Is this your company? Buyers are checking Ibotta here. Claim ibotta.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Ibotta
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Ibotta is SOC 2 Type II compliant. Ibotta also holds CCPA.
About
Founded in 2012, Ibotta is a leading performance marketing platform allowing brands to deliver digital promotions to over 200 million consumers through a network of publishers called the Ibotta Performance Network (IPN). The IPN allows marketers to influence what people buy, and where and how often they shop – all while paying only when their campaigns directly result in a sale. [Terms of Use](https://legal.ibotta.com/policies?name=ibotta-terms-of-use) [Bug Bounty Program](https://bugcrowd.com/ibotta?preview=c79530ac3115197a881cd0d63f040804)
Compliance & infrastructure
SOC 2 Type IICCPA
Hosting
AWS
Data handled
Credit card informationAnonymized Customer Information
Subprocessors
1- AAmazon Web Services (AWS) · Cloud providerUS
Compliance leadership
The person who leads Ibotta's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Ibotta's penetration test vendor isn't listed yet.
Claim this profile to add it.
Recent updates
2025 - SOC 2 Type 2 ReportNov 2025
Ibotta's updated SOC 2 Type 2 report will be uploaded to the Trust Center once delivered by our auditor (mid-December).
This listing is partial
6/11 details · 55%SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Ibotta SOC 2 compliant?
Ibotta is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Ibotta CCPA compliant?
According to Ibotta's public trust center, Ibotta is CCPA compliant. On SOC2C this listing is Listed.
Is Ibotta SOC 2 Type I or Type II?
Ibotta is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Ibotta's SOC 2 for a vendor risk assessment?
Yes. Ibotta's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Ibotta penetration tested?
Ibotta hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Ibotta secure?
Security isn't a single yes/no, but Ibotta is SOC 2 Type II compliant and holds SOC 2 Type II, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Ibotta have a bug bounty or vulnerability disclosure program?
Ibotta hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@ibotta.com or via a /security page (Ibotta lists a security contact).
Who are Ibotta's subprocessors?
Ibotta lists 1 subprocessor on its trust center, including Amazon Web Services (AWS). Buyers use this for fourth-party risk review.
Where does Ibotta host or store data?
Ibotta hosts on AWS, and handles Credit card information, Anonymized Customer Information. Data residency details are on its trust center.
Where is Ibotta's trust center or security page?
Ibotta's trust center is at https://trust.ibotta.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
How can I disclose a security vulnerability to Ibotta?
We recognize the important role of security researchers in helping keep our community safe. If you believe you’ve discovered a bug in Ibotta’s security, please let us know as soon as possible via our bug bounty program our security team will rapidly investigate and respond as quickly as possible to your report. Note that this program is for software security researchers only. If you have a question or issue with your account, please contact Ibotta Care.
Does Ibotta support multi-factor authentication (MFA)?
Yes, Ibotta utilizes multi-factor authentication via integration with single sign-on through the organization’s cloud identity provider to verify customer's access to the platform as well as for its employees to access Ibotta's organization tools.
Is Ibotta self-hosted, or hosted in the cloud?
Ibotta is hosted in the cloud, we utilize AWS availability zones for production infrastructure to ensure geographic distribution of redundant resources.
Is customer data encrypted?
Yes, Ibotta encrypts customer data at rest and in transit. This is part of one of our principal service commitments.
What security policies does Ibotta have in place?
- Data Classification & Inventory of Data Assets Policy - Acceptable Use Policy - Access Control Policy - Account Management Policy - System Security Audit Policy - System and Secure Communications Policy - Identification and Authentication Policy - Incident Response Planning Policy - Business Continuity and Disaster Recovery Planning Policy - Security Awareness and Training Policy - Data Security Retention and Sanitization Policy - Physical Security Policy - Asset Management Policy - System Privacy Policy - Risk Management Policy - Vendor Security Management Policy - Vulnerability Management Policy - Change Management Policy - AI Acceptable Use Policy
Is Ibotta international?
The Services are hosted in the United States and Puerto Rico and are intended only for users located in those areas.
How can we help?
If you have questions about how Ibotta works, troubleshooting tips, referrals, bonuses and other topics for savers, please go to our Help Center page
How do we manage your personal information?
Please visit our Personal Information Management page for more details!
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public