Trust Center Start your security review View & download sensitive information Welcome to Cresta's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. Our enterprise-grade security and data privacy program is designed to keep your customer data safe and secure. We rely on industry best practices, security product features, and comprehensive audits of our applications, systems, and networks to ensure that your data is always protected. Here is an introduction to Cresta's security and data privacy practices. Have questions? If you have additional questions about our security program please reach out to your enterprise sales representative or email security@cresta.ai
REMOVEDCCPA CPRA GDPR HIPAA ISO/IEC 27001 ISO/IEC 27701 ISO/IEC 42001:2023 PCI DSS SOC 2 TISAX SOC 3
ADDEDISO/IEC 27701 SoA ISO/IEC 42001 SoA CCPA CPRA GDPR HIPAA ISO/IEC 27001 ISO/IEC 27701 ISO/IEC 42001:2023 PCI DSS SOC 2 TISAX ISO/IEC 27001 SoA SOC 3 ISO/IEC 27701 SoA ISO/IEC 42001 SoA
CCPA CPRA GDPR HIPAA ISO/IEC 27001 ISO/IEC 27701 ISO/IEC 42001:2023 PCI DSS SOC 2 TISAX
ADDEDISO/IEC 27001 SoA
SOC 3 United Airlines Hilton Grand Vacations Holiday Inn Club Vacations Brinks HomeTM Marriott Vacations Worldwide Optimum United Airlines Hilton Grand Vacations Holiday Inn Club Vacations Brinks HomeTM Marriott Vacations Worldwide Optimum Featured Documents
ADDEDCOMPLIANCE ISO/IEC 27001 SoA
COMPLIANCE PCI DSS COMPLIANCE SOC 2 Data Access Level Internal Impact Level Substantial Recovery Time Objective 4 hours View more Data Access Level Internal Impact Level Substantial Recovery Time Objective 4 hours View more Data Security Integrations Multi-Factor Authentication View more Data Security Integrations Multi-Factor Authentication Accessibility Conformance Report HIPAA Report Network Diagram View more Accessibility Conformance Report HIPAA Report Network Diagram SIG Lite VSA Core Data Backups Encryption-at-rest Encryption-in-transit View more Data Backups Encryption-at-rest Encryption-in-transit Responsible Disclosure Secure Development Training Software Development Lifecycle View more Responsible Disclosure Secure Development Training Software Development Lifecycle Subprocessors Cyber Insurance Data Processing Agreement View more Cyber Insurance Data Processing Agreement Data Privacy Officer Employee Privacy Training Data Privacy Officer Employee Privacy Training Logical Access Control Status Monitoring Amazon Web Services BC/DR View more Status Monitoring Amazon Web Services BC/DR Disk Encryption Endpoint Detection & Response Mobile Device Management View more Disk Encryption Endpoint Detection & Response Mobile Device Management IDS/IPS Network Vulnerability Scanning Asset Management Practices Employee Training HR Security View more Asset Management Practices Employee Training HR Security Information Security Program Policy Qualys SSL Labs cresta.com Subprocessor Notification Subprocessors August 4, 2026 Effective August 04, 2026, Cresta has discontinued using GUIDEcx. July 20, 2026 Effective July 20, 2026, Cresta has discontinued using Segment. April 28, 2026 Cresta has added Anthropic as a sub-processor in the role of Natural Language API Provider. February 20, 2026 Cresta added Cloudflare as a sub-processor for web application firewall software. November 13, 2025 Cresta added ElevenLabs as a sub-processor for TTS (text-to-speech). August 30, 2025 Effective August 30, 2025, Cresta has discontinued using Linear. August 8, 2025 Effective August 8, 2025, Cresta has discontinued using Mixpanel. March 14, 2025 Effective March 14, 2025, Cresta has discontinued using Atlassian. March 10, 2025 Effective January 30, 2025, Cresta has discontinued using FullStory. December 11, 2024 Cresta added GUIDEcx as a sub-processor for onboarding software. October 29, 2024 Cresta added Cartesia AI as a sub-processor for TTS (text-to-speech). September 17, 2024 Effective September 17, 2024, Cresta has discontinued using MosaicML. March 7, 2024 Cresta added MosaicML as a sub-processor for LLM model inference. Cresta added Atlassian as a sub-processor for project management / ticketing. February 21, 2024 Cresta added Fireworks.ai as a sub-processor for LLM model inference. February 14, 2024 Effective February 14, 2024, Cresta has discontinued using Optimizely. Updates General June 19, 2026 Klue has published additional detail on the breach of their systems in a blog post here. Cresta is in communication with all customers regarding the Klue incident. We will share additional updates if new information becomes available. Otherwise ongoing communication on this incident will be conducted with individual customers on a one-to-one basis. June 18, 2026 Beginning around June 11, attackers compromised Klue systems and stole OAuth credentials associated with customer integrations. The stolen credentials were used to query connected Salesforce environments and exfiltrate CRM data from multiple organizations in an extortion campaign linked to Icarus. Salesforce disabled the Klue integration to prevent additional unauthorized access. Cresta's Salesforce instance is one of those that was impacted. Business contact information, contractual information, and email correspondence may have been exposed. We have not found any indication that Cresta's products or infrastructure are impacted. Cresta is committed to transparency. Today we unfortunately have to announce that Cresta was impacted by the recent breach of market intelligence platform Klue . We are working continuously to analyze the impact of this breach and to protect customer data. Here is what we know: Beginning around June 11, attackers compromised Klue systems and stole OAuth credentials associated with customer integrations. The stolen credentials were used to query connected Salesforce environments and exfiltrate CRM data from multiple organizations in an extortion campaign linked to Icarus. Salesforce disabled the Klue integration to prevent additional unauthorized access. Cresta's Salesforce instance is one of those that was impacted. Business contact information, contractual information, and email correspondence may have been exposed. We have not found any indication that Cresta's products or infrastructure are impacted. We are in direct contact with Klue and Salesforce and we have engaged our internal and external incident response teams. We are committed to protecting customer information and will provide regular updates as this incident develops. November 27, 2025 Cresta is aware of the security incident at Mixpanel , but is not affected by it. We discontinued using Mixpanel in August 2025. July 19, 2024 Cresta is aware of the ongoing CrowdStrike incident, but is not affected by it. We are closely monitoring the situation and are staying in contact with CrowdStrike. Third-party audits Compliance February 25, 2026 Cresta updated its Trust Center with new audit reports and certificates for SOC2 Type II, ISO27001/27701/42001, HIPAA and PCI DSS. January 23, 2026 Cresta has updated its Trust Center with the 2025 red teaming report. March 3, 2025 Cresta updated its Trust Center with new audit reports and certificates for SOC2 Type II and ISO27001/27701/42001. April 16, 2024 Cresta updated its Trust Center with new audit reports for SOC2 Type II, ISO27001/27701 and HIPAA. Vulnerability Notification Vulnerabilities March 30, 2024 Cresta is aware of CVE-2024-3094, related to malicious code being embedded in XZ Utils versions 5.6.0 and 5.6.1. Cresta does not use the affected versions. October 12, 2023 Cresta is aware of CVE-2023-44487 also known as "HTTP/2 Rapid Reset attack", related to HTTP/2 capable web servers where rapid stream generation and cancellation can result in additional load which could lead to a Denial of Service. Mitigations were implemented to address the vulnerability. If you think you may have discovered a vulnerability, please send us a note. Report issue