Snapshot 189743
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Subprocessor / Key Service Provider Update Notification Trust Center Start your security review View & download sensitive information Overview Ramp exists to save you time and to save you money. We understand the importance of the trust you place in us by sharing your data. Upholding and nurturing that trust is ingrained in our company culture, guiding our internal operations and product development. Ramp has garnered trust from customers operating in tightly regulated industries, including defense, financial services, and medical manufacturing. Our team is committed to safeguarding your data against potential threats, and we’re excited to provide insight into our approach on this page. Accessing the documentation on our trust center: Please request access via the banner above. You will be sent an invite via email, and will be prompted to sign an NDA once in the portal. Once the NDA is signed, you will have access to view and download the resources in our Trust Center. Compliance CCPA ISO/IEC 27001 PCI DSS SOC 1 SOC 2 FedRAMP Moderate Cyber Essentials Plus GovRAMP ISO/IEC 42001:2023 TX-RAMP Documents Featured Documents REPORTSPCI DSS REPORTSSOC 1 Type 2 Report REPORTSSOC 2 Type 2 Report COMPLIANCEISO/IEC 27001 Product Security Audit Logging Bank Connections Integrations View more Reports SOC 2 Type 2 Report SOC 1 Type 2 Report PCI DSS View more Self-Assessments SIG Lite CAIQ Data Security Access Monitoring Data Backups Encryption-at-rest View more App Security Responsible Disclosure Code Analysis Secure Development Training View more Legal Subprocessors Key Service Providers List of Affiliates View more Access Control Data Access Logging Password Security Infrastructure Amazon Web Services Anti-DDoS Business Continuity & Disaster Recovery View more Endpoint Security Disk Encryption Endpoint Detection & Response Mobile Device Management View more Network Security Firewall Security Information and Event Management Zero Trust View more Corporate Security Email Protection Third Party Risk Management (TPRM) Program Employee Training View more Policies Acceptable Use Policy Information Security Policy AI Policy Security Grades SecurityScorecard ramp.com CryptCheck app.ramp.com HSTS Preload List app.ramp.com View more Knowledge Base (FAQ) What applications/ systems does Ramp have integrations with? Does Ramp share information with third-parties? Does Ramp perform penetration testing on a periodic basis? Does Ramp have a bridge/gap letter for the SOC 1 and SOC 2 report? Does Ramp have Cyber Insurance? View more Trust Center Updates PHP Vulnerabilities: No Direct Impact to Ramp’s Services Vulnerabilities On October 21, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published an advisory about the “php2shell” vulnerabilities, including CVE-2026-109618 and CVE-2026-109619. Based on our assessment to date, we are not directly impacted by the recently disclosed PHP vulnerabilities. We continue to monitor the issue and are working with our critical third-party providers to assess any potential impacts relevant to Ramp. We will update this notice if our assessment changes or new information becomes available. Subprocessor / Key Service Provider Update Notification Subprocessors We’ve updated our subprocessor list to include Sphere and Turbopuffer. Name: Sphere Location: United States Website: https://www.getsphere.com/ Purpose: Tax Compliance DPA Signed: Yes Name: Turbopuffer Location: United States Website: https://turbopuffer.com/ Purpose: Search platform DPA Signed: Yes These subprocessors have been evaluated in accordance with Ramp’s third-party risk management process. To provide more clarity around our use of subprocessors (where Ramp may act as a data processor) and other key service providers (where Ramp may act as a data controller), we’ve separated our lists of subprocessors and key service providers. We’ve updated our subprocessor list to include Amplitude Inc., Astronomer, Cloudflare, Duffel Technology Ltd., and Sierra Technologies Inc. Name: Amplitude Inc. Location: United States Website: https://amplitude.com/ Purpose: Product analytics DPA Signed: Yes Name: Astronomer, Inc Location: United States Website: https://www.astronomer.io/ Purpose: AI and machine learning services DPA Signed: Yes Name: Cloudflare Location: United States Website: https://www.cloudflare.com/ Purpose: Caching and content delivery network DPA Signed: Yes Name: Duffel Technology Ltd. Location: EU Website: https://duffel.com/ Purpose: Travel booking and management DPA Signed: Yes Name: Sierra Technologies Inc. Location: United States Website: https://sierra.ai/ Purpose: AI support agent DPA Signed: Yes These subprocessors have been evaluated in accordance with Ramp’s third-party risk management process. AI Provider Subprocessor Update Notification Subprocessors We’ve updated our subprocessor list to include xAI and Fireworks AI. Name: xAI Location: United States Website: https://x.ai/ Purpose: AI Provider DPA Signed: Yes Name: Fireworks AI Location: United States Website: https://fireworks.ai/ Purpose: AI Provider DPA Signed: Yes These subprocessors have been evaluated in accordance with Ramp’s third-party risk management process. We’ve updated our subprocessor list to include Modal. Name: Modal Location: United States Website: https://modal.com/ Purpose: AI Provider DPA Signed: Yes These subprocessors have been evaluated in accordance with Ramp’s third-party risk management process. We’ve updated our subprocessor list to include Together AI and Cerebras. Name: Together AI Location: United States, European Union, Canada Website: https://www.together.ai/ Purpose: AI Provider DPA Signed: Yes NOTE: This subprocessor is no longer in use as of March 30, 2026. Name: Cerebras Location: United States Website: https://www.cerebras.ai/ Purpose: AI Provider DPA Signed: Yes These subprocessors have been evaluated in accordance with Ramp’s third-party risk management process. Ramp achieves ISO/IEC 42001 certification Compliance Ramp has earned its first ISO/IEC 42001:2023 certification for its AI management system. The system governs AI embedded across all products and services of the Ramp.com platform. The certificate and Statement of Applicability are now available in Ramp’s Trust Center. Ramp's 2025 Security Documentation Available for Download Compliance The following updated 2025 security documentation is available for download from our Trust Center: SOC 2 Type 2 report for the period ending October 2025 SOC 1 Type 2 report for the period ending October 2025 ISO 27001:2022 Certification, achieved in October 2025 PCI DSS Attestation of Compliance (AoC) as of December 2025 Ramp’s 2025 external penetration test reports (Web, API, Mobile) If you think you may have discovered a vulnerability, please send us a note. Report issue