Malwarebytes Trust Center

generated: '2026-08-04'
method: searched
source: https://www.threatdown.com/legal/trust-and-compliance/
trust_center:
  published: true
  url: https://www.threatdown.com/legal/trust-and-compliance/
  name: ThreatDown Trust and Compliance
  hosted: first-party
  note: A first-party legal/trust page on threatdown.com, not a hosted trust portal (no SafeBase, Conveyor, Vanta
    or Drata instance was found on any Malwarebytes or ThreatDown host). There is no self-serve document request
    flow or NDA-gated evidence room; reports are obtained through sales/support.
certifications:
- SOC 2 Type II
- ISO/IEC 27001
- PCI DSS
frameworks:
- name: NIST Cybersecurity Framework
  role: security program foundation, not a certification
  evidence: '"We built our cybersecurity practices on the same framework that the US government relies on to protect
    the nation''s critical infrastructure"'
not_claimed:
- HIPAA
- FedRAMP
- ISO/IEC 27017
- ISO/IEC 27018
- Cyber Essentials
- TISAX
- StateRAMP
gaps:
- No certificate numbers, audit periods, or report validity dates are published, so the currency of the SOC 2 and
  ISO 27001 attestations cannot be verified from the public page.
- No machine-readable trust artifact (no /.well-known/api-catalog, no OSCAL, no compliance JSON) is published anywhere
  on the estate.
x-evidence:
  fetched: '2026-08-04'
  url: https://www.threatdown.com/legal/trust-and-compliance/
  http_status: 200
certification_details:
- name: SOC 2 Type II
  standard: AICPA Trust Services Criteria
  criteria:
  - Security
  - Availability
  - Confidentiality
  auditor: Schellman & Company
  evidence: '"audited by a third-party auditing firm (Schellman & Company) against Trust Services Criteria (TSC)
    for Security, Availability, and Confidentiality"'
  source: https://www.threatdown.com/legal/trust-and-compliance/
- name: ISO/IEC 27001
  standard: ISO/IEC 27001 Information Security Management System
  auditor: Schellman Compliance
  evidence: '"undergone an independent audit by Schellman Compliance, a recognized third-party auditing firm"'
  verification_url: https://www.schellman.com/certificate-directory
  source: https://www.threatdown.com/legal/trust-and-compliance/
- name: PCI DSS
  standard: Payment Card Industry Data Security Standard
  attestation: Attestation of Compliance (AoC)
  auditor: Qualified Security Assessor (QSA), not named on the page
  evidence: '"Malwarebytes engages with a Qualified Security Assessor (QSA) for its Attestation of Compliance (AoC)"'
  source: https://www.threatdown.com/legal/trust-and-compliance/