CrowdStrike
Security · crowdstrike.com · last read 2026-10-12
Identity
| Legal entity | CROWDSTRIKE, INC. |
|---|---|
| HQ | US |
| Parent company | CROWDSTRIKE HOLDINGS, INC. |
| Ultimate ownership | US |
| EU contracting entity | — |
| LEI | 549300R070HUWKN8SG56 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | crowdstrike.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
No data-location observation recorded yet.
Subprocessor chain
No subprocessor list transcribed. Either the vendor does not publish one where we could reach it, or it is gated — see the documents table below for which.
Processing terms
The vendor's data processing agreement could not be read: the site refused our crawler.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| APEC Cross-Border Privacy Rules (CBPR) · APECCBPR | Claimed | certified by TrustArc | crowdstrike.com | 2026-10-08 |
| Global Cross-Border Privacy Rules (CBPR) · APECCBPR | Claimed | — | crowdstrike.com | 2026-10-08 |
| APEC PRP · APECPRP | Claimed | — | crowdstrike.com | 2026-10-08 |
| Global Privacy Recognition for Processors (Global PRP) · APECPRP | Claimed | — | crowdstrike.com | 2026-10-08 |
| C5 | Claimed | CrowdStrike's Falcon platform | crowdstrike.com | 2026-10-08 |
| Germany Cloud Computing Compliance Controls Catalog (C5) · C5 | Claimed | CrowdStrike's Falcon platform | crowdstrike.com | 2026-10-08 |
| CSA STAR · CSA | Claimed | The Falcon platform; STAR Level 1 and STAR Level 2 (CCM version 4.0) | crowdstrike.com | 2026-10-08 |
| UK Cyber Essentials · CyberEssentials | Claimed | — | crowdstrike.com | 2026-10-08 |
| EU-U.S. Data Privacy Framework · DPF | Claimed | — | crowdstrike.com | 2026-10-08 |
| Swiss-U.S. Data Privacy Framework · DPF | Claimed | — | crowdstrike.com | 2026-10-08 |
| Spain ENS High (EDR) · ENS | Claimed | Falcon platform certified in the CCN STIC Products and Services Catalog (CPSTIC) at the ‘high’ level; antivirus/endpoint protection platform (EPP) and EDR categories | crowdstrike.com | 2026-10-08 |
| FedRAMP® High · FedRAMP | Claimed | The Falcon platform | crowdstrike.com | 2026-10-08 |
| General Data Protection Regulation (GDPR) · GDPR | Claimed | EU’s and UK’s; personal information processed through its offerings | crowdstrike.com | 2026-10-08 |
| IRAP | Claimed | — | crowdstrike.com | 2026-10-08 |
| ISO/IEC 27001:2022 · ISO27001 | Claimed | — | crowdstrike.com | 2026-10-08 |
| ISO/IEC 42001:2023 · ISO42001 | Claimed | — | crowdstrike.com | 2026-10-08 |
| G-Cloud | Claimed | UK Government’s G-Cloud framework, UK public sector organizations | crowdstrike.com | 2026-10-08 |
| National Security Cyber Assistance Program (NSCAP) Cyber Incident Response Assistance (CIRA) | Claimed | — | crowdstrike.com | 2026-10-08 |
| NCSC 14 cloud principles | Claimed | CrowdStrike Falcon® Cloud Security solution | crowdstrike.com | 2026-10-08 |
| NHS Data Security and Protection Toolkit (DSPT) | Claimed | within the UK NHS sector | crowdstrike.com | 2026-10-08 |
| UK Extension | Claimed | UK Extension to the EU-U.S. Data Privacy Framework | crowdstrike.com | 2026-10-08 |
| UK NCSC Cyber Assessment Framework (CAF) | Claimed | UK public sector organizations | crowdstrike.com | 2026-10-08 |
| PCI DSS v4 · PCIDSS | Available on request | Falcon platform; CrowdStrike provides a PCI DSS AOC for its customers | crowdstrike.com | 2026-10-08 |
| SOC 2 · SOC2 | Available on request | Type 2 report provided to Falcon platform customers; controls relevant to security, availability, processing integrity, confidentiality, or privacy | crowdstrike.com | 2026-10-08 |
| TISAX | Available on request | Scope ID: SY936H; Assessment ID: AM1KZ4-1 | crowdstrike.com | 2026-10-08 |
| VPAT | Available on request | Falcon platform; in accordance with Section 508 of the Rehabilitation Act of 1973 | crowdstrike.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| ACN qualified cloud (Italy) | CrowdStrike Endpoint Security · CROWDSTRIKE ITALY S.R.L. | qualified | QC1 (SaaS) | 2028-05-27 | 2026-10-12 |
| ACN qualified cloud (Italy) | CrowdStrike Falcon Cloud Security · CROWDSTRIKE ITALY S.R.L. | qualified | QC1 (SaaS) | 2028-05-27 | 2026-10-12 |
| ACN qualified cloud (Italy) | CrowdStrike Falcon Exposure Management · CROWDSTRIKE ITALY S.R.L. | qualified | QC1 (SaaS) | 2028-05-27 | 2026-10-12 |
| ACN qualified cloud (Italy) | CrowdStrike Falcon Identity Protection · CROWDSTRIKE ITALY S.R.L. | qualified | QC1 (SaaS) | 2028-05-27 | 2026-10-12 |
| ACN qualified cloud (Italy) | CrowdStrike Falcon Next-Gen SIEM · CROWDSTRIKE ITALY S.R.L. | qualified | QC1 (SaaS) | 2028-05-27 | 2026-10-12 |
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · CrowdStrike, Inc. | Active - Re-certification under Review | HR data, non-HR data | 2027-10-09 | 2026-10-12 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · CrowdStrike, Inc. | Active - Re-certification under Review | HR data, non-HR data | 2027-10-09 | 2026-10-12 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · CrowdStrike, Inc. | Active - Re-certification under Review | HR data, non-HR data | 2027-10-09 | 2026-10-12 |
| FedRAMP Marketplace (US) | CrowdStrike Falcon Platform for Government · CrowdStrike, Inc. | FedRAMP Authorized | High | — | 2026-10-12 |
| Global LEI Index (GLEIF) | CROWDSTRIKE, INC. · CROWDSTRIKE, INC. | ISSUED | US-DE | 2027-07-12 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, 5 entries under CROWDSTRIKE, INC.; CrowdStrike
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under CROWDSTRIKE, INC.; CrowdStrike
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under CROWDSTRIKE, INC.; CrowdStrike
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under CROWDSTRIKE, INC.; CrowdStrike
- FedRAMP Marketplace (US): checked 2026-10-12, 1 entry under CROWDSTRIKE, INC.; CrowdStrike
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under CROWDSTRIKE, INC.; CrowdStrike
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2028-04-01; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Refused | partial | — | 2026-10-09 |
| residency | Refused | partial | — | 2026-10-09 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-10-12 | Status Active → Active - Re-certification under Review Valid until 2026-10-10 → 2027-10-09 | the vendor changed it | dataprivacyframework.gov |
| 2026-10-12 | Status Active → Active - Re-certification under Review Valid until 2026-10-10 → 2027-10-09 | the vendor changed it | dataprivacyframework.gov |
| 2026-10-12 | Status Active → Active - Re-certification under Review Valid until 2026-10-10 → 2027-10-09 | the vendor changed it | dataprivacyframework.gov |