dbt Labs compliance, certifications and attestations

Data platforms · 8 certifications held · 1 from public registries · read Sep 24, 2026

Certification	Status	Source	Evidence
SOC reports
SOC 2 Type II Vendor page	Type II	Vendor page	Sep 24, 2026
ISO standards
ISO/IEC 27001 Held Vendor page	Held	Vendor page	Sep 24, 2026
ISO/IEC 27017 Held Vendor page	Held	Vendor page	Sep 24, 2026
ISO/IEC 27018 Held Vendor page	Held	Vendor page	Sep 24, 2026
ISO/IEC 27701 Held Vendor page	Held	Vendor page	Sep 24, 2026
AI governance
ISO/IEC 42001 Held Vendor page	Held	Vendor page	Sep 24, 2026
Health
HIPAA (BAA) Held Vendor page	Held	Vendor page	Sep 24, 2026
Privacy and cloud
Data Privacy Framework Held EU-US, UK extension, Swiss-US; non-HR data. Covered entity of Fivetran Data Privacy Framework List	Held	Data Privacy Framework List	Sep 23, 2026

From public trust centers and registries on the date shown. Confirm scope with the vendor. Logos via logo.dev; trademarks belong to their owners.

History

Date	Change	Source
Aug 26, 2018	Added Data Privacy Framework Covered entity of Fivetran	Data Privacy Framework List

About dbt Labs

dbt, the data transformation framework, and dbt Cloud.

No public evidence found for

SOC reports: SOC 1, SOC 3
ISO standards: ISO 9001, ISO 22301, ISO 20000, ISO 27799
AI governance: STAR AI
US government: FedRAMP, DoD IL, GovRAMP, TX-RAMP, CMMC, 800-171, 800-53, FIPS 140, ITAR, CJIS, IRS 1075, 508/VPAT
Finance: PCI DSS, PCI 3DS, SWIFT, 17a-4, GLBA, SOX, FFIEC, MAS TRM, APRA, OSFI, FISC, DORA
Health: HITRUST, HDS, NHS DSPT, PHIPA
Life sciences (GxP): GxP, Part 11, Annex 11, CSV
Privacy and cloud: CBPR, EU CoC, CSA STAR
Regional programs: Cyber Ess., G-Cloud, C5, ENS, SecNum, IRAP, ISMAP, MTCS, K-ISMS, TISAX
Education: FERPA, HECVAT, COPPA