Snapshot 212283
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Medallia Trust Center **Medallia Proprietary and Confidential** Welcome to Medallia's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. Medallia offers a wide variety of products in order to best serve our customers. This page will provide information that is useful to every customer such as our corporate security including policies and standards. **To find information that is specific to the product or products you use today or are interested in learning more about, please use the dropdown menu on the top of the screen!** Powered by Wolfia. Review compliance certifications, security policies, subprocessors, and request access to detailed documentation. Skip to main content Medallia Trust Center Medallia Proprietary and Confidential Welcome to Medallia's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. Medallia offers a wide variety of products in order to best serve our customers. This page will provide information that is useful to every customer such as our corporate security including policies and standards. To find information that is specific to the product or products you use today or are interested in learning more about, please use the dropdown menu on the top of the screen! csa@medallia.com ⌘K OverviewDocumentationControlsSubprocessorsUpdates Loading content... Documentation Featured Security Best Practices (MEC) Certifications Contact supportReport a vulnerability Trust center by Wolfia: AI trust center & security questionnaire automation Want a trust center like this one? Get one for your company with Wolfia Subprocessors Aerialink Inc. · USA Mindful Callback: Provides mobile connection services through SMS (Short Message Service) functionality. USA Affectiva, Inc. · USA Video: Software-based recognition of facial emotions. USA Amazon Comprehend · US, Canada, EU, Australia Mindful Feedback: Sentiment analysis. US, Canada, EU, Australia Amazon Transcribe (Optional) · USA, UK, Germany, Singapore Speech / Voci: Transcription for additional languages. USA, UK, Germany, Singapore Amazon Web Services, Inc. · USA, EU or UK (Customer's choice) Ideas: Hosts platform data. Archives security logs for security incident monitoring and detection. USA, EU or UK (Customer's choice) Controls Data Privacy Privacy controls and data protection measures Data Privacy Officer Employee Privacy Training Access Control Data Access Password Security BYOD Policy Infrastructure Infrastructure security and availability controls Status Monitoring Endpoint Security Disk Encryption Threat Detection Anti-DDoS BC/DR Data Center Network Time Protocol Capacity Planning & Management Separate Production Environment Corporate Security Organization-wide security policies and practices Asset Management Practices Employee Training Incident Response Contact supportReport a vulnerability Trust center by Wolfia: AI trust center & security questionnaire automation Want a trust center like this one? Get one for your company with Wolfia Controls Data Privacy Privacy controls and data protection measures Data Privacy Officer Medallia has a designated Data Privacy Officer responsible for overseeing data protection strategy and compliance. Employee Privacy Training All employees complete privacy training to ensure awareness of data protection obligations. Access Control Medallia and customer assets are monitored by Site Reliability Engineering and the Trust and Assurance Group (TAG); all relevant user activities, system exceptions and security events are logged and stored locally and in a centralized log management system to prevent tampering. Privileged access is also monitored using a centralized log management solution. Access to logging facilities and log information is restricted to authorized personnel only. System administrator actions are logged and reviewed by TAG as part of risk assessments or as otherwise necessary. Privileged Access Logs must contain the following information: Information about the event (e.g., files accessed, functions performed) Success/failure of the event Time the event occurred Information about the event (e.g., files handled) or failure Account or administrator involved and processes that were involved Data Access Customer data access is restricted and monitored, with all access logged and auditable. Password Security Strong password policies and multi-factor authentication protect access to systems and data. BYOD Policy Bring Your Own Device policies ensure personal devices meet security requirements before accessing corporate resources. Infrastructure Infrastructure security and availability controls Status Monitoring The experiences you provide your customers and employees never stop, and neither do we. Our Production Services & Engineering teams utilize internal and external services to perform continuous scanning