Dropbox compliance, certifications and attestations

An auditor's report on controls relevant to customers' financial reporting.

HeldVendor page

An auditor's report on security, availability, confidentiality, processing integrity and privacy controls.

HeldVendor page

A public summary of a SOC 2 examination, readable without an NDA.

HeldVendor page

A certified information security management system.

HeldVendor page

Cloud-specific security controls on top of ISO 27001.

HeldVendor page

Protection of personal data in public clouds acting as processors.

HeldVendor page

A certified privacy information management system extending ISO 27001.

HeldVendor page

A certified business continuity management system.

HeldVendor page

Controls for protecting controlled unclassified information in non-federal systems.

HeldVendor page

Validated compliance with the card industry data security standard.

HeldVendor page

Controls documented to support customers' Sarbanes-Oxley reporting.

HeldVendor page

The vendor supports HIPAA-regulated health data and signs a Business Associate Agreement.

HeldVendor page

Support for electronic records and signatures under 21 CFR Part 11.

HeldVendor page

Self-certification under the EU-US Data Privacy Framework, with UK and Swiss extensions where noted.

HeldData Privacy Framework ListEU-US, UK extension, Swiss-US; non-HR data and HR data. Dropbox, Inc.

Adherence to the GDPR code of conduct for cloud processors.

HeldCSA STAR Registry and vendor pagePartner entry in the STAR Registry

A listing in the Cloud Security Alliance STAR Registry.

Level 2CSA STAR RegistryCAIQ, certification, attestation

Registration on Japan's government cloud security list.

HeldVendor page

Support for student education records under FERPA.

HeldVendor page

Support for the Children's Online Privacy Protection Act, where stated.

HeldVendor page