Can I use Appcues Inc's SOC 2 for a vendor risk assessment?

Yes. Appcues Inc's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Is Appcues Inc penetration tested?

Appcues Inc hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Is Appcues Inc secure?

Security isn't a single yes/no, but Appcues Inc is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR, CCPA, HIPAA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Does Appcues Inc have a bug bounty or vulnerability disclosure program?

Appcues Inc hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@appcues.com or via a /security page (Appcues Inc lists a security contact).

Who are Appcues Inc's subprocessors?

Appcues Inc lists 7 subprocessors on its trust center, including Amazon Web Services, ClickHouse, Confluent, Snowflake, Mailgun. Buyers use this for fourth-party risk review.

Where does Appcues Inc host or store data?

Appcues Inc hosts on AWS. Data residency details are on its trust center.

Where is Appcues Inc's trust center or security page?

Appcues Inc's trust center is at https://trust.appcues.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Is this your company? Buyers are checking Appcues Inc here. Claim appcues.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.

Claim free

Appcues Inc

appcues.com · United States· 1–50 employees· Security contact

Security overview Compliance Penetration test

Trust level

Listed

Unverified

Listed

Domain

Report

Live

Sourced from public information. Not yet verified by the company.

Appcues Inc is SOC 2 Type II compliant. Appcues Inc also holds GDPR, CCPA, and HIPAA.

Request report access Claim this profile

Framework

Auditor

Last report

Renewal

View official trust center ↗

About

Security is built into the fabric of our products, team, infrastructure, and processes, so you can rest assured your data is safeguarded.

Compliance & infrastructure

SOC 2 Type II GDPRCCPAHIPAA

Hosting

AWS

Subprocessors

A
Amazon Web Services · Primary infrastructure provider for Appcues applications and services
USA & EU
C
ClickHouse · Provides managed database services.
USA & EU
C
Confluent · Infrastructure provider, managing Apache Kafka as a service.
USA & EU
S
Snowflake · Analytics database for calculating aggregate statistics for production.
USA & EU
M
Mailgun · Used for delivering emails as part of the Appcues out-of-product messaging produ
USA & EU
O
OpenAI · Provides AI model services for optional Appcues AI features.
USA & EU
L
Langfuse · Provides monitoring and quality testing tools for optional Appcues AI features
USA & EU

Compliance leadership

The person who leads Appcues Inc's SOC 2 isn't listed yet. Claim this profile to add it.

Penetration test

Unknown. Appcues Inc's penetration test vendor isn't listed yet.

Claim this profile to add it.

Recent updates

2026 Pentest and Summary of Findings Documents AvailableJun 2026

Appcues’ 2026 Penetration Test Report is now available, as well as the summary of findings document.

EU hosting environment support for AI featuresFeb 2026

AI features are now supported for any customers using the Appcues EU hosting environment. In addition, the Appcues' subprocessor list has been expanded to include OpenAI for EU and Langfuse for EU. Appcues complies with all applicable data protection laws, including GDPR.

EU Hosting EnvironmentJan 2026

Appcues now offers an EU hosting environment. Customers using the EU hosting environment benefit from the same security controls, infrastructure standards, and subprocessors as our US hosting environment, with the following exceptions: - OpenAI processing remains US-based. - HIPAA support is not available in the EU hosting environment. All data in the EU hosting environment implements the same strict security controls as the US hosting environment, and Appcues complies with all applicable data protection laws, including GDPR.

2025 SOC 2 Type 2 Report AvailableDec 2025

Appcues’ 2025 SOC 2 Type 2 report covering the observation period 10/01/2024 to 09/30/2025 is now available on the trust center.

Updates to the Appcues Subprocessor ListOct 2025

At Appcues, protecting the confidentiality and integrity of your data is our top priority. We work exclusively with trusted third-party service providers who meet our rigorous security and privacy standards. We will soon add the following entity to our list of subprocessors: - Langfuse Langfuse will provide monitoring and quality testing tools for Appcues AI features. Langfuse will not be used if your account has opted out of Appcues AI features. We have verified our service providers have the required technical expertise and that they maintain our security and privacy standards. You can view the current list of Appcues Third Party Subprocessors at any time.

