Question 1

Is Pendo SOC 2 compliant?

Accepted Answer

Pendo is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Pendo PCI DSS compliant?

Accepted Answer

According to Pendo's public trust center, Pendo is PCI DSS compliant. On SOC2C this listing is Listed.

Question 3

Is Pendo HIPAA compliant?

Accepted Answer

According to Pendo's public trust center, Pendo is HIPAA compliant. On SOC2C this listing is Listed.

Question 4

Is Pendo GDPR compliant?

Accepted Answer

According to Pendo's public trust center, Pendo is GDPR compliant. On SOC2C this listing is Listed.

Question 5

Is Pendo CCPA compliant?

Accepted Answer

According to Pendo's public trust center, Pendo is CCPA compliant. On SOC2C this listing is Listed.

Question 6

Is Pendo SOC 2 Type I or Type II?

Accepted Answer

Pendo is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 7

Can I use Pendo's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Pendo's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 8

Is Pendo penetration tested?

Accepted Answer

Pendo hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 9

Is Pendo secure?

Accepted Answer

Security isn't a single yes/no, but Pendo is SOC 2 Type II compliant and holds SOC 2 Type II, PCI DSS, HIPAA, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 10

Does Pendo have a bug bounty or vulnerability disclosure program?

Accepted Answer

Pendo hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@pendo.io or via a /security page.

Question 11

Who are Pendo's subprocessors?

Accepted Answer

Pendo lists 10 subprocessors on its trust center, including Google Cloud Platform, Amazon Web Services, OpenAI, Elastic.co, Core10. Buyers use this for fourth-party risk review.

Question 12

Where does Pendo host or store data?

Accepted Answer

Pendo hosts on AWS, GCP, Azure. Data residency details are on its trust center.

Question 13

Where is Pendo's trust center or security page?

Accepted Answer

Pendo's trust center is at https://ja.trust.pendo.io;trust.pendo.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 14

Does Pendo incorporate Artificial Intelligence (AI) into any of its functionality?

Accepted Answer

Yes. Some key things to note: * You are able to choose if and when you make use of any of Pendo’s AI-powered functionality. * We don’t train models that run across all of our customers’ data. * Our AI principles reflect our commitment to innovation and the safe, responsible, and ethical use of artificial intelligence with the Pendo Platform. For additional details please see Artificial intelligence (AI) at Pendo.

Question 15

Does Pendo support single sign on and/or 2-factor authentication?

Accepted Answer

You are in control of and responsible for user authentication. Access to Pendo requires an email address and password combination. We encourage you to use strong passwords. Alternatively, depending on your plan level, you can choose SAML for single sign-on or Google-based logins. Administrators can disable password-based logins, and require authentication through Google. Authentication through Google supports two factor authentication, as do many SAML implementations.

Question 16

Does Pendo conduct security audits?

Accepted Answer

Pendo undergoes third-party penetration testing on an annual basis.

Question 17

Will Pendo slow down my application?

Accepted Answer

Pendo is designed to minimize the impact on your application. The client-side agent is only about 50 Kb and loads asynchronously. Data transmissions are queued and sent to the server every 2 minutes. Data is compressed before sending so that each transmission is less than 2 Kb.

Question 18

How is the client agent distributed?

Accepted Answer

The JavaScript code is hosted and deployed in Amazon’s Cloudfront Content Distribution Network (CDN), with an extremely broad network of servers and edge caching to ensure rapid loading times. Amazon service level agreements guarantee 99.9% uptime for the agent delivery.

Question 19

How will guides and walk-throughs affect my application?

Accepted Answer

Guides load with the Pendo agent. They will not be displayed until the current page is finished loading. The typical response time for guides is sub-second with guides almost always delivered in less than half a second.

Question 20

Does Pendo act in accordance with the General Data Protection Regulation (GDPR)?

Accepted Answer

While there is no 3rd-party verified certification for GDPR compliance, Pendo is committed to acting in accordance with the GDPR for all of our users - not just those in the EU. We are partnering with our customers to ensure the privacy and security of their and their customer’s data, and have implemented a number of data acquisition, access, and retention policy changes. See this article for additional detail about our GDPR support.

Question 21

Does Pendo have a Bug Bounty program?

Accepted Answer

Yes. Pendo has a Private Bug Bounty program. In the future we may consider making this a public program.

Question 22

Does Pendo collect any personally identifying information?

Accepted Answer

The only identifying information that Pendo requires is a unique user ID for your end users. All other information is optional (but will provide for richer analysis and segmentation). Pendo does not collect any user-entered form field text in your application. You should avoid sending any of the following types of sensitive personal information to Pendo: government-issued identification numbers; specific financial information (such as credit or debit card numbers, any related security codes or passwords, and bank account numbers); information related to an individual’s physical or mental health; and information related to the provision or payment of health care.

Question 23

How long does Pendo store customer information?

Accepted Answer

Pendo retains all customer data as long as you are an active subscriber, up to a maximum of 7 years. Customers can also request that their Pendo subscriptions be configured for retention periods shorter than 7 years. When a customer terminates their contract with Pendo, all customer data will be removed starting 90 days after a subscription is cancelled. Pendo customers can request that specific records in their data be removed based on the request of an individual who is the subject of that data. Specific record removal may incur additional charges depending on your plan level.

Question 24

Is the data encrypted?

Accepted Answer

All data hosted by Pendo is encrypted. Pendo uses industry-accepted encryption products to protect data at rest, with 256 bit AES encryption. All data transfers within the data center are secured by TLS 1.2/1.3. All of the Customer Data collected by Pendo is transmitted over TLS 1.2/1.3 if the customer application is accessed via TLS.

Question 25

Where does Pendo store data?

Accepted Answer

Data submitted to Pendo, and Pendo’s application, are processed and stored in a secure, multi-tenant environment provided by Google’s Cloud Platform. All data storage is encrypted by default, and a variety of logical segregation techniques are used to prevent one customer from accessing another customer’s data. Customers can choose between having their data hosted in Google’s data center facilities in either the United States, European Union, Japan, or Australia. For the most up-to-date information, refer to https://support.pendo.io/hc/en-us/articles/22832528657179-Global-data-hosting

Pendo

About

Compliance & infrastructure

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Business & Industrial peers that completed SOC 2

Newsworthy.ai

1099-Prep

Octopus Deploy

Ask Ai