Is this your company? Buyers are checking Crossmint here. Claim crossmint.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Crossmint
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
● Report dated Dec 2024
Crossmint is SOC 2 Type II compliant, with its most recent report dated Dec 2024. Crossmint also holds GDPR, and US Data Privacy.
About
An all-in-one platform for companies and agents: wallets, payments, tokenization, and more.
Compliance & infrastructure
Hosting
AWSGCPAzure
Documents
4Compliance leadership
The person who leads Crossmint's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Crossmint's penetration test vendor isn't listed yet.
Claim this profile to add it.
Listing history
- Listing information updated · by SOC2C
- Listing information updated · by SOC2C
- Listed on SOC2C
Recent updates
Crossmint DPF CertificationJul 2025
We’re proud to share that Crossmint, Inc. has successfully renewed its certification under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), including the UK Extension and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). You can view our current certification on the official DPF website: https://www.dataprivacyframework.gov/list (Search for “Crossmint, Inc.” to confirm our active status.) Crossmint undergoes this re-certification annually, as required by the U.S. Department of Commerce, to ensure continued compliance with the data protection standards governing the transfer of personal data from the European Union, United Kingdom, and Switzerland to the United States.
Crossmint’s Privacy CommitmentsJul 2025
At Crossmint, we’re committed to transparency and data protection. We’ve recently updated our Privacy Policy to reflect the expansion of our services and to ensure alignment with the EU-U.S. Data Privacy Framework (DPF). These updates clarify: - Our participation in the DPF and the enforcement role of the U.S. Federal Trade Commission (FTC) - How we handle personal data through trusted subprocessors (e.g., customer support platforms) - How we may use secure, governed AI tools to improve internal workflows—never to train third-party models You can always review how your data is collected, used, and protected by visiting our Privacy Policy. Have questions? Reach out to us at privacy@crossmint.com
Subscribe to Updates From Crossmint's Trust CenterJul 2025
You can now subscribe to updates from Crossmint's Trust Center to be notified of any updates to our contractual terms, managed vendors, compliance and security program.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- SubprocessorsList your subprocessors so buyers can assess fourth-party risk, the way your trust center does.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Crossmint SOC 2 compliant?
Crossmint is SOC 2 Type II compliant, with its most recent report dated Dec 2024. On SOC2C this listing is Listed.
Is Crossmint GDPR compliant?
According to Crossmint's public trust center, Crossmint is GDPR compliant. On SOC2C this listing is Listed.
Is Crossmint US Data Privacy compliant?
According to Crossmint's public trust center, Crossmint is US Data Privacy compliant. On SOC2C this listing is Listed.
Is Crossmint SOC 2 Type I or Type II?
Crossmint is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Crossmint's SOC 2 for a vendor risk assessment?
Yes. Crossmint's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Crossmint penetration tested?
Crossmint hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get Crossmint's SOC 2 report?
Crossmint's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Is Crossmint secure?
Security isn't a single yes/no, but Crossmint is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR, US Data Privacy. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Crossmint have a bug bounty or vulnerability disclosure program?
Crossmint hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@crossmint.com or via a /security page (Crossmint lists a security contact).
Who are Crossmint's subprocessors?
Crossmint's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.
Where does Crossmint host or store data?
Crossmint hosts on AWS, GCP, Azure. Data residency details are on its trust center.
Where is Crossmint's trust center or security page?
Crossmint's trust center is at https://trust.crossmint.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Crossmint
Reproduced from Crossmint's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
Is customer data encrypted?
Yes, Crossmint ensures that all customer data is encrypted both at rest and in transit. We utilize Advanced Encryption Standard (AES) for stored data and enforce Transport Layer Security (TLS) protocols for data transmitted over public networks. Our cryptographic controls adhere to industry standards, including NIST SP 800-57. Additionally, Crossmint has implemented a comprehensive Cryptography Policy that outlines our commitment to maintaining the confidentiality, integrity, and availability of customer data. This policy governs the selection, implementation, and management of cryptographic controls within our organization, ensuring that all encryption practices meet or exceed current industry standards.
Where is customer data stored?
Crossmint infrastructure is hosted in compliant data centers within the US and the EU. We leverage industry-standard cloud and database services, ensuring compliance with SOC 2, GDPR, and other industry-standard security measures.
Where can I find Crossmint's Data Processing Addendum?
Crossmint's Data Processing Addendum (DPA) can be found here. Crossmint's Data Processing Addendum is also available upon request. Please contact us at [legal@crossmint.com](mailto:legal@crossmint.com) to obtain a copy.
How does Crossmint review NFT collections?
Crossmint reviews NFT collections to ensure they comply with our Terms of Service, Content Policy, and regulatory requirements. Our Collection Review Process assesses: - Submission quality – Collections must include accurate details, social accounts, and project documentation. - Regulatory compliance – NFTs must not be structured as investment contracts under U.S. securities laws. - Prohibited content – Collections must not contain IP-infringing, deceptive, or restricted content (e.g., gambling, adult content). Collections that do not meet these standards may be rejected or disabled at Crossmint’s discretion. If a collection is rejected, users can submit an appeal within 7 days. For more details, refer to our Collection Review Guidelines.