and monitoring of our network and application to ensure world-class availability of our SaaS platform. Endpoint Security Endpoint protection solutions deployed across all corporate devices. Disk Encryption Full disk encryption enabled on all corporate devices and servers. Threat Detection Advanced threat detection systems monitor for security events and anomalies. Anti-DDoS Medallia uses robust load balancing, malware detection and prevention, and on-demand DoS and DDoS detection and prevention systems. BC/DR Medallia has established a Business Continuity Plan to support continued delivery of its products and services after a disaster event that impacts the resources required (i.e., people, technology, physical assets and/or relationships) to support the performance of its critical business processes. Data Center As a cloud-based SaaS provider, Medallia platforms are accessed over the Internet. Medallia's Experience Cloud and Digital platforms are hosted out of colocation facilities, located in North America, Asia, Australia, and Europe. Network Time Protocol Medallia uses an internal NTP to ensure all systems have a common time reference. Capacity Planning & Management DXA is built on a robust cloud-based infrastructure that can efficiently scale to handle huge data sets, including seasonal traffic and unexpected visitor surges. Separate Production Environment Medallia uses separate environments for development and production, with segmentation ensuring isolation between environments. Corporate Security Organization-wide security policies and practices Asset Management Practices Comprehensive asset management ensures all hardware and software assets are tracked and secured. Employee Training Medallia has an extensive Security Champions program. Development teams have one or more representatives that take part in an intensive 6-month certified security training program. This ensures that secure development scales as we scale and is part of the DNA and culture of how we build our applications. Incident Response Established incident response procedures for timely detection, containment, and remediation of security incidents. Product Security Application and product-level security controls Data Security Data protection is a top priority for Medallia. We build our platform using the following core principles: We treat all customer data as private and sensitive. We do not share customer data with third parties without approval of the customer. Our customers are in control of their data with standard, industry compliant policies for deletion and retention. We have architected our platform from the ground up with security and privacy by default. Customer data is labeled as Confidential by Medallia. Integrations Medallia provides application adapters, connectors, and integrations including our Auto Importer (ETL tools for automated data transfer), pre-built connectors at medallia.com/xchange, developer APIs at developer.medallia.com, and batch file transfers via SFTP. Multi-Factor Authentication Medallia uses multi-factor authentication for system-level access to our application and backend infrastructure. Support teams must use two-factor authentication to access the application remotely, and employees connect through SSH tunneling (VPN) with public/private key (PKI) two-factor authentication. Role-Based Access Control User authentication and authorization determines who can access information based on their privileges and role. Service-Level Agreement Service availability is defined and agreed to within the Master Services Agreement. Audit Logging Medallia takes access management seriously, granting access with the least privilege needed for the specific role and only to the personnel that need it. We review and update access rights annually and after any change in a user's role. Access to systems that store client data is severely restricted and carefully logged, monitored, and audited. Data Security Data protection, encryption, and access controls Data Erasure Any media containing client data will be sanitized or physically destroyed, in accordance with NIST SP 800-88 rev 1 Guidelines for Media Sanitization, before the media is reused or disposed. Encryption-at-rest Data at rest is encrypted using 256-bit AES encryption. Encryption-in-transit Data in transit is encrypted using TLS 1.2. Access Monitoring All Medallia access to customer data is audited and logged, including an annual review of all employee access rights. Physical Security Medallia has placed appropriate countermeasures in place to protect its office facilities from any physical damage. In addition, Medallia's colocation data centers inherit physical security and environmental controls from the colocation providers. All facilities hosting our services provide the robust physical security and fault-tolerant, highly resilient, redundant