The v3 API exposes a first-class AuditLog resource,
    which is the technical substrate this requires.
- name: EU Annex 11
  type: compliance
- name: GxP
  type: compliance
  note: Validation support is sold as an Enterprise-tier capability — plans/benchling-plans-pricing.yml.
- name: GDPR
  type: compliance
- name: EU-US Data Privacy Framework
  type: program
- name: CCPA
  type: compliance
- name: NIST
  type: alignment
- name: C5 (Germany)
  type: alignment
- name: NCSC (UK)
  type: alignment
security_practices:
  encryption_at_rest: AES-256
  encryption_in_transit: TLS 1.2 or higher
  penetration_testing: Annual, by an independent third party
  mfa: Required
  sso: SSO / OIDC identity provider support
  audit_trail: Audit trail plus citation architecture for AI outputs
documents:
- name: Information Security Policy
  url: https://www.benchling.com/information-security-policy
  status: 200
- name: Security Whitepaper
  url: https://securitytrust.benchling.com/
  status: 200
  gated: true
- name: Agreements and Terms
  url: https://www.benchling.com/agreements-and-terms
  status: 200
- name: Privacy Center
  url: https://www.benchling.com/privacy
  status: 200
vulnerability_disclosure:
  published: false
  security_txt: false
  bug_bounty: false
  note: probe-security-programs.py returned vdp=none trust=none on 2026-08-15, and /.well-known/security.txt
    404s on www.benchling.com and docs.benchling.com (benchling.com answers 200 with an HTML sign-in shell,
    not a document — see well-known/benchling-well-known.yml). No HackerOne, Bugcrowd or Intigriti programme
    and no /security or /responsible-disclosure page was found. The only published security address is
    trust@benchling.com, which is a trust / compliance contact rather than a disclosure channel. No VulnerabilityDisclosure
    or Security pointer is emitted as a result.
certifications_detail:
- name: SOC 2 Type 2
  type: attestation
  note: AI features stated as in scope.
- name: ISO/IEC 27001:2022
  type: certification
  note: AI features stated as in scope.
- name: ISO/IEC 27017:2015
  type: alignment
- name: ISO/IEC 27018:2025
  type: alignment