Is Peppy Health secure?

Security isn't a single yes/no, but Peppy Health is SOC 2 compliant and holds ISO 27001, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Does Peppy Health have a bug bounty or vulnerability disclosure program?

Peppy Health hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@peppy.health or via a /security page (Peppy Health lists a security contact).

Who are Peppy Health's subprocessors?

Peppy Health lists 11 subprocessors on its trust center, including Google Cloud Platform, Mixpanel, Sentry, Customer.IO, Vanta. Buyers use this for fourth-party risk review.

Where is Peppy Health's trust center or security page?

Peppy Health's trust center is at https://trust.peppy.health. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Is this your company? Buyers are checking Peppy Health here. Claim peppy.health free to control the listing, earn the badge buyers trust, and see who's evaluating you.

Claim free

Peppy Health

Q: Where does Peppy Health host or store data?

Peppy Health hosts on GCP, and handles Customer personally identifiable information, Personal health information. Data residency details are on its trust center.

peppy.health · United Kingdom· 1–50 employees· Security contact

Security overview Compliance Penetration test

Trust level

Listed

Unverified

Listed

Domain

Report

Live

Sourced from public information. Not yet verified by the company.

Peppy Health is SOC 2 compliant. Peppy Health also holds ISO 27001, and GDPR.

Request report access Claim this profile

Framework

SOC 2

Auditor

Not publicAdd

Last report

—Add

Renewal

UnknownAdd

View official trust center ↗

About

Peppy Health is a trusted partner in personalised healthcare, offering secure and effective support to individuals and organisations alike. We prioritise the protection of your sensitive health information by adhering to the highest security standards and industry best practices. Our commitment to transparency, integrity, and data protection is demonstrated through the rigorous safeguards in place across all areas of our operations. We hope this trust centre provides clarity on our security practices, and we invite you to reach out with any questions using the contact information below.

Compliance & infrastructure

ISO 27001 GDPR

Hosting

GCP

Data handled

Customer personally identifiable informationPersonal health information

Documents

Penetration Testing Report Summary 2026Request

Subprocessors

G
Google Cloud Platform · Cloud provider
London, UK
M
Mixpanel · Data visualisation tool
GCP eu-west netherlands
S
Sentry · Cloud monitoring
USA
C
Customer.IO · CRM tool
AWS EU
V
Vanta · Security
United Kingdom
S
Sendbird · Customer messaging platform
AWS Frankfurt, Germany
T
Typeform · User Questionaires
AWS EU
S
Segment · Event tracking
AWS S3 Dublin
S
Semble · Clinical consultation and prescriptions
GCP London, UK
H
HubSpot · Marketing
AWS US East
L
Linear · Collaboration
US

Compliance leadership

The person who leads Peppy Health's SOC 2 isn't listed yet. Claim this profile to add it.

Penetration test

Unknown. Peppy Health's penetration test vendor isn't listed yet.

Claim this profile to add it.

Recent updates

Cyber Essentials PlusMay 2026

Peppy is please to annouce we have been renewed for our CyberEssentials Plus cerifitcation for 2026. Our latest certificate has been added to our Trust Centre

CyberEssentialsApr 2026

Peppy is please to annouce we have been renewed for our CyberEssentials cerifitcation for 2026. Our latest certificate has been added to our Trust Centre

CyberEssentials and CyberEssentials PlusMar 2026

Peppy is currently going through renewal audits for both of these frameworks and will update our Trust Center with the new certificates as soon as they are issued.

This listing is partial

7/11 details · 64%

SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.

Auditorraises trust
Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
Report dateraises trust
Add your most recent report period so buyers see how current your SOC 2 is.
Renewal date
Add your renewal window so buyers know your coverage is active.
Security controls
Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.

Claim free to control your listing

Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.

Frequently asked

Is Peppy Health SOC 2 compliant?

Peppy Health is SOC 2 compliant. On SOC2C this listing is Listed.

Is Peppy Health ISO 27001 certified?

According to Peppy Health's public trust center, Peppy Health is ISO 27001 certified. On SOC2C this listing is Listed.

Is Peppy Health GDPR compliant?

According to Peppy Health's public trust center, Peppy Health is GDPR compliant. On SOC2C this listing is Listed.

Can I use Peppy Health's SOC 2 for a vendor risk assessment?

Yes. Peppy Health's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Is Peppy Health penetration tested?

Peppy Health hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Show 5 more questions

Answers published by Peppy Health

Reproduced from Peppy Health's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗

Do you encrypt data at rest?

