Sonatype Nexus Repository Trust Center

generated: '2026-11-05'
method: searched
probe: true
source:
- https://trust.sonatype.com/
- https://www.sonatype.com/security-at-sonatype
- https://help.sonatype.com/en/nexus-repository-tiers-and-feature-availability.html
url: https://trust.sonatype.com/
host: trust.sonatype.com
platform: vanta
platform_evidence: Footer link to vanta.com/products/trust-center?utm_campaign=powered_by_vanta on the rendered page.
company: Sonatype
website: https://www.sonatype.com/
contact: security@sonatype.com
frameworks:
- name: SOC 2
- name: ISO 27001:2022
- name: NIST CSF 2.0
certifications:
- SOC 2 Type II
- ISO 27001:2022
- NIST CSF 2.0
certifications_detail:
- name: SOC 2 Type II
  note: '"SOC2 Type II report Published August 11, 2026 Lastest SOC2 Type II report for 2025 - 2026 now available." Report
    and Bridge Letter are request-access documents.'
- name: ISO 27001:2022
  note: ISO 27001 2022 Certificate and Statement of Applicability listed under Security Compliance & Assurance (request access).
- name: NIST CSF 2.0
  note: Listed under Compliance on the trust center overview.
- name: DHS CISA Secure Software Attestation
  note: Listed under Security Compliance & Assurance (request access).
- name: FIPS 140-2 Compliance Support
  note: 'Editions matrix: "FIPS 140-2 Compliance Support" Available in Pro, Pro+ and Enterprise editions; N/A in Community
    Edition.'
resources: SOC 2 Type II Report; ISO 27001 2022 Certificate; DHS CISA Secure Software Attestation; Sonatype SOC 2 Bridge Letter;
  Independent Security Assessment - Sonatype Nexus Repository; Nexus Repository VPAT; Acceptable Use Policy; Business Continuity
  and Disaster Recovery Policy; Change Management Policy; AI Acceptable Use Policy; Information Security Management Program
  Auditing Policy; Sonatype Statement of Applicability ISO 27001:2022
document_access: Most documents open a "Request access" flow (trust.sonatype.com/?requestAccessOpen=true&requestedResources=...);
  the overview, controls and updates pages are public.
control_categories:
- name: Infrastructure security
- name: Organizational security
- name: Product security
- name: Internal security procedures
- name: Data and privacy
overview: '"To earn your trust, we share our security and compliance programs with you." Security program described as aligned
  with ISO 27001 and NIST frameworks, governed by a formal executive committee, with a Third-Party Risk Management program
  (security-at-sonatype page).'
probe_detail:
  url: https://trust.sonatype.com/
  status: 200
  rendered: true
  fetched: '2026-11-05'