When does Crossmint require KYC verification?
Crossmint requires Know Your Customer (KYC) verification in compliance with Anti-Money Laundering (AML) regulations. To complete KYC, users must provide a government-issued photo ID, proof of address, and a selfie.
How does Crossmint handle copyright infringement claims?
Crossmint respects intellectual property rights and has implemented a Copyright Notice and Takedown Procedure in compliance with the U.S. Digital Millennium Copyright Act (DMCA). If you believe your copyright has been infringed on our platform, you can submit a notice of infringement through our designated agent. Upon receiving a valid DMCA notice, Crossmint will: - Promptly remove or disable access to the allegedly infringing material. - Notify the user who posted the content and provide them an opportunity to submit a counter-notice if they believe the removal was in error. - Enforce a repeat infringer policy, which may result in account termination for multiple violations. For detailed instructions on submitting a copyright claim or counter-notice, visit our Crossmint Copyright Notice and Takedown Guidelines or contact [legal@crossmint.com](mailto:legal@crossmint.com) .
How does Crossmint leverage AI within the product?
At Crossmint, AI may be used by employees to enhance product development, optimize workflows, and improve internal processes. However, we do not train AI models on Customers or End Users data.
Does Crossmint conduct regular penetration testing and vulnerability scans?
Yes. We conduct internal security audits as well as third-party penetration tests regularly to proactively identify and mitigate potential risks. Our security framework includes continuous security monitoring, static code analysis, and dependency vulnerability scanning for our applications to detect and address threats in real-time. Critical vulnerabilities are prioritized and remediated within 24 hours.
Does Crossmint offer rewards for reporting security vulnerabilities?
Crossmint has a Vulnerability Reward Program to recognize and reward high-quality security reports. We actively encourage responsible disclosure of security issues, and security researchers or users can report vulnerabilities to [security@crossmint.com](mailto:security@crossmint.com) Our security team promptly investigates and addresses all valid reports. While not all reports are eligible for rewards, we appreciate contributions that help enhance our security. For more details, please refer to our Vulnerability Disclosure Policy.
Does Crossmint Meet SOC II Type 2 Standards?
Yes, Crossmint follows SOC II Type 2 security principles and undergoes independent audits to ensure compliance.
Does Crossmint perform independent security reviews and assessments?
Yes. We conduct independent security reviews and audits annually as part of our compliance framework.
How can I request a security review of Crossmint?
Users can request the necessary security and compliance documents through our Trust Page under the Resources section. Alternatively, they may contact us directly, providing details on the specific documentation required and the purpose of the request in [security@crossmint.com](mailto:security@crossmint.com) Our Security & Compliance team will respond with relevant security documentation and certifications.
Does Crossmint have controls in place to ensure email security?
Yes. We leverage Google Workspace for corporate email, implementing encryption with TLS while in transit.
Does Crossmint have a corporate security policy?
Yes. Our Human Resource Security Policy through our Trust Page under the Resources section or upon request through [security@crossmint.com](mailto:security@crossmint.com).
Does Crossmint have a dedicated security team?
Yes. Crossmint has a dedicated Risk and Security Operations Team responsible for protecting our systems, responding to security incidents, and ensuring general IT and legal compliance.
Does Crossmint perform background checks on employees?
Yes. All Crossmint employees undergo background checks before hire, including criminal history verification where legally permitted. To ensure a thorough and compliant process, we partner with Checkr, a trusted third-party provider specializing in background screenings.
Does Crossmint have an anti-virus solution in place?
Yes. All Crossmint devices run endpoint protection software with real-time malware scanning, behavior analysis, and threat detection. Suspicious files are quarantined automatically.
Does Crossmint perform regular vulnerability scanning?
Yes. Vulnerability assessments are conducted continuously. Critical vulnerabilities are remediated within 24 hours, and high-severity vulnerabilities within 5 working days.
What cloud infrastructure does Crossmint use?
Crossmint relies on industry-leading cloud infrastructure providers, including Google Cloud Platform (GCP) and Amazon Web Services (AWS) and Microsoft Azure for its cloud infrastructure, ensuring compliance with the highest security standards, with robust security controls, encryption, and continuous monitoring in place to protect customer data and maintain system integrity.
How does Crossmint handle data breaches?
Crossmint has a Cybersecurity Incident Response Plan (CIRP) to detect, contain, and remediate security incidents. In the event of a personal data breach, affected users will be notified within 72 hours as required under GDPR.
How does Crossmint ensure business continuity?
Crossmint maintains a Business Continuity Plan (BCP) to recover critical operations in the event of disruptions. Our cloud-based infrastructure and disaster recovery strategies ensure minimal service interruptions.
Retail & Commerce peers that completed SOC 2
Joshu Inc
joshuins.com · United States · Retail & Commerce
SOC 2 Type IIRenewal not public
Engine
engine.net · United States · Retail & Commerce
SOC 2 Type IIRenewal not public
Wrks
wrks.me · Retail & Commerce
SOC 2 Type IIRenewal not public
Clerk
clerk.io · European Union · Retail & Commerce
SOC 2 Type IIRenewal not public