SOC 2 Compliance
Customer.io is SOC 2 Type II compliant. To learn more about our compliance or request a copy of our independent auditor report, please contact our sales team.
Customer.io fulfills a Business Associate’s role under HIPAA and is fully compliant for all customers regardless of the plan tier. We also execute Business Associate Addendums (BAA) for our premium customers that are considered Covered Entities under HIPAA. To get more information, please contact our sales team.
Frequently Asked Questions
Do you host or store customer data in EU data centers?
Customer.io’s Ad Audience Sync allows you to use our segmentation to create ad audiences on Facebook and Google. Our segments are populated in real-time and synced on an hourly basis so that your audiences remain as accurate and true as possible – without the need for any manual work. Additionally, you can retarget customers based on Mobile Advertising ID (IDFA or AAID) or an email address.
How do I report a security vulnerability?
Our Site Reliability team rapidly investigates all reported security issues. If you believe you’ve discovered a bug in Customer.io’s security, please get in touch by email at email@example.com. We will respond as quickly as possible to your report. We request that you not publicly disclose the issue until it has been addressed by Customer.io’s Site Reliability team.
Learn more by reading our report a vulnerability page.
How do you communicate service outages?
We communicate service impacting outages to our customers via our status page at https://status.customerio.com.
What is your ISO 27001 compliance status?
Customer.io does not currently maintain active ISO 27001 compliance. Our compliance program and control environment is influenced by ISO 27001 principles and we have an ISMS policy and committee within the company. We will explore formal ISO 27001 compliance at a future date.
What is your PCI compliance status?
When you purchase a paid Customer.io subscription, your credit card data is not transmitted through nor stored on our systems. Instead, we depend on Stripe, a company dedicated to this task. Stripe is certified to PCI Service Provider Level 1, the most stringent level of certification available. Stripe’s security information is available online.
What is your policy for encrypted data?
Data transmitted to Customer.io, via our API, is encrypted in transit through the use of the HTTPS protocol.
Our system data is encrypted at rest using Cloud KMS services.