support infrastructure necessary to ensure reliable service. Data Masking Sensitive data fields can be masked to protect personally identifiable information during session replays and analytics. Media Data Retention Video and media data retention policies ensure content is managed according to customer requirements. Medallia Quantum Statement Medallia recognizes the ongoing research into quantum computing and its potential future impact on cryptography. Your trust and data security remain our highest priority. Current Security Protocols Today, Medallia secures client data by protocols proven resilient against all current threats: Data in Transit: We utilize TLS 1.2+ for all data transmitted outside our corporate network, protecting against conventional eavesdropping. Data at Rest: All stored data is encrypted using AES-256 (Advanced Encryption Standard with a 256-bit key), a standard considered computationally infeasible to break by current classical computers. Our Quantum Preparedness While a universal, fault-tolerant quantum computer capable of breaking current public-key cryptography (Shor's algorithm threat to TLS) is a speculative, long-term threat, we are proactively addressing it: AES Resilience: In alignment with the National Institute of Standards and Technology’s (NIST) Post-Quantum Cryptography (PQC) standardization process, our use of AES-256 (category 5 security strength) for data storage offers strong quantum resistance. While quantum algorithms like Grover's could theoretically reduce the security level, the resulting 128-bit security equivalent remains robust. Monitoring and Strategy: We are actively monitoring the development of PQC standards led by the National Institute of Standards and Technology (NIST). Crypto-Agility: Our system architecture is designed with crypto-agility in mind, enabling us to seamlessly integrate future NIST-finalized PQC standards into our platform before any credible quantum threat materializes. In summary: Your data is safe with our current, state-of-the-art encryption. We are strategically preparing our systems for the transition to quantum-safe standards to ensure continuous, future-proof security. Backups Medallia’s production data backup schedule runs daily using write-ahead-logging (WAL) with full weekly backups of the entire database. The backup script runs hourly, checking the timestamp of the last successful base backup. If the timestamp of a database is over a week old, it will run the base backup for the particular database and replace the oldest weekly backup (14 day retention). The backup is encrypted at the same level as the production environment, AES-256-bit. Customer data is always backed up to disk — never to external media (i.e. tape). Backup data is also stored within the databases using write-ahead logging (WAL) to minimize data loss. Medallia also takes snapshots of the entire database system as an additional backup measure. App Security Application development and security practices Code Analysis Medallia's Engineering and Product Security teams conduct extensive development and post-development testing to be certain our applications are secure. This includes static and dynamic code analysis and manual penetration testing. All deployed software undergoes a post-deployment vulnerability scan. Secure Development Training Medallia has an extensive Security Champions program. Development teams have one or more representatives that take part in an intensive 6-month certified security training program. This ensures that secure development scales as we scale and is part of the DNA and culture of how we build our applications. Software Development Lifecycle Medallia uses an agile methodology for development. Our software feature development process has five clearly defined lanes or stages: Ready Lane, Development Lane, Code Review Lane, Checkpoint Lane and Merged Lane. Medallia also follows its internal SDLC policy and associated procedures. Vulnerability & Patch Management Medallia's vulnerability management process includes regular and ad hoc vulnerability scanning. We monitor for vulnerabilities listed in the CVE database and frequently test for threats on the OWASP Top 10 list. Any vulnerabilities identified are analyzed and remediated in accordance with our Vulnerability Management Standard. Credential Management Medallia implements secure credential management practices. Passwords and secrets are properly stored using industry-standard encryption, regularly rotated, and access is restricted to authorized personnel only. Network Security Network protection and monitoring controls Firewall Medallia has firewall systems in place to monitor and filter unauthorized inbound network traffic from the Internet, maintain segregation between internal and external networks, and maintain separation between internal wired, wireless, and