This listing is partial

6/11 details · 55%

SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.

Auditorraises trust
Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
Report dateraises trust
Add your most recent report period so buyers see how current your SOC 2 is.
Renewal date
Add your renewal window so buyers know your coverage is active.
Documents
List the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
Security controls
Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.

Claim free to control your listing

Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.

Frequently asked

Is Appcues Inc SOC 2 compliant?

Appcues Inc is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Is Appcues Inc GDPR compliant?

According to Appcues Inc's public trust center, Appcues Inc is GDPR compliant. On SOC2C this listing is Listed.

Is Appcues Inc CCPA compliant?

According to Appcues Inc's public trust center, Appcues Inc is CCPA compliant. On SOC2C this listing is Listed.

Is Appcues Inc HIPAA compliant?

According to Appcues Inc's public trust center, Appcues Inc is HIPAA compliant. On SOC2C this listing is Listed.

Is Appcues Inc SOC 2 Type I or Type II?

Appcues Inc is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Show 7 more questions

Answers published by Appcues Inc

Reproduced from Appcues Inc's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗

Appcues Links

Appcues Terms of Service Appcues Privacy Policy Appcues Cookie Policy Appcues Data Processing Addendum (DPA) Appcues Shared Responsibility Model for Security and Privacy Appcues HIPAA Compliance Documentation

Why does your chrome extension require access to browser data for all websites?

The Appcues chrome extension is designed to be able to build content for all of our customers across any of their web properties. In order for our extension to inspect the page and place content, Google Chrome requires permissions to access this browser data, and in order to accommodate all of our customers' use cases, that permission has to be granted across all websites.

How do you monitor the health of your service?

Service health is monitored continuously, using metrics collected from actual requests. Additionally, external systems make periodic requests to the systems, to provide external visibility into system health.

How often do you have maintenance windows?

Appcues does not have regularly scheduled maintenance windows. In the event of service unavailability due to service maintenance, the window would be communicated to all customers well in advance of the event. Appcues strives to provide 24/7/365 service to all customers.

Does the application support Single Sign-On (SSO)? If so, how is it implemented (i.e. SAML)?

Appcues supports Google SSO, and SAML for enterprise accounts.

What is the service-level agreement (SLA)?

Appcues does not provide a contractually guaranteed service-level agreement as a standard part of the service offering. Appcues strives to provide 24/7/365 service to all customers. Status.appcues.com will provide updates on the status of the system and product.

Do you have RTO and RPO metrics?

RTO 3 hours, RPO 5 minutes or less

Do you follow any privacy or security frameworks? (ISO 27001, NIST, SOC-2, etc?)

Appcues conducts a SOC-2 Type 2 audit annually. Appcues also complies with regulatory privacy frameworks, including GDPR and CCPA.

What is your data retention period?

Appcues does not have a data retention window. By default, data sent to Appcues will be retained indefinitely. This is necessary because of the nature of the Appcues product. If a user sees a flow that is configured to only display to the user once, Appcues needs to remember that the user has already seen the flow, so that we don't show the flow to that user again. If we allowed data to expire out of our platform, then we would show that content to that user each time the record expired. Appcues can delete any data upon request. To request a data deletion, please refer to our GDPR Deletion API or write to us at [support@appcues.com](mailto:support@appcues.com)

What is the data retention policy?

Since Appcues uses data for core functionality of the product, data is retained for the life of the contract with the customer. Data is deleted upon request from the customer, or in accordance with the EU’s GDPR law. Deletion requests should be sent to support@appcues.com

What is the software development lifecycle (SDLC), or software change control process?

All software is peer reviewed before release. Appcues maintains multiple fully functional environments for the purposes of testing and validation outside of the production environment. Software changes are accepted to production only after peer review of source code and passage of the software’s automated test suite.

Has Appcues conducted a Business Impact Analysis (BIA)?

Yes, Appcues has completed a BIA as a part of our risk managment program.

Show 7 more questions

Business & Industrial peers that completed SOC 2

Compare vs Newsworthy.ai Compare vs Octopus Deploy Compare vs 1099-Prep