Jotform Trust Center

generated: '2026-11-05'
method: searched
source:
- https://www.jotform.com/security/
- https://www.jotform.com/enterprise/soc-2-compliance/
- https://www.jotform.com/hipaa/baa/
- https://www.jotform.com/enterprise/security/
url: https://www.jotform.com/security/
host: www.jotform.com
platform: self-hosted-or-unknown
platform_evidence: 'No dedicated trust portal: https://trust.jotform.com/ redirects to the homepage and /trust/
  -> 404. The /security/ page carries the certification and compliance claims, security practices (encryption, backups,
  audits, bug bounty) and links to SOC 2, FERPA, HECVAT, data residency and SSO pages.'
company: Jotform
website: https://www.jotform.com/
contact: https://www.jotform.com/vulnerability-disclosure-program/
certifications:
- PCI DSS Service Provider Level 1
- SOC 2 Type II (dedicated Enterprise environment)
- GDPR
- CCPA
- HIPAA (BAA)
- FERPA
- HECVAT
- StateRAMP Security Snapshot
frameworks:
- name: PCI DSS
  source: https://www.jotform.com/security/
- name: SOC 2
  source: https://www.jotform.com/security/
- name: GDPR
  source: https://www.jotform.com/security/
- name: CCPA
  source: https://www.jotform.com/security/
- name: HIPAA
  source: https://www.jotform.com/security/
- name: FERPA
  source: https://www.jotform.com/security/
- name: HECVAT
  source: https://www.jotform.com/security/
- name: StateRAMP
  source: https://www.jotform.com/security/
subprocessors:
- name: Amazon Web Services
  purpose: Data storage -- Cloud Service Provider (IaaS/PaaS)
  url: https://www.jotform.com/subprocessors/
- name: Deepgram
  purpose: AI voice technology -- AI / Voice Processing
  url: https://www.jotform.com/subprocessors/
- name: ElevenLabs
  purpose: AI voice technology -- AI / Voice Processing
  url: https://www.jotform.com/subprocessors/
- name: Google LLC / Google Cloud EMEA Limited / Google Australia Pty Ltd / Google Cloud Canada Corporation
  purpose: Data storage, AI, Google Workspace, Google Analytics -- Cloud Service Provider (IaaS/PaaS), Productivity
    Suite, AI Platform, Analytics Tracking
  url: https://www.jotform.com/subprocessors/
dpa: https://www.jotform.com/dpa/
infrastructure_note: Our primary platform is Google Cloud, which complies with SSAE16 / ISAE 3402 Type II, SOC 1,
  SOC 2, SOC 3, ISO 27001, ISO 27017 (Cloud Security), ISO 27018 (Cloud Privacy), and PCI DSS v3.2. (These are the
  hosting provider's certifications, quoted as Jotform states them, not Jotform's own.)
security_practices:
- 256 Bit SSL
- Encrypted Forms (RSA 2048 at the user's computer)
- Two-factor Authentication (2FA)
- Single Sign-On (SSO, Enterprise)
- EU Servers / local data residency
- Backups (30 days in the cloud environment)
- ASV scans for PCI, periodic penetration tests, bug bounty program
certification_evidence:
- name: PCI DSS Service Provider Level 1
  status: claimed
  evidence: Jotform is PCI DSS Service Provider Level 1 compliant, the highest security attainment you can have
    as a business that collects payments from and integrates with credit cards.
  source: https://www.jotform.com/security/
- name: SOC 2 Type II (dedicated Enterprise environment)
  status: claimed
  evidence: Jotform Enterprise now offers a dedicated SOC 2 Type II-compliant environment that customers can purchase
    access to.
  source: https://www.jotform.com/enterprise/soc-2-compliance/
- name: GDPR
  status: claimed
  evidence: Jotform is compliant with the European Union's General Data Protection Regulation (GDPR), which governs
    businesses that collect personally-identifiable information from or on EU citizens.
  source: https://www.jotform.com/security/
- name: CCPA
  status: claimed
  evidence: Jotform is compliant with the California Consumer Privacy Act (CCPA), which, among other things, prohibits
    the selling of personal information of California residents without their consent.
  source: https://www.jotform.com/security/
- name: HIPAA (BAA)
  status: offered
  evidence: We offer a Business Associate Agreement (BAA) for HIPAA customers who operate in the USA and who have
    enabled HIPAA compliance features in their account.
  source: https://www.jotform.com/hipaa/baa/
- name: FERPA
  status: claimed
  evidence: FERPA Compliance (listed; detail at https://www.jotform.com/enterprise/ferpa/)
  source: https://www.jotform.com/security/
- name: HECVAT
  status: completed
  evidence: Jotform has used the Higher Education Community Vendor Assessment Toolkit
  source: https://www.jotform.com/security/
- name: StateRAMP Security Snapshot
  status: in-program
  evidence: Jotform is currently in the security snapshot Program of StateRAMP.
  source: https://www.jotform.com/security/
subprocessors_url: https://www.jotform.com/subprocessors/
subprocessor_count: null
subprocessor_note: the first four rows of the subprocessor table are listed; the page carries more rows and no last-updated
  date