protected network segments, including Demilitarized Zones (DMZs). With default deny rules in place and deny any type of network connection that is not explicitly authorized, firewall rules are reviewed on an annual basis to ensure firewalls are appropriately configured. IDS/IPS Medallia has electronic intrusion detection systems installed within data server locations to monitor, detect, and automatically alert appropriate personnel of security incidents. SIEM Security Information and Event Management systems aggregate and analyze security events across the infrastructure. Legal Legal compliance and regulatory requirements Subprocessors Medallia maintains a list of authorized subprocessors for data processing activities. To receive updates to this list, please sign up at medallia.com/subprocessors. Cyber Insurance Comprehensive cyber insurance coverage for data breach and security incident response. Data Processing Agreement Standard DPA available for customers requiring data processing agreements. State Wiretapping Laws (CIPA / FCSA) Medallia Digital Experience Analytics (DXA) provides insight into how users interact with websites and applications, enabling organizations to identify friction points and improve digital journeys. Because DXA records interaction data, customers sometimes ask how tools of this kind relate to state privacy and communications laws, particularly the California Invasion of Privacy Act (CIPA) and the Florida Security of Communications Act (FSCA). Certificates of Destruction Medallia can provide an attestation of data deleted to any client upon request. For physical hardware destruction our Data Center Services (DCS) team follows the procedure outlined below: Retired and defective media with confidential customer information is stored in a secured environment until destruction. When we have sufficient media collected to destroy, we request that one of our media destruction vendors comes on site to pickup the media. When we hand over the media, we get a receipt for the number of drives handed over. The media is either degaussed or physically shredded by the vendor. The vendor provides Medallia a certificate of hard drive destruction which includes serial numbers of the hard drives destroyed. The certificate of hard drive destruction is forwarded to Medallia's Trust and Assurance Group (TAG). The secure media destruction policy does not apply to drives that have hardware full disk encryption enabled at the time of disposal or failure. EU-AI Act Medallia's security and privacy is an embedded priority as it relates to our data privacy principles. We work to adhere to the most stringent data protection regulations globally keeping in mind the adaptation of the ever changing landscape that is data privacy. Medallia’s cloud-native SaaS platform is designed with EU AI Act alignment at its core. Based on our current functionality and intended use, and as of the time of writing, our AI capabilities are assessed as low risk under the EU AI Act’s risk-based framework. Medallia proactively established an AI Moderation Council, anticipating the need for industry leadership for emerging AI trends. This included enabling members of Medallia’s Product, Data Science, Security Engineering, and Legal teams to review proposed use cases for AI models within Medallia Products as well as our internal infrastructure, and to address requirements of the Act. Most importantly, it applies to both providers and deployers of the AI systems. Customers retain full control of how they use Medallia’s features and products. The ultimate risk is determined by the customer's specific use case. We stress to our customers to perform internal assessments to ensure they do not deploy our tools in a manner that's considered “high-risk” under the regulation. We require human in the loop feedback to ensure compliance and the responsible use of any AI system. We do not currently depend on external generative AI services for processing or training. All AI workloads run within our own managed and trusted infrastructure, in support of security and an attested compliance posture as regulatory guidance continues to evolve. Medallia ensures that inputs are protected to its highest capability when ingested into our models within the Medallia environment by instilling de-identification and aggregation mechanisms, HTIL, prompt engineering, and customer data is not used to train the third party foundational model. To maintain this standard, our data processing architecture follows a security-first initiative, ensuring customer data is never vulnerable and used to train the foundational third-party models. Generative AI at Medallia Medallia security posture and principle design foundations AI Security Principles GenAI & SDLC (Software Development Lifecycle) As a cloud-native SaaS provider, our AI platform follows