Alibaba Cloud compliance, certifications and attestations

An auditor's report on controls relevant to customers' financial reporting.

Type IIVendor page

An auditor's report on security, availability, confidentiality, processing integrity and privacy controls.

Type IIVendor page

A public summary of a SOC 2 examination, readable without an NDA.

HeldVendor page

A certified information security management system.

HeldVendor page

Cloud-specific security controls on top of ISO 27001.

HeldVendor page

Protection of personal data in public clouds acting as processors.

HeldVendor page

A certified privacy information management system extending ISO 27001.

HeldVendor page

A certified quality management system.

HeldVendor page

A certified business continuity management system.

HeldVendor page

A certified IT service management system.

HeldVendor page

Information security controls for personal health information.

HeldVendor page

The federal security and privacy control catalog (the basis of FedRAMP).

HeldVendor page

Validated compliance with the card industry data security standard.

HeldVendor page

Compliance with the PCI standard for 3-D Secure card authentication.

HeldVendor page

Alignment with Japan's FISC security guidelines for financial institutions.

HeldVendor page

The vendor supports HIPAA-regulated health data and signs a Business Associate Agreement.

HeldVendor page

Certification to host personal health data in France (Hébergeur de Données de Santé).

HeldUnverifiedVendor page

Support for regulated life-sciences workloads under GMP, GCP and GLP.

HeldVendor page

Self-certification under the EU-US Data Privacy Framework, with UK and Swiss extensions where noted.

HeldData Privacy Framework ListEU-US, UK extension, Swiss-US; non-HR data. Covered entity of Alibaba Cloud US LLC

Certification under the Cross-Border Privacy Rules or Privacy Recognition for Processors.

HeldVendor page

Adherence to the GDPR code of conduct for cloud processors.

HeldVendor page

A listing in the Cloud Security Alliance STAR Registry.

Level 2CSA STAR RegistryCAIQ, certification

An attestation against Germany's Cloud Computing Compliance Criteria Catalogue.

HeldVendor page

Certification under Singapore's Multi-Tier Cloud Security standard.

HeldVendor page

Korea's information security management system certification.

HeldVendor page

An assessment shared through the German automotive industry's exchange.

HeldVendor page

Support for student education records under FERPA.

HeldVendor page

A published Higher Education Community Vendor Assessment Toolkit.

HeldVendor page

Support for the Children's Online Privacy Protection Act, where stated.

HeldVendor page