Snapshot 93346
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Medallia Trust Center **Medallia Proprietary and Confidential** Welcome to Medallia's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. Medallia offers a wide variety of products in order to best serve our customers. This page will provide information that is useful to every customer such as our corporate security including policies and standards. **To find information that is specific to the product or products you use today or are interested in learning more about, please use the dropdown menu on the top of the screen!** Powered by Wolfia. Review compliance certifications, security policies, subprocessors, and request access to detailed documentation. Skip to main content Medallia Trust Center Medallia Proprietary and Confidential Welcome to Medallia's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. Medallia offers a wide variety of products in order to best serve our customers. This page will provide information that is useful to every customer such as our corporate security including policies and standards. To find information that is specific to the product or products you use today or are interested in learning more about, please use the dropdown menu on the top of the screen! csa@medallia.com ⌘K OverviewDocumentationControlsSubprocessorsUpdates Loading content... Documentation Featured Security Best Practices (MEC) Certifications Contact supportReport a vulnerability Trust center by Wolfia: AI trust center & security questionnaire automation Does your team answer security questionnaires too? Wolfia answers them for you and runs trust centers Subprocessors Aerialink Inc. · USA Mindful Callback: Provides mobile connection services through SMS (Short Message Service) functionality. USA Affectiva, Inc. · USA Video: Software-based recognition of facial emotions. USA Amazon Comprehend · US, Canada, EU, Australia Mindful Feedback: Sentiment analysis. US, Canada, EU, Australia Amazon Transcribe (Optional) · USA, UK, Germany, Singapore Speech / Voci: Transcription for additional languages. USA, UK, Germany, Singapore Amazon Web Services, Inc. · USA, EU or UK (Customer's choice) Ideas: Hosts platform data. Archives security logs for security incident monitoring and detection. USA, EU or UK (Customer's choice) Controls Data Privacy Privacy controls and data protection measures Data Privacy Officer Employee Privacy Training Access Control Data Access Password Security BYOD Policy Infrastructure Infrastructure security and availability controls Status Monitoring Endpoint Security Disk Encryption Threat Detection Anti-DDoS BC/DR Data Center Network Time Protocol Capacity Planning & Management Separate Production Environment Corporate Security Organization-wide security policies and practices Asset Management Practices Employee Training Incident Response Frequently asked security questions Is Medallia secure? Medallia operates this public trust center. It publishes 19 independent compliance certifications, security documentation available on request, and a published list of its subprocessors. Is Medallia SOC 2 compliant? Yes. Medallia maintains SOC 2 Type I compliance. You can review this in the compliance section of this trust center. Does Medallia have ISO 27001 certification? Yes. Medallia is ISO 27001 certified. You can review this certification in the compliance section of this trust center. Is Medallia GDPR compliant? Yes. Medallia maintains GDPR compliance. See the compliance section of this trust center for details. Is Medallia HIPAA compliant? Yes. Medallia maintains HIPAA compliance. See the compliance section of this trust center for details. Does Medallia have FedRAMP authorization? Yes. Medallia maintains FedRAMP compliance. See the compliance section of this trust center for details. Who are Medallia's subprocessors? Medallia discloses its subprocessors in this trust center, including Aerialink Inc., Affectiva, and Amazon Comprehend. See the subprocessors section for the complete list. Where is Medallia data hosted? Medallia discloses its infrastructure and hosting subprocessors in this trust center, including Google Cloud. See the subprocessors section for details. How do I request Medallia's security documentation? You can request access to Medallia's security documentation directly through this trust center. Submit an access request and the Medallia team reviews and grants access. Contact supportReport a vulnerability Trust center by Wolfia: AI trust center & security questionnaire