a risk-based governance approach and, as of the time of writing, our AI capabilities are internally assessed as low risk based on their intended use and system design, subject to ongoing review. We distinguish our models between shared/models and customer-specific. Shared customer models consist of large scale, fine-tuned models used for general language understanding, feedback experience analysis and reasoning capabilities. Models act as a processing engine, not a storage point, therefore, client data is never retained beyond the contractual limitation period. Capabilities such as Smart Response, Root Cause Assist, Intelligent Summaries and Coaching Intelligence are all cross-customer models. Customer-specific models are dedicated components allowing the AI to understand your unique business context and use case. These assets are logically isolated within your tenant boundary, ensuring privacy and making it inaccessible to any other Medallia client. Themes with GenAI is the sole GenAI capability that inhibits customer-specific models per tenant. Together, this approach reduces operational complexity, limits unintended and uncontrolled data flows, and provides enterprises with a secure and transparent foundation for responsible AI adoption. Security By Design at Medallia Medallia in addition to our expanded secure SDLC for generative AI, applies secure system prompt engineering practices aligned with industry standard security frameworks such as OWASP for Large Language Model Applications and relevant SANS secure AI guidance at this time. These controls include strict PII minimization (in adherence to GDPR Article 5), structured input validation, and robust code injection protections through escaping and sanitization mechanisms. Human-in-the-loop (HITL) controls are incorporated where appropriate to provide oversight, exception handling, and controlled decision points for higher-risk interactions. To mitigate common GenAI attack vectors, we extend our existing SaaS security controls to address risks such as LLM model manipulation and prompt-based exploitation, human process weaknesses, overly permissive GenAI feature configurations. These protections are informed by OWASP and SANS threat models and are continuously reviewed as new GenAI-specific risks emerge. We further strengthen our security posture through ongoing GenAI internal and external red teaming and product security reviews , to validate model behavior, control effectiveness, and operational resilience against realistic attack techniques. In parallel, our vendor risk and supply chain management program applies defined risk mitigation criteria—aligned with OWASP and SANS best practices—when selecting and managing third-party technologies, ensuring that all supporting components meet our security, compliance, and operational standards. Medallia also protects its compatible solution offerings at the presentation layer, deploying runtime application self-protection (RASP) controls that continuously monitor and inspect common attack vectors such as XSS, Injection attempts as well as now our GenAI interactions in real time. These controls are evolving to detect and mitigate common Generative AI attack vectors, including prompt manipulation, injection attempts, and anomalous input or output patterns. By enforcing protective actions at runtime, RASP enables immediate response to emerging GenAI vulnerabilities without disrupting application availability or user experience. GenAI Deployment Architecture and Licensing Model Within the Medallia landscape, hosting of data as well as processing AI compute stays enclosed to enhance our security. GenAI results are stored within the Medallia ecosystem alongside your other data, whereas processing occurs within the GPU farm uniquely linked to hosting facilities via an HPC link. The solution is built on closed LLM models deployed within controlled, private environments, ensuring predictable behavior, strong operational oversight, and clear data boundaries. Most AI workloads are executed within our own infrastructure and with some relying on public cloud privately hosted LLM models (e.g. AWS Bedrock which is also used as our public cloud failover service). There are no current reliances on external generative AI processing services. A private enterprise licensing model complements this architecture by enforcing tenant isolation, role-based access controls, HITL (human in the loop) processes, and contractual accountability, while also offering GenAI features with the ability of shared and non-shared model usage. Together, this limits unintended and uncontrolled data flows, and provides enterprises with a secure and transparent foundation for responsible AI adoption. ISO 42001 Statement With Generative AI rapidly evolving, Medallia understands the importance of governance, security and accountability