Yes, our data is stored within our Google Cloud instance and use AES-256 for our data encryption.

Do you support Single Sign-On (SSO)?

For our clinical product we don't support SSO. As the product is intended for personal use away from an employers system we have deliberately chosen the option for end users to select a personal email address and password for account creation.

Where are your servers located?

We use cloud servers through Google Cloud to store our data. That data is located in their London, UK cluster.

Which contract terms apply to my order?

Where your Order Form includes a link which brings you to Vanta, the Customer Subscription Terms, Data Protection Terms and the Information Security Terms apply regardless of the Peppy Service included in your Order Form. However, depending on the Peppy Services included in the Order Form, the following additional terms will also apply to your contract with us: - If your Order Form is for Peppy Clinical Services then you should also read the "Peppy Clinical Services - Service Specific Terms and Conditions" - If your Order Form is for Peppy Global Services then you should also read the "Peppy Global Services - Service Specific Terms and Conditions"

If I want to suggest changes to the Peppy terms, how can I do this?

We strongly encourage no/minimal mark up to our terms and conditions as we feel that they already provide a very balanced document which has been agreed with numerous customers. However, if you require any changes to our terms and conditions, we ask that you include these as "Special Conditions" in the Order Form.

Is Peppy compliant with the relevant data protection laws?

Peppy adheres to all applicable data protection legislation in its operating jurisdictions, including: - EU General Data Protection Regulation (GDPR); - UK Data Protection Act 2018; - Health Insurance Portability and Accountability Act (HIPPA); - California Consumer Privacy Act (CCPA); and - All other applicable US state privacy laws We have comprehensive policies and procedures in place to ensure ongoing compliance with these regulations, including regular audits and assessments. Full details regarding how and why we process personal data are available in our privacy policy on the company website.

When is Peppy a Data Controller/Data Processor under GDPR?

Data Controller Peppy acts as a Data Controller (within the meaning of applicable data protection legislation in the UK/EU) when collecting data shared directly from end users. This means that Peppy determines the purposes and means of collecting personal data and takes ultimate legal responsibility for processing this data. Data Processor Peppy shall only act as a Data Processor (within the meaning of applicable data protection legislation in the UK/EU) when it has been specifically included within a legal contract between Peppy and a customer. But, this is not standard in our UK customer agreements. In this scenario, the customer is the Data Controller and Peppy is the Data Processor of such data and the relevant data processing clauses would be added to the contract between Peppy and the customer.

Where does Peppy host and store personal data?

Personal data for end users who reside in North, South and Central America is hosted and stored in the USA by our hosting provider,Google Cloud Platform. Personal data for end users who reside anywhere else in the world (excluding North, South and Central America) is hosted and stored in the UK with our hosting provider, Google Cloud Platform, in its London datacentre. Peppy maintains strict data segregation and does not co-mingle end user data between its US and UK hosted locations.

Is end user data transferred outside the UK or EU?

End user personal data is transferred to a select number of trusted providers that are essential for service delivery. Peppy undertakes thorough risk or impact assessments as appropriate in connection with such transfers to third party vendors. We only use lawful mechanisms to transfer such data such as the Standard Contractual Clauses approved by the European Data Protection Board as in force from time to time, and the UK ICO addendum.

What sensitive (special category) personal data does Peppy process?

Peppy may process a variety of health data in order to provide the services. Health data is primarily processed on the basis of explicit consent. In some cases it may be necessary to process health data on the basis of necessity for the provision of medical care or safeguarding purposes, in accordance with UK GDPR. Peppy may also process ethnicity data for research purposes. Full details of Peppy’s data processing are set out in our Privacy Policy (https://peppy.health/privacy-policy/).

Does Peppy notify customers in the event of a data breach?

As a Data Controller: - We will notify affected individuals directly within 72 hours of becoming aware of a breach; - We will notify customers in accordance with any contractual specifications; and - We will notify relevant supervisory authorities as required by law. As a Data Processer: - We will notify the customer (as Data Controller) upon becoming aware of a breach; and - We will provide the customer with all necessary information to assist with their investigation and meet their regulatory obligations.

Is Peppy insured for data breaches or loss of data?

Peppy has insurance with first party cyber coverage as well as third party indemnity coverage. Further details on our policy coverage are available upon request.

Show 7 more questions

Healthcare peers that completed SOC 2

Compare vs Ambiencehealthcare Compare vs Elfie Compare vs Vitablehealth