automation Does your team answer security questionnaires too? Wolfia answers them for you and runs trust centers Controls Data Privacy Privacy controls and data protection measures Data Privacy Officer Medallia has a designated Data Privacy Officer responsible for overseeing data protection strategy and compliance. Employee Privacy Training All employees complete privacy training to ensure awareness of data protection obligations. Access Control Privileged user access is restricted as per the access management standard. Access requests outside of the role-based access are tracked and approved in the ticketing system. Data Access Customer data access is restricted and monitored, with all access logged and auditable. Password Security Strong password policies and multi-factor authentication protect access to systems and data. BYOD Policy Bring Your Own Device policies ensure personal devices meet security requirements before accessing corporate resources. Infrastructure Infrastructure security and availability controls Status Monitoring The experiences you provide your customers and employees never stop, and neither do we. Our Production Services & Engineering teams utilize internal and external services to perform continuous scanning and monitoring of our network and application to ensure world-class availability of our SaaS platform. Endpoint Security Endpoint protection solutions deployed across all corporate devices. Disk Encryption Full disk encryption enabled on all corporate devices and servers. Threat Detection Advanced threat detection systems monitor for security events and anomalies. Anti-DDoS Medallia uses robust load balancing, malware detection and prevention, and on-demand DoS and DDoS detection and prevention systems. BC/DR Medallia has established a Business Continuity Plan to support continued delivery of its products and services after a disaster event that impacts the resources required (i.e., people, technology, physical assets and/or relationships) to support the performance of its critical business processes. Data Center As a cloud-based SaaS provider, Medallia platforms are accessed over the Internet. Medallia's Experience Cloud and Digital platforms are hosted out of colocation facilities, located in North America, Asia, Australia, and Europe. Network Time Protocol Medallia uses an internal NTP to ensure all systems have a common time reference. Capacity Planning & Management DXA is built on a robust cloud-based infrastructure that can efficiently scale to handle huge data sets, including seasonal traffic and unexpected visitor surges. Separate Production Environment Medallia uses separate environments for development and production, with segmentation ensuring isolation between environments. Corporate Security Organization-wide security policies and practices Asset Management Practices Comprehensive asset management ensures all hardware and software assets are tracked and secured. Employee Training Medallia has an extensive Security Champions program. Development teams have one or more representatives that take part in an intensive 6-month certified security training program. This ensures that secure development scales as we scale and is part of the DNA and culture of how we build our applications. Incident Response Established incident response procedures for timely detection, containment, and remediation of security incidents. Product Security Application and product-level security controls Data Security Data protection is a top priority for Medallia. We build our platform using the following core principles: We treat all customer data as private and sensitive. We do not share customer data with third parties without approval of the customer. Our customers are in control of their data with standard, industry compliant policies for deletion and retention. We have architected our platform from the ground up with security and privacy by default. Customer data is labeled as Confidential by Medallia. Integrations Medallia provides application adapters, connectors, and integrations including our Auto Importer (ETL tools for automated data transfer), pre-built connectors at medallia.com/xchange, developer APIs at developer.medallia.com, and batch file transfers via SFTP. Multi-Factor Authentication Medallia uses multi-factor authentication for system-level access to our application and backend infrastructure. Support teams must use two-factor authentication to access the application remotely, and employees connect through SSH tunneling (VPN) with public/private key (PKI) two-factor authentication. Role-Based Access Control User authentication and authorization determines who can access information based on their privileges and role. Service-Level Agreement Service availability is defined and agreed to within the Master Services Agreement. Audit Logging Medallia takes access management seriously, granting access with the least privilege needed for the specific role and only to the personnel that need it. We review and update access rights annually and after any change in a user's role. Access to systems that store client data is severely restricted and carefully logged, monitored, and audited. Data Security Data protection, encryption, and access controls Data Erasure Any media containing client data will be sanitized or physically destroyed, in accordance with NIST SP 800-88 rev 1 Guidelines for Media Sanitization, before the media is reused or disposed. Encryption-at-rest Data at rest is encrypted using 256-bit AES encryption. Encryption-in-transit Data in transit is encrypted using TLS 1.2. Access Monitoring All Medallia access to customer data is audited and logged, including an annual review of all employee access rights. Physical Security Medallia has placed appropriate countermeasures in place to protect its office facilities from any physical damage. In addition, Medallia's colocation data centers inherit physical security and environmental controls from the colocation providers. All facilities hosting our services provide the robust physical security and fault-tolerant, highly resilient, redundant support infrastructure necessary to ensure reliable service. Data Masking Sensitive data fields can be masked to protect personally identifiable information during session replays and analytics. Media Data Retention Video and media data retention policies ensure content is managed according to customer requirements. App Security Application development and security practices Code Analysis Medallia's Engineering and Product Security teams conduct extensive development and post-development testing to be certain our applications are secure. This includes static and dynamic code analysis and manual penetration testing. All deployed software undergoes a post-deployment vulnerability scan. Secure Development Training Medallia has an extensive Security Champions program. Development teams have one or more representatives that take part in an intensive 6-month certified security training program. This ensures that secure development scales as we scale and is part of the DNA and culture of how we build our applications. Software Development Lifecycle Medallia uses an agile methodology for development. Our software feature development process has five clearly defined lanes or stages: Ready Lane, Development Lane, Code Review Lane, Checkpoint Lane and Merged Lane. Medallia also follows its internal SDLC policy and associated procedures. Vulnerability & Patch Management Medallia's vulnerability management process includes regular and ad hoc vulnerability scanning. We monitor for vulnerabilities listed in the CVE database and frequently test for threats on the OWASP Top 10 list. Any vulnerabilities identified are analyzed and remediated in accordance with our Vulnerability Management Standard. Credential Management Medallia implements secure credential management practices. Passwords and secrets are properly stored using industry-standard encryption, regularly rotated, and access is restricted to authorized personnel only. Network Security Network protection and monitoring controls Firewall Medallia has firewall systems in place to monitor and filter unauthorized inbound network traffic from the Internet, maintain segregation between internal and external networks, and maintain separation between internal wired, wireless, and protected network segments, including Demilitarized Zones (DMZs). With default deny rules in place and deny any type of network connection that is not explicitly authorized, firewall rules are reviewed on an annual basis to ensure firewalls are appropriately configured. IDS/IPS Medallia has electronic intrusion detection systems installed within data server locations to monitor, detect, and automatically alert appropriate personnel of security incidents. SIEM Security Information and Event Management systems aggregate and analyze security events across the infrastructure. Legal Legal compliance and regulatory requirements Subprocessors Medallia maintains a list of authorized subprocessors