when building out capabilities to further enhance customer insights. Here at Medallia, we've instilled many factors that come into play of being ISO 42001 compliant including a dedicated AI Moderation Council (AIMC) that reviews AI use cases, assesses risks, and addresses ethical, legal, and security considerations before deployment. Furthermore, Medallia's commitment to responsible AI ensures data protection, compliance, and reliability, with all models undergoing regular review for security, performance, and ethical standards.. The memo attached stipulates how we adhere to the framework and the what the future holds to be fully compliant with framework. ESG Anti-Bribery and Corruption Medallia has instituted a comprehensive code of business conduct and ethics consistent with the highest standards of legal and ethical business conduct. This code covers compliance with applicable laws, rules, and regulations, including anti-bribery and anti-corruption laws; principles of ethical behavior and fair dealing; and confidentiality and privacy. Code of Ethics Medallia has instituted a comprehensive code of business conduct and ethics consistent with the highest standards of legal and ethical business conduct. This code covers compliance with applicable laws, rules, and regulations, including anti-bribery and anti-corruption laws; principles of ethical behavior and fair dealing; and confidentiality and privacy. Documentation Featured Security Best Practices (MEC) Policies Access Management Standard Business Continuity and Disaster Recovery Standard Video Architecture Diagram Change Management Standard Clean Workspace Policy Cloud Services Security Standard Customer Program Data Retention Policy Data Classification Standard Data Loss Prevention Policy Information Retention Policy Information Security Management System Policy Information Security Management System Scope Information Security Policy Policy Management Standard Privacy Information Management System Policy Software Development Lifecycle Standard Systems Operations Standard Third-Party Risk Management Standard Corporate Software Security Policy Endpoint Privilege Management Policy Network Security Standard Product Security Policy Production Access Policy Removable Media and Wireless File Transfer Policy Secure Coding Standard Source Code Control Standard Vulnerability Management Standard Medallia Security Standards Certifications FSQS-NE Certificate (20000187) HITRUST r2 Certification Letter ISO/IEC 27001 Certificate ISO/IEC 27017 Certificate ISO/IEC 27018 Certificate ISO/IEC 27701 Certificate PCI DSS Attestation of Compliance (DXA) PCI DSS Attestation of Compliance (MEC) SOC 2 Bridge Letter SOC 2 Type II Report (Agent Connect) SOC 2 Type II Report (Concierge) SOC 2 Type II Report (Digital) SOC 2 Type II Report (DXA) SOC 2 Type II Report (MEC) VPAT - Concierge ISO 27001 Statement of Applicability (SoA) v3.9 ISO 27017 & 27018 Statement of Applicability (SoA) v3.9 ISO 27701 Statement of Applicability (SoA) v3.9 SOC 2 Type II Report Medallia-Feedback-2025-Type 1 SOC 2-Final Report Medallia-Video-2025-Type 2 SOC 2-Final Report Medallia Ideas SOC 2 Type II (2025-2026) Medallia ISO 27017.2015 (2025-2026) Medallia ISO 27001.2022 (2025-2026) Medallia ISO 27018.2019 (2025-2026) Medallia ISO 27701.2019 (2025-2026) Medallia MXO SOC 2 Type II (2025-2026) 2026 Medallia APEC PRP Certification Letter 2026 Medallia APEC CBPR Certification Letter Cyber Essentials Certificate SOC 2 Type I Report HITRUST Certification Assessment 2026 Bridge Letter Security Agent Connect Architecture Diagram (AWS) Agent Connect Architecture Diagram (Co-Location) DXA Data Masking Samples DXA System Architecture Diagram MEC Data Flow and Infrastructure Diagram MEC SaaS Production Architecture Diagram Security Best Practices (MEC) Trust at Medallia Trust at Medallia - DXA Concierge Pen Test Summary Ideas Pen Test Summary Medallia Digital SDK - iOS and Android Pen Test Summary Letter Medallia Ideas APIs Pen Test Summary Medallia Marketing Site Pen Test Summary Mindful Callback On-Prem Pen Test Summary Message Based Surveys Pen Test Summary Mindful Feedback Pen Test Summary Mindful Callback Cloud Pen Test Summary Video Pen Test Summary MXO Pen Test Summary MM3 and Voices 2 Mobile App Pen Test Summary MXO Data Flow Architecture CISO Organization Chart Published October 2026 Pentest MEC Pen Test Summary Medallia AI Intelligent Summaries and Root Cause Assist Pen Test Summary Medallia AI Smart Response Pen Test Summary Medallia AI Themes 2.0 Pen Test Summary DXA Mobile SDK Pen Test Summary DXA Pen Test Summary DXA External OCI Network Pen Test Summary Medallia Digital Feedback Web Pen Test Summary Agile Research Pen Test Summary Third-Party Security Rating Reports Letter MEC External Network Pen Test Summary Medallia Mobile and Voices Application Penetration Test Report Medallia