Snapshot 256825
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content
Mixpanel, Inc.
Mixpanel is a powerful, self-serve digital analytics platform that helps teams analyze user behavior in real time to make faster, data-informed decisions.
grc@mixpanel.com
Privacy PolicyOpens in new tab
Filter by
Mixpanel is a digital analytics platform that allows anyone to get answers from their customer and business data in seconds. It offers powerful real-time charts and visualizations of how people interact with your digital products and company. With insights into behaviors like conversion and retention, teams can collaborate more effectively and make informed decisions. Regardless of technical expertise, builders can double down on what’s working, cut what isn’t, and spend more time on their best ideas with Mixpanel.
Compliance
SOC 2
ISO 27001:2022
ISO 27701
GDPR
CCPA
HIPAA
CSA STAR
Resources
View all
Certifications & Attestations
Mixpanel SOC 2 ISAE Type 2 Report w. HIPAA Mapping 04.30.26.pdf
Mixpanel ISO 27701:2019 Compliance Certificate FINAL 6.25.2026.pdf
Mixpanel ISO 27001:2022 Compliance Certificate FINAL 6.25.2026.pdf
Mixpanel SOC 2 Bridge Letter 09.11.2026.pdf
Penetration Test
Mixpanel 2025 Penetration Test HackerOne Executive Summary Report.pdf
Mixpanel 2025 Penetration Test HackerOne Executive Summary Retest Report.pdf
Policies
Acceptable Use Policy
Asset Management Policy
Business Continuity Plan
Software Development Policy
View 13 more
Legal
Terms of Use
Opens in new tab
Supplemental Terms
Opens in new tab
California Data Privacy Addendum (CDPA)
Opens in new tab
Data Processing Addendum (DPA)
Opens in new tab
View 2 more
Privacy
Privacy Statement
Opens in new tab
Marketing Privacy Notice
Opens in new tab
Mixpanel & the GDPR
Opens in new tab
Mixpanel Data Residency Program: US, EU & India
Opens in new tab
View 7 more
Architectural Design
Mixpanel Data Flow Chart.pdf
Security Questionnaires
CAIQ v4.0.3
Opens in new tab
Other resources
Certificate of Insurance
ISO 27001:2022 Statement of Applicability (SoA)
ISO 27701:2019 Statement of Applicability (SoA)
Controls
Subprocessors
View all
Google, Inc. • Infrastructure/Crash Reporting
USA
Google Cloud Platform ("GCP") provides infrastructure and storage of Customer Content, Personal Information, and hosts Mixpanel's Analytics platform. We also use GCP for crash reporting, DNS, and other infrastructure that supports the Application Services.
Amazon Web Services, Inc. • Supplemental Storage
USA
Amazon Web Services provides supplemental storage and backup storage for Mixpanel's Analytics platform, as well as disaster recovery storage that support our business continuity efforts.
Zendesk, Inc. • Customer Account Administration and Support
USA
Zendesk provides Mixpanel with customer account administration and support. Zendesk receives limited access to customer names, emails, and basic customer support information about servicing customer accounts. Zendesk does not process or gain access to Personal Information stored in or processed by Mixpanel as part of these services.
Atlassian Pty, Ltd. • Bug Tracking
USA
Atlassian provides products for bug tracking and remediation.
Updates
View all
Security
Security update: Google Brotli/Node.js vulnerabilities and LiteLLM compromise
Published October 29, 2026
Last updated: November 6, 2026
This page summarizes our response to two recently disclosed external security issues that you may have read about. We will update it as our investigations progress.
Google Brotli/Node.js vulnerabilities
Publicly disclosed: October 23, 2026
Shortly after the following vulnerabilities were disclosed, our internal teams promptly reviewed exposure.
CVE-2026-111497 (Brotli)
CVE-2026-105482
CVE-2026-105483
CVE-2026-106069
CVE-2026-105481
CVE-2026-106072
CVE-2026-106074
Based on our assessment, all endpoints have been remediated or mitigated. We have found no exposure in Mixpanel's product or systems and no actions are required by our customers at this time. We consider the investigation for this issue as complete as of October 26, 2026, and will only provide an update if any future discovery warrants disclosure.
LiteLLM compromise
Publicly disclosed: October 21, 2026
Shortly after the vulnerability affecting the recent LiteLLM compromise was disclosed, our internal teams promptly reviewed exposure. Based on our assessment, we have found no exposure to this vulnerability in Mixpanel's product or systems and no actions are required by our customers at this time. We consider the investigation for this issue as complete as of October 23, 2026, and will only provide an update if any future discovery warrants disclosure.