for data processing activities. To receive updates to this list, please sign up at medallia.com/subprocessors. Cyber Insurance Comprehensive cyber insurance coverage for data breach and security incident response. Data Processing Agreement Standard DPA available for customers requiring data processing agreements. State Wiretapping Laws (CIPA / FCSA) Medallia Digital Experience Analytics (DXA) provides insight into how users interact with websites and applications, enabling organizations to identify friction points and improve digital journeys. Because DXA records interaction data, customers sometimes ask how tools of this kind relate to state privacy and communications laws, particularly the California Invasion of Privacy Act (CIPA) and the Florida Security of Communications Act (FSCA). Documentation Featured Security Best Practices (MEC) Policies Access Management Standard Business Continuity and Disaster Recovery Standard Video Architecture Diagram Change Management Standard Clean Workspace Policy Cloud Services Security Standard Customer Program Data Retention Policy Data Classification Standard Data Loss Prevention Policy Information Retention Policy Information Security Management System Policy Information Security Management System Scope Information Security Policy Policy Management Standard Privacy Information Management System Policy Software Development Lifecycle Standard Systems Operations Standard Third-Party Risk Management Standard Corporate Software Security Policy Endpoint Privilege Management Policy Network Security Standard Product Security Policy Production Access Policy Removable Media and Wireless File Transfer Policy Secure Coding Standard Source Code Control Standard Vulnerability Management Standard Medallia Security Standards AI Governance Policy Certifications FSQS-NE Certificate (20000187) HITRUST r2 Certification Letter ISO/IEC 27001 Certificate ISO/IEC 27017 Certificate ISO/IEC 27018 Certificate ISO/IEC 27701 Certificate PCI DSS Attestation of Compliance (DXA) PCI DSS Attestation of Compliance (MEC) SOC 2 Bridge Letter SOC 2 Type II Report (Agent Connect) SOC 2 Type II Report (Concierge) SOC 2 Type II Report (Digital) SOC 2 Type II Report (DXA) SOC 2 Type II Report (MEC) VPAT - Concierge ISO 27001 Statement of Applicability (SoA) v3.9 ISO 27017 & 27018 Statement of Applicability (SoA) v3.9 ISO 27701 Statement of Applicability (SoA) v3.9 SOC 2 Type II Report Medallia-Feedback-2025-Type 1 SOC 2-Final Report Medallia-Video-2025-Type 2 SOC 2-Final Report Medallia Ideas SOC 2 Type II (2025-2026) Medallia ISO 27017.2015 (2025-2026) Medallia ISO 27001.2022 (2025-2026) Medallia ISO 27018.2019 (2025-2026) Medallia ISO 27701.2019 (2025-2026) Medallia MXO SOC 2 Type II (2025-2026) 2026 Medallia APEC PRP Certification Letter 2026 Medallia APEC CBPR Certification Letter Cyber Essentials Certificate SOC 2 Type I Report HITRUST Certification Assessment 2026 Bridge Letter Security Agent Connect Architecture Diagram (AWS) Agent Connect Architecture Diagram (Co-Location) DXA Data Masking Samples DXA System Architecture Diagram MEC Data Flow and Infrastructure Diagram MEC SaaS Production Architecture Diagram Security Best Practices (MEC) Trust at Medallia Trust at Medallia - DXA Concierge Pen Test Summary Ideas Pen Test Summary Medallia Digital SDK - iOS and Android Pen Test Summary Letter Medallia Ideas APIs Pen Test Summary Medallia Marketing Site Pen Test Summary Mindful Callback On-Prem Pen Test Summary Message Based Surveys Pen Test Summary Mindful Feedback Pen Test Summary Mindful Callback Cloud Pen Test Summary Video Pen Test Summary MXO Pen Test Summary MM3 and Voices 2 Mobile App Pen Test Summary MXO Data Flow Architecture Pentest MEC Pen Test Summary Medallia AI Intelligent Summaries and Root Cause Assist Pen Test Summary Medallia AI Smart Response Pen Test Summary Medallia AI Themes 2.0 Pen Test Summary DXA Mobile SDK Pen Test Summary DXA Pen Test Summary DXA External OCI Network Pen Test Summary Medallia Digital Feedback Web Pen Test Summary Agile Research Pen Test Summary Third-Party Security Rating Reports Letter MEC External Network Pen Test Summary Questionnaires CAIQ v4.0.3 Accessibility Survey Emails Builder Voluntary Product Accessibility Template (VPAT) WCAG Report (2026) Medallia Experience Cloud Accessibility Conformance Report (WCAG, 2026 H1) Medallia Experience Cloud Accessibility Conformance Report (2026 H1 2) Medallia Experience Cloud Accessibility Report (Web Content Accessibility Guidelines 2026) 2026_Digital Feedback_Web_VPAT2.5Rev_WCAG_February2025 2026_Digital_Feedback_Android_VPAT2.5_WCAG_February2025 2026_Digital_Feedback_iOS_VPAT2.5_WCAG_February2025 VPAT2.5WCAG_November2023_DXA_2025 2024_Agile Research Report_VPAT2.5_WCAG_November2023 2024_Agile_Research_Builder_VPAT2.5_WCAG_November2023 2024_Agile_Research_Survey_VPAT2.5WCAG_November2023. 