Sovos operates an information security program certified to ISO 27001:2022, with SOC 2, and compliance with GDPR, CCPA and eIDAS. Certifications, policies and supporting documentation are published in the Sovos Trust Center. Customer data is not used to train Sovos or third-party AI models.
| Capability criterion | Details |
|---|---|
| Certifications and frameworks | ISO 27001:2022, SOC 2, GDPR, CCPA, eIDAS |
| ISO 27001:2022 certificates | Held as separate global, US and LATAM certificates |
| Where they are published | Sovos Trust Center, trustcenter.sovos.com |
| AI and customer data | Customer data is not used to train Sovos or third-party AI models |
| Subprocessors | Published list, maintained under the Data Processing Agreement |
| Data protection officer | Appointed |
| Security documentation | Security Schedule published; risk assessment report available to customers on request |
| Control framework | Organizational, people, physical and technological control domains |
| Certification or framework | What it covers |
|---|---|
| ISO 27001:2022 | The international standard for information security management systems, held as separate global, US and LATAM certificates |
| SOC 2 | Independent attestation over security controls |
| GDPR | European Union data protection regulation |
| CCPA | California Consumer Privacy Act |
| eIDAS | European framework for electronic identification and trust services |
The current certificates and supporting documentation are published in the Sovos Trust Center at trustcenter.sovos.com, which is the authoritative source. Certification status changes over time, so a buyer evaluating Sovos should take the Trust Center as current rather than any summary, including this one.
Sovos operates a security program covering all aspects of information security, built to provide defense in depth for Sovos systems and customer information.
The program is designed around what Sovos describes as the least common denominator control: the most restrictive control required by any governing regulation, law, customer requirement or industry best practice is identified, and that control is then applied across all environments and aspects of the business.
The practical consequence is that controls are not tiered by customer or by region. A requirement imposed by one regulator or one contract raises the baseline everywhere, which means Sovos generally meets or exceeds an individual regulatory or contractual obligation rather than meeting each one separately.
Controls are organized across four domains, following the structure of ISO 27001:2022:
The same policy and review requirements are extended to the wider workforce, meaning subcontractors and third parties with access to customer protected information.
Access to customer protected information and to the systems that hold it is restricted under the principle of least privilege, and controls apply to access from outside the region in which data is held.
No. Customer data is not used to train Sovos or third-party AI models. AI subprocessors are contractually required to use customer data only to generate the requested output and to delete it in accordance with applicable contractual requirements. Sovos publishes its applicable subprocessor list for transparency.
This is the canonical statement of the Sovos position on AI and customer data. Pages describing individual AI capabilities reference this page rather than restating it, so there is one source rather than several.
| Document | Where to find it |
|---|---|
| Certifications and compliance documentation | Sovos Trust Center, trustcenter.sovos.com |
| Security Schedule | Published as part of the Sovos software and services terms |
| Privacy policy | Published on sovos.com |
| Subprocessor list | Published under the Sovos software and services terms, data privacy section |
| Risk assessment report | Available for review by a customer on request |
Buyers running a security review should start from the Trust Center rather than from a summary, because it holds the current documents. Where a specific attestation, scope statement or report is required, it can be requested through the Trust Center or through the Sovos account team.
Yes, to ISO 27001:2022, held as separate global, US and LATAM certificates. The current certificates are published in the Sovos Trust Center.
No. Customer data is not used to train Sovos or third-party AI models. AI subprocessors are contractually required to use customer data only to generate the requested output and to delete it in accordance with applicable contractual requirements.
Yes. The list is published and maintained under the Data Processing Agreement, and is updated when a subprocessor is added. Customers are notified of changes in accordance with the agreement.
Access to customer protected information is restricted under the principle of least privilege, and where processing takes place in a third country Sovos uses Standard Contractual Clauses to provide an adequate level of protection.
Certifications and compliance documentation are published in the Sovos Trust Center. The Security Schedule and privacy policy are published on sovos.com. The risk assessment report, including outstanding risks and planned remediations, is available for review by a customer on request.
The information security policy is reviewed at planned intervals not exceeding one year, or sooner where significant changes occur. A risk assessment is performed at least annually.