Concierge Application Penetration Testing Report Conversation Message-Based Penetration Testing Report Questionnaires CAIQ v4.0.3 Accessibility Survey Emails Builder Voluntary Product Accessibility Template (VPAT) WCAG Report (2026) Medallia Experience Cloud Accessibility Conformance Report (WCAG, 2026 H1) Medallia Experience Cloud Accessibility Conformance Report (2026 H1 2) Medallia Experience Cloud Accessibility Report (Web Content Accessibility Guidelines 2026) 2026_Digital Feedback_Web_VPAT2.5Rev_WCAG_February2025 2026_Digital_Feedback_Android_VPAT2.5_WCAG_February2025 2026_Digital_Feedback_iOS_VPAT2.5_WCAG_February2025 VPAT2.5WCAG_November2023_DXA_2025 2024_Agile Research Report_VPAT2.5_WCAG_November2023 2024_Agile_Research_Builder_VPAT2.5_WCAG_November2023 2024_Agile_Research_Survey_VPAT2.5WCAG_November2023. 2025_Mindful_Email_VPAT2.5_WCAG_November2023 2025_Mindful_Web_VPAT2.5_WCAG_November2023 Accessibility Conformance Report for Callback Dialog Accessibility Conformance Report Accessibility Conformance Report for Medallia Voices Android Medallia Voices iOS Accessibility Conformance Report BCP & DR Incident Management Tabletop Exercise Report Disaster Recovery Test Results Other MXO Technology Stack Architecture Global Impact Report Trust Center Letter Updated October 2026 Privacy & Legal Medallia, Inc. Privacy Modern Slavery Statement Certificate of Liability Insurance Generative AI (GenAI) AI Governance Policy Responsible AI Frequently Asked Questions Technology Providers Subprocessors providing technology for Medallia products. If Customer does not purchase a product listed, those subprocessors shall not apply. Aerialink Inc. · USA Mindful Callback: Provides mobile connection services through SMS (Short Message Service) functionality. USA Affectiva, Inc. · USA Video: Software-based recognition of facial emotions. USA Amazon Comprehend · US, Canada, EU, Australia Mindful Feedback: Sentiment analysis. US, Canada, EU, Australia Amazon Transcribe (Optional) · USA, UK, Germany, Singapore Speech / Voci: Transcription for additional languages. USA, UK, Germany, Singapore Amazon Web Services, Inc. · USA, EU or UK (Customer's choice) Ideas: Hosts platform data. Archives security logs for security incident monitoring and detection. USA, EU or UK (Customer's choice) Amazon Web Services, Inc. · USA Concierge: Data storage and processing. USA Amazon Web Services, Inc. · USA, Canada, Ireland or Australia (Customer's choice) Video: Hosts platform data. USA, Canada, Ireland or Australia (Customer's choice) Amazon Web Services, Inc. · USA Agent Connect: Hosts platform data. USA Amazon Web Services, Inc. · USA and EU DXA: Data processing activities. USA and EU Amazon Web Services, Inc. · USA, EU, Canada or Singapore (Customer's choice) Agile Research: Hosts platform data. USA, EU, Canada or Singapore (Customer's choice) Amazon Web Services, Inc. · USA Mindful Callback: Hosts platform data: telephone numbers, callback requests, meta data sent with telephone calls. USA Amazon Web Services, Inc. · USA Mindful Feedback: Hosts platform data: telephone numbers, email addresses, survey invitations, survey responses. USA Amazon Web Services, Inc. · USA CX Journeys: Renders front-end html and reports. USA Amazon Web Services, Inc. · USA, EU or UK (Customer's choice) Strikedeck: Hosts platform data. USA, EU or UK (Customer's choice) Amazon Web Services, Inc. · USA Sense360: Hosts platform data. USA Amazon Web Services, Inc. · USA Speech / Voci: Hosts platform data (GovCloud only). USA Amazon Web Services, Inc. (Optional) · USA, EU, Canada, Australia MEC: LLM hosting and data processing for Generative AI Features, if included in the Customer's subscription. USA, EU, Canada, Australia Amazon Web Services, Inc. (Optional) · USA Digital: Hosts platform data. USA Atlassian Pty Ltd. · USA, Germany, Ireland, Singapore, Australia MXO: Support issue tracking tool and service status monitoring. USA, Germany, Ireland, Singapore, Australia Bandwidth Inc. · USA and Canada Concierge: Provides SMS routing and delivery services. Customer and Medallia shall mutually agree on the provider(s) of choice. USA and Canada Cantab Research Limited (Speechmatics) · UK Video: Software-based speech recognition (speech-to-text). UK Cloudinary Ltd. · USA Ideas: Storage for user uploads. USA Cloudinary Ltd. · USA Agent Connect: User image provider. USA Cyclr Systems Limited · UK Mindful Callback and Feedback: Integration Platform as a Service. Enables data to flow between Mindful and other client platforms. UK Datadog Inc. · USA Mindful Callback and Feedback: Application logging and observability. USA Elasticsearch AS · USA Video: Search and analytics. USA Engage Hub Ltd. (Optional) · UK MEC: Provides SMS routing and delivery services for SMS Message-Based surveys, if enabled. UK Google Cloud · USA Mindful Feedback: Voice to text