2025_Mindful_Email_VPAT2.5_WCAG_November2023 2025_Mindful_Web_VPAT2.5_WCAG_November2023 Accessibility Conformance Report for Callback Dialog Accessibility Conformance Report Accessibility Conformance Report for Medallia Voices Android Medallia Voices iOS Accessibility Conformance Report BCP & DR Business Continuity Tabletop Exercise Report Disaster Recovery Test Results Other MXO Technology Stack Architecture Global Impact Report Privacy & Legal Medallia, Inc. Privacy Modern Slavery Statement Technology Providers Subprocessors providing technology for Medallia products. If Customer does not purchase a product listed, those subprocessors shall not apply. Aerialink Inc. · USA Mindful Callback: Provides mobile connection services through SMS (Short Message Service) functionality. USA Affectiva, Inc. · USA Video: Software-based recognition of facial emotions. USA Amazon Comprehend · US, Canada, EU, Australia Mindful Feedback: Sentiment analysis. US, Canada, EU, Australia Amazon Transcribe (Optional) · USA, UK, Germany, Singapore Speech / Voci: Transcription for additional languages. USA, UK, Germany, Singapore Amazon Web Services, Inc. · USA, EU or UK (Customer's choice) Ideas: Hosts platform data. Archives security logs for security incident monitoring and detection. USA, EU or UK (Customer's choice) Amazon Web Services, Inc. · USA Concierge: Data storage and processing. USA Amazon Web Services, Inc. · USA, Canada, Ireland or Australia (Customer's choice) Video: Hosts platform data. USA, Canada, Ireland or Australia (Customer's choice) Amazon Web Services, Inc. · USA Agent Connect: Hosts platform data. USA Amazon Web Services, Inc. · USA and EU DXA: Data processing activities. USA and EU Amazon Web Services, Inc. · USA, EU, Canada or Singapore (Customer's choice) Agile Research: Hosts platform data. USA, EU, Canada or Singapore (Customer's choice) Amazon Web Services, Inc. · USA Mindful Callback: Hosts platform data: telephone numbers, callback requests, meta data sent with telephone calls. USA Amazon Web Services, Inc. · USA Mindful Feedback: Hosts platform data: telephone numbers, email addresses, survey invitations, survey responses. USA Amazon Web Services, Inc. · USA CX Journeys: Renders front-end html and reports. USA Amazon Web Services, Inc. · USA, EU or UK (Customer's choice) Strikedeck: Hosts platform data. USA, EU or UK (Customer's choice) Amazon Web Services, Inc. · USA Sense360: Hosts platform data. USA Amazon Web Services, Inc. · USA Speech / Voci: Hosts platform data (GovCloud only). USA Amazon Web Services, Inc. (Optional) · USA, EU, Canada, Australia MEC: LLM hosting and data processing for Generative AI Features, if included in the Customer's subscription. USA, EU, Canada, Australia Amazon Web Services, Inc. (Optional) · USA Digital: Hosts platform data. USA Atlassian Pty Ltd. · USA, Germany, Ireland, Singapore, Australia MXO: Support issue tracking tool and service status monitoring. USA, Germany, Ireland, Singapore, Australia Bandwidth Inc. · USA and Canada Concierge: Provides SMS routing and delivery services. Customer and Medallia shall mutually agree on the provider(s) of choice. USA and Canada Cantab Research Limited (Speechmatics) · UK Video: Software-based speech recognition (speech-to-text). UK Cloudinary Ltd. · USA Ideas: Storage for user uploads. USA Cloudinary Ltd. · USA Agent Connect: User image provider. USA Cyclr Systems Limited · UK Mindful Callback and Feedback: Integration Platform as a Service. Enables data to flow between Mindful and other client platforms. UK Datadog Inc. · USA Mindful Callback and Feedback: Application logging and observability. USA Elasticsearch AS · USA Video: Search and analytics. USA Engage Hub Ltd. (Optional) · UK MEC: Provides SMS routing and delivery services for SMS Message-Based surveys, if enabled. UK Google Cloud · USA Mindful Feedback: Voice to text transcription of survey responses. USA Google LLC · USA Ideas: Google Analytics is used to gather information about product use. USA Google LLC · USA Concierge: Data storage and processing for MMS message attachments. USA Google LLC · USA Video: Software-based object recognition. USA Google LLC · USA CX Journeys: Data storage and