Questions or documentation requests
Customers who need additional documentation for their compliance obligations can submit a formal request through our trust portal at trust.mixpanel.com. For other questions, contact support@mixpanel.com or security@mixpanel.com.
This update is provided for informational purposes only, in support of our customers' due diligence obligations. It does not constitute a comprehensive security disclosure.
Security
Security update: eMudhra CA compromise and PHP2Shell vulnerabilities
Published October 24, 2026
Last updated: October 23, 2026
At Mixpanel, we know our customers trust us with data that is critical to their businesses, and protecting that data is a core responsibility. Data security is built into how we design, operate, and monitor our platform, and we take every potential threat seriously.
This page summarizes our response to two recently disclosed external security issues that you may have read about. We will update it as our investigations progress.
eMudhra Certificate Authority compromise
Publicly disclosed: October 20, 2026
Shortly after the compromise of the eMudhra Certificate Authority (CA) was disclosed, our internal teams promptly assessed Mixpanel's exposure. We identified components and systems that trust the compromised CA. We have started remediation and mitigation under our vulnerability management processes, and we are setting up ongoing monitoring for the affected certificates and the CA.
Our assessment is ongoing, and we are committed to completing it promptly. We will update this page periodically with findings that we believe should be disclosed. There has been no impact on our customers at this time. If that changes, we will notify customers directly.
PHP vulnerabilities (PHP2Shell): CVE-2026-109618 and CVE-2026-109619
Publicly disclosed: October 19, 2026
When these vulnerabilities, collectively known as PHP2Shell, were disclosed, our internal teams promptly assessed Mixpanel's exposure.
Based on our assessment and the information available as of October 23, 2026:
The Mixpanel product and systems that process customer data are not affected.
Two non-production resources outside our customer data environment were vulnerable. We started remediation under our vulnerability management process, and both identified vulnerable endpoints were patched as of October 21, 2026. To date, we have found no evidence of impact.
Our review is ongoing. We will update this page when the investigation concludes, or sooner if any material findings warrant disclosure.
Our Vulnerability Management Program
Mixpanel maintains a formal Vulnerability Management Program aligned with SOC 2 Type II and ISO 27001. It governs how we identify, prioritize, and remediate security vulnerabilities across our infrastructure and software supply chain. The program includes:
Continuous monitoring of third-party dependencies
Defined remediation SLAs based on CVSS severity and internal risk weighting
Regular checks of our asset inventory against known threat intelligence sources
Questions or documentation requests
Customers who need additional documentation for their compliance obligations can submit a formal request through our trust portal at trust.mixpanel.com. For other questions, contact support@mixpanel.com or security@mixpanel.com.
This update is provided for informational purposes only, in support of our customers' due diligence obligations. It does not constitute a comprehensive security disclosure.
Compliance
Announcing Our Latest Security and Privacy Milestones
Published August 5, 2025
We are excited to announce several major achievements that strengthen our security and privacy posture, demonstrating our ongoing commitment to protecting our customers' data. We have successfully completed our SOC 2 Type 2 audit and have updated our key ISO certifications.
New SOC 2 Type 2 Report
We have once again successfully completed our Service Organization Control (SOC) 2 Type 2 examination. The audit, conducted by the independent firm Baker Tilly US, LLP, covers the period from May 1, 2024, to April 30, 2025, and affirms that our security controls and practices meet the highest industry standards.
Transition to ISO/IEC 27001:2022
We have successfully transitioned our Information Security Management System (ISMS) from the ISO 27001:2013 standard to the latest ISO/IEC 27001:2022 standard. This update ensures our security framework aligns with the most current global best practices for managing information security.
Successful ISO/IEC 27701:2019 Surveillance Audit
Additionally, we have completed our annual surveillance audit for ISO/IEC 27701:2019, confirming our continued adherence to the standards for our Privacy Information Management System (PIMS). This reinforces our dedication to robust data privacy practices.
Access the Reports and Certificates
Your trust is our top priority. The latest SOC 2 Type 2 report, ISO 27001:2022 and ISO 27701:2019 certificates are now available for viewing in our trust center
General
Uploaded new version of our 2024 Pentest Report
Published July 14, 2025
Our pentest report now properly reflects the current state of the reported findings. A false positive medium-severity finding has been removed and the two remaining medium-severity findings accurately report as remediated.
No further revisions of this report shall be made. Our 2025 pentest engagement kicks off in August and a new report shall be posted early Fall.