Security isn't a single yes/no, but Ibotta is SOC 2 Type II compliant and holds SOC 2 Type II, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Does Ibotta have a bug bounty or vulnerability disclosure program?

Ibotta hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@ibotta.com or via a /security page (Ibotta lists a security contact).

Who are Ibotta's subprocessors?

Ibotta lists 1 subprocessor on its trust center, including Amazon Web Services (AWS). Buyers use this for fourth-party risk review.

Where does Ibotta host or store data?

Ibotta hosts on AWS, and handles Credit card information, Anonymized Customer Information. Data residency details are on its trust center.

Where is Ibotta's trust center or security page?

Ibotta's trust center is at https://trust.ibotta.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Is this your company? Buyers are checking Ibotta here. Claim ibotta.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.

Claim free

Ibotta

ibotta.com · United States· 51–200 employees· Security contact

Security overview Compliance Penetration test

Trust level

Listed

Unverified

Listed

Domain

Report

Live

Sourced from public information. Not yet verified by the company.

Ibotta is SOC 2 Type II compliant. Ibotta also holds CCPA.

Request report access Claim this profile

Framework

Auditor

Last report

Renewal

View official trust center ↗

About

Founded in 2012, Ibotta is a leading performance marketing platform allowing brands to deliver digital promotions to over 200 million consumers through a network of publishers called the Ibotta Performance Network (IPN). The IPN allows marketers to influence what people buy, and where and how often they shop – all while paying only when their campaigns directly result in a sale. [Terms of Use](https://legal.ibotta.com/policies?name=ibotta-terms-of-use) [Bug Bounty Program](https://bugcrowd.com/ibotta?preview=c79530ac3115197a881cd0d63f040804)

Compliance & infrastructure

SOC 2 Type IICCPA

Hosting

AWS

Data handled

Credit card informationAnonymized Customer Information

Subprocessors

A
Amazon Web Services (AWS) · Cloud provider
US

Compliance leadership

The person who leads Ibotta's SOC 2 isn't listed yet. Claim this profile to add it.

Penetration test

Unknown. Ibotta's penetration test vendor isn't listed yet.

Claim this profile to add it.

Recent updates

2025 - SOC 2 Type 2 ReportNov 2025

Ibotta's updated SOC 2 Type 2 report will be uploaded to the Trust Center once delivered by our auditor (mid-December).

This listing is partial

6/11 details · 55%

SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.

Auditorraises trust
Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
Report dateraises trust
Add your most recent report period so buyers see how current your SOC 2 is.
Renewal date
Add your renewal window so buyers know your coverage is active.
Documents
List the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
Security controls
Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.

Claim free to control your listing

Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.

Frequently asked

Is Ibotta SOC 2 compliant?

Ibotta is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Is Ibotta CCPA compliant?

According to Ibotta's public trust center, Ibotta is CCPA compliant. On SOC2C this listing is Listed.

Is Ibotta SOC 2 Type I or Type II?

Ibotta is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Can I use Ibotta's SOC 2 for a vendor risk assessment?

Yes. Ibotta's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Is Ibotta penetration tested?

Ibotta hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Show 5 more questions

Answers published by Ibotta

Reproduced from Ibotta's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗

How can I disclose a security vulnerability to Ibotta?

We recognize the important role of security researchers in helping keep our community safe. If you believe you’ve discovered a bug in Ibotta’s security, please let us know as soon as possible via our bug bounty program our security team will rapidly investigate and respond as quickly as possible to your report. Note that this program is for software security researchers only. If you have a question or issue with your account, please contact Ibotta Care.

Does Ibotta support multi-factor authentication (MFA)?

Yes, Ibotta utilizes multi-factor authentication via integration with single sign-on through the organization’s cloud identity provider to verify customer's access to the platform as well as for its employees to access Ibotta's organization tools.

Is Ibotta self-hosted, or hosted in the cloud?

Ibotta is hosted in the cloud, we utilize AWS availability zones for production infrastructure to ensure geographic distribution of redundant resources.

Is customer data encrypted?

Yes, Ibotta encrypts customer data at rest and in transit. This is part of one of our principal service commitments.

What security policies does Ibotta have in place?

- Data Classification & Inventory of Data Assets Policy - Acceptable Use Policy - Access Control Policy - Account Management Policy - System Security Audit Policy - System and Secure Communications Policy - Identification and Authentication Policy - Incident Response Planning Policy - Business Continuity and Disaster Recovery Planning Policy - Security Awareness and Training Policy - Data Security Retention and Sanitization Policy - Physical Security Policy - Asset Management Policy - System Privacy Policy - Risk Management Policy - Vendor Security Management Policy - Vulnerability Management Policy - Change Management Policy - AI Acceptable Use Policy

Show 3 more questions

Business & Industrial peers that completed SOC 2

Compare vs Newsworthy.ai Compare vs Octopus Deploy Compare vs 1099-Prep