Rippling
Hr · rippling.com · last read 2026-11-09
At a glance
- Is Rippling GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Rippling itself publishes, each answer linked to its source and the date we read it.
- Does Rippling have a SOC 2 report?
- Rippling says a SOC 2 report is available on request (no type given). In Rippling's words: “meet stringent global certification and audit requirements including ISO 27001, ISO 27018, ISO 42001, SOC 1 and SOC 2.” We read this on 2026-11-09. Source and date
- Is Rippling ISO 27001 certified?
- Rippling states ISO/IEC 27001 certification, and says the certificate or audit report is available on request. In Rippling's words: “meet stringent global certification and audit requirements including ISO 27001, ISO 27018, ISO 42001, SOC 1 and SOC 2.” We read this on 2026-11-09. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
No identity observation recorded yet.
Data location
No data-location observation recorded yet.
The same question for every vendor: where SaaS vendors store EU data.
Subprocessor chain
Processing terms
No data processing agreement read yet.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Does Rippling have a SOC 2 report?
Rippling says a SOC 2 report is available on request (no type given). We read this on 2026-11-09.
- Available on request “meet stringent global certification and audit requirements including ISO 27001, ISO 27018, ISO 42001, SOC 1 and SOC 2.”
Source: trust.rippling.com, 2026-11-09
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Rippling ISO 27001 certified?
Rippling states ISO/IEC 27001 certification, and says the certificate or audit report is available on request. We read this on 2026-11-09.
- Available on request “meet stringent global certification and audit requirements including ISO 27001, ISO 27018, ISO 42001, SOC 1 and SOC 2.”
Source: trust.rippling.com, 2026-11-09
On the same list Rippling also names ISO/IEC 27018. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CSA STAR Level 2 · CSA | Available on request | — | trust.rippling.com | 2026-11-09 |
| ISO 27001 · ISO27001 | Available on request | — | trust.rippling.com | 2026-11-09 |
| ISO 27018 · ISO27018 | Available on request | — | trust.rippling.com | 2026-11-09 |
| ISO 42001 · ISO42001 | Available on request | — | trust.rippling.com | 2026-11-09 |
| SOC 1 · SOC1 | Available on request | — | trust.rippling.com | 2026-11-09 |
| SOC 2 · SOC2 | Available on request | — | trust.rippling.com | 2026-11-09 |
| SOC 3 · SOC3 | Available on request | — | trust.rippling.com | 2026-11-09 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Rippling
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Rippling
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Rippling
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Rippling
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under Rippling
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Rippling
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: no security.txt at the well-known path (read 2026-11-09)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | JavaScript only | full | 200 | 2026-11-09 |
History
Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.