transcription of survey responses. USA Google LLC · USA Ideas: Google Analytics is used to gather information about product use. USA Google LLC · USA Concierge: Data storage and processing for MMS message attachments. USA Google LLC · USA Video: Software-based object recognition. USA Google LLC · USA CX Journeys: Data storage and processing. USA Google LLC (Looker Studio) · USA Mindful Callback and Feedback: Modeled, anonymized application data for business intelligence and reporting. USA Google LLC (Optional) · USA MEC: Translates feedback text, if enabled. USA IBM Corp. · USA Video: Watson natural language processing for sentiment analysis. USA Intercom R&D Unlimited Company · EU Agent Connect: Application Connector for Support. EU Intercom R&D Unlimited Company · Ireland MEC and DXA: Used for live chat support in Premier and Signature Success Plans, if purchased by the Customer. Ireland Joincube, Inc. (Beamer) · USA MXO: In-app notifications in MXO. USA Localize Corporation · USA Agent Connect: Translation provider. USA MessageBird B.V. (Optional) · Netherlands Agile Research: Message Gateway (only SMS telephone and text messages). Netherlands Microsoft Azure · USA, Europe, Australia MXO: MXO operates its Services from Microsoft Azure, with data held in MXO's Azure subscriptions across multiple regions. USA, Europe, Australia Microsoft Corporation · USA Video: Hosting for reporting application, software-based machine translation and facial blurring. USA Mode Analytics, Inc. · USA Concierge: Provides in-product analytics. USA Okta Inc. · USA Mindful Callback: Identity and access management (for Mindful Gov instance only). USA Oracle Inc. · Regional Video and DXA: Hosting of platform data. Regional Oracle Inc. (Optional) · Regional MEC and Digital: Regional hosting in certain locations. Regional Participatory Culture Foundation (Amara) · USA Video: Human transcription and translation services. USA Pendo io, Inc. · USA Mindful Callback and Feedback: Mindful application usage and in-app messaging. USA Postmark (Wildbit, LLC) · USA Concierge: Provides email routing and delivery services. USA Redis Labs Ltd. · USA CX Journeys: Redis for Caching service maintains state for cookies. USA Rev.com Inc. · USA Video: Human transcription services. USA Rocket Science Group LLC d/b/a Mailchimp · USA Agent Connect: Email service provider. USA Rollbar, Inc. · USA Concierge: Manages system logs for diagnosis and resolution of technical issues. USA Segment.io, Inc. · USA Concierge: Tracks Concierge product usage. USA Snowflake Inc. · USA Mindful Feedback: Survey invitations, survey responses, messages, platform data for business intelligence and reporting. USA Snowflake Inc. · USA Mindful Callback: Callbacks, messages, platform data for business intelligence and reporting. USA Summa Linguae Technologies S.A. · EU Speech / Voci: Transcription for Custom Model Tuning. EU Twilio Inc. · USA Ideas and MXO: Sendgrid service used for platform generated emails. USA Twilio Inc. · USA and Canada Concierge: Provides SMS routing and delivery services. Customer and Medallia shall mutually agree on the provider(s) of choice. USA and Canada Twilio Inc. · USA Mindful Callback: Routes Mindful traffic through Twilio Edge Locations. Data: telephone numbers, callback requests, call metadata. USA Twilio Inc. · USA Mindful Feedback: Routes Mindful traffic through Twilio Edge Locations. Data: phone numbers, SMS survey invitations and responses, call metadata. USA Twilio Inc. · USA CX Journeys: Sendgrid service used for platform generated emails. USA Twilio Inc. (Optional) · USA MEC: Provides SMS routing and delivery services for SMS Message-Based surveys, if enabled. USA Usersnap GmbH (Optional) · Austria Digital: Screen capture functionality, if enabled. Austria Way With Words Limited · UK, South Africa Speech / Voci: Transcription for Custom Model Tuning. UK, South Africa Xelex Inc. · USA Speech / Voci: Transcription for Custom Model Tuning. USA Zendesk Inc. (Optional) · USA Concierge: Provides mobile SDK message routing and delivery services. USA Basic Technical Support Subprocessors providing basic technical support and troubleshooting, with limited temporary access to personal data if required to resolve a support item. Effective Teleservices Pvt Ltd (Etech Global Services) · India Implementation, servicing and technical support. India Infinit-O Philippines, Inc. · Philippines Technical support. Philippines Optional Servicing Partners Optional servicing partners which are available if requested by a customer in specific regions/locations. Accenture International Ltd. · Ireland Implementation and servicing. Ireland Excers Inc. · USA Implementation and servicing. USA Omega3c S.r.l. · Italy Implementation and servicing. Italy SM Technologies Limited · Brazil Implementation and servicing. Brazil Loading content... Updates Overview