processing. USA Google LLC (Looker Studio) · USA Mindful Callback and Feedback: Modeled, anonymized application data for business intelligence and reporting. USA Google LLC (Optional) · USA MEC: Translates feedback text, if enabled. USA IBM Corp. · USA Video: Watson natural language processing for sentiment analysis. USA Intercom R&D Unlimited Company · EU Agent Connect: Application Connector for Support. EU Intercom R&D Unlimited Company · Ireland MEC and DXA: Used for live chat support in Premier and Signature Success Plans, if purchased by the Customer. Ireland Joincube, Inc. (Beamer) · USA MXO: In-app notifications in MXO. USA Localize Corporation · USA Agent Connect: Translation provider. USA MessageBird B.V. (Optional) · Netherlands Agile Research: Message Gateway (only SMS telephone and text messages). Netherlands Microsoft Azure · USA, Europe, Australia MXO: MXO operates its Services from Microsoft Azure, with data held in MXO's Azure subscriptions across multiple regions. USA, Europe, Australia Microsoft Corporation · USA Video: Hosting for reporting application, software-based machine translation and facial blurring. USA Mode Analytics, Inc. · USA Concierge: Provides in-product analytics. USA Okta Inc. · USA Mindful Callback: Identity and access management (for Mindful Gov instance only). USA Oracle Inc. · Regional Video and DXA: Hosting of platform data. Regional Oracle Inc. (Optional) · Regional MEC and Digital: Regional hosting in certain locations. Regional Participatory Culture Foundation (Amara) · USA Video: Human transcription and translation services. USA Pendo io, Inc. · USA Mindful Callback and Feedback: Mindful application usage and in-app messaging. USA Postmark (Wildbit, LLC) · USA Concierge: Provides email routing and delivery services. USA Redis Labs Ltd. · USA CX Journeys: Redis for Caching service maintains state for cookies. USA Rev.com Inc. · USA Video: Human transcription services. USA Rocket Science Group LLC d/b/a Mailchimp · USA Agent Connect: Email service provider. USA Rollbar, Inc. · USA Concierge: Manages system logs for diagnosis and resolution of technical issues. USA Segment.io, Inc. · USA Concierge: Tracks Concierge product usage. USA Snowflake Inc. · USA Mindful Feedback: Survey invitations, survey responses, messages, platform data for business intelligence and reporting. USA Snowflake Inc. · USA Mindful Callback: Callbacks, messages, platform data for business intelligence and reporting. USA Summa Linguae Technologies S.A. · EU Speech / Voci: Transcription for Custom Model Tuning. EU Twilio Inc. · USA Ideas and MXO: Sendgrid service used for platform generated emails. USA Twilio Inc. · USA and Canada Concierge: Provides SMS routing and delivery services. Customer and Medallia shall mutually agree on the provider(s) of choice. USA and Canada Twilio Inc. · USA Mindful Callback: Routes Mindful traffic through Twilio Edge Locations. Data: telephone numbers, callback requests, call metadata. USA Twilio Inc. · USA Mindful Feedback: Routes Mindful traffic through Twilio Edge Locations. Data: phone numbers, SMS survey invitations and responses, call metadata. USA Twilio Inc. · USA CX Journeys: Sendgrid service used for platform generated emails. USA Twilio Inc. (Optional) · USA MEC: Provides SMS routing and delivery services for SMS Message-Based surveys, if enabled. USA Usersnap GmbH (Optional) · Austria Digital: Screen capture functionality, if enabled. Austria Way With Words Limited · UK, South Africa Speech / Voci: Transcription for Custom Model Tuning. UK, South Africa Xelex Inc. · USA Speech / Voci: Transcription for Custom Model Tuning. USA Zendesk Inc. (Optional) · USA Concierge: Provides mobile SDK message routing and delivery services. USA Basic Technical Support Subprocessors providing basic technical support and troubleshooting, with limited temporary access to personal data if required to resolve a support item. Effective Teleservices Pvt Ltd (Etech Global Services) · India Implementation, servicing and technical support. India Infinit-O Philippines, Inc. · Philippines Technical support. Philippines Optional Servicing Partners Optional servicing partners which are available if requested by a customer in specific regions/locations. Accenture International Ltd. · Ireland Implementation and servicing. Ireland Excers Inc. · USA Implementation and servicing. USA Omega3c S.r.l. · Italy Implementation and servicing. Italy SM Technologies Limited · Brazil Implementation and servicing. Brazil Loading content... Updates Overview