Prismic Trust Center

generated: '2026-08-13'
method: searched
probe: true
source: https://prismic.io/legal/security
url: https://prismic.io/legal/security
page_last_updated: '2026-06-11'
kind: security policy page
trust_center: false
trust_center_note: >-
  Prismic does not operate a trust center. trust.prismic.io and
  security.prismic.io do not resolve to a trust portal; what exists is one static
  legal page, https://prismic.io/legal/security, with no downloadable evidence,
  no report request flow and no subprocessor list.
certifications: []
certifications_correction: >-
  CORRECTED 2026-08-13. A prior automated pass recorded SOC 2, ISO 27001,
  ISO 27017, ISO 27018, PCI DSS, GDPR and CSA STAR as Prismic certifications.
  They are not. Reading the page in full, every one of those names belongs to a
  THIRD PARTY, and Prismic's own text says so plainly:
    - ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, PCI-DSS Level 1, SOC 1, SOC 2,
      SOC 3 and CSA STAR Levels 1-3 are listed in the "Data hosting and storage"
      section as AWS's certifications — "AWS is widely recognized as a global
      leader in cloud infrastructure, with its data centers and services
      certified against ... " Prismic hosts on AWS us-east-1; it does not hold
      these.
    - PCI is disclaimed outright: "All payment instrument processing is
      outsourced to Stripe. Stripe ... is certified as a PCI Service Provider
      Level 1."
    - SOC 2 and ISO 27001 also appear in the "Third-party suppliers" paragraph,
      as certifications Prismic REQUIRES OF ITS OWN SUPPLIERS.
  Prismic names no certification of its own anywhere on the page. Its
  "Compliance certifications & policies" section describes internal auditing,
  legal watch, annual security training and Stripe's PCI status — no audited
  attestation. Keyword-matching a security page is how a hosting provider's
  compliance posture gets credited to its tenant; this file records the
  distinction instead.
own_certifications: none published
supplier_certifications:
  - {party: AWS, role: infrastructure host (us-east-1), certifications: [ISO/IEC 27001,
      ISO/IEC 27017, ISO/IEC 27018, PCI-DSS Level 1, SOC 1, SOC 2, SOC 3, CSA STAR
        Levels 1-3]}
  - {party: Stripe, role: payment processing, certifications: [PCI Service Provider
        Level 1]}
  - {party: Intercom, role: 'sales, marketing and support — processes personal data'}
published_practices:
  - {area: penetration testing, detail: Performed on a yearly basis by external independent
      contractors specializing in web application cybersecurity, with a remediation
      plan scheduled by criticality and re-testing of resolved issues.}
  - {area: vulnerability scanning, detail: Continuous, using industry standards and
      tools.}
  - {area: security audits, detail: Periodic internal evaluation of peripheral and
      in-depth services by external independent contractors.}
  - {area: secure development lifecycle, detail: Code peer review plus a security checklist
      per release; non-regression testing and approval before production.}
  - {area: security policies, detail: 'Internal policy set covering access control,
      physical security, secure development, data protection, privacy and confidentiality;
      reviewed periodically.'}
  - {area: security training, detail: Annual security and awareness training for all
      employees.}
  - {area: incident response, detail: 'Documented Incident Response Plan with tenant-specific
      security contacts for Enterprise customers; incident declaration, action tracking,
      stakeholder communication and post-incident documentation.'}
  - {area: business continuity, detail: Redundant deployment across three Availability
      Zones in one AWS region, with backups/snapshots/replication and point-in-time
      recovery to S3, plus documented runbooks and infrastructure-as-code redeployment.}
  - {area: audit logging, detail: Tooling and processes monitoring account activity
      across the infrastructure.}
  - {area: network segregation, detail: 'AWS Network Security Group rules, reviewed
      and adapted at least annually; virtual firewall between tenants.'}
data_protection:
  gdpr: 'Claimed — "Prismic fulfils its obligations and maintains transparency about
    how it processes personal data."'
  dpa:
    available_online: false
    note: '"Prismic is in the process of making a DPA available online" — in the meantime
      Enterprise customers must go through their Account Manager.'
  data_residency: AWS us-east-1 (Northern Virginia, USA) — single region, no choice
    offered
  data_portability: Content and metadata exportable through the tenant API endpoint
  personal_data_scope: 'Limited to the name and email of business users with repository
    access; more may be processed by Intercom.'
  contacts:
    data_privacy: dataprivacy@prismic.io
    security: security@prismic.io
sso:
  supported: true
  standards: [OAuth2, AD, Okta]
  tier: Enterprise only, on request
  mfa: via the customer's own identity provider
uptime:
  sla_document: none published
  sla_availability: Enterprise tier only ("Support and uptime SLAs")
  monitoring: https://status.prismic.io/
evidence:
  - {source: 'https://prismic.io/legal/security', http_status: 200, fetched: '2026-08-13',
     read: full page text, not keyword match}