Can I use The Predictive Index's SOC 2 for a vendor risk assessment?

Yes. The Predictive Index's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Is The Predictive Index penetration tested?

The Predictive Index hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Is The Predictive Index secure?

Security isn't a single yes/no, but The Predictive Index is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, PCI DSS, NIST CSF. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Does The Predictive Index have a bug bounty or vulnerability disclosure program?

The Predictive Index hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@predictiveindex.com or via a /security page.

Who are The Predictive Index's subprocessors?

The Predictive Index lists 30 subprocessors on its trust center, including Auth0, CircleCI, ChurnZero, Datadog, Domo. Buyers use this for fourth-party risk review.

Where does The Predictive Index host or store data?

The Predictive Index hosts on Azure. Data residency details are on its trust center.

Where is The Predictive Index's trust center or security page?

The Predictive Index's trust center is at https://trust.predictiveindex.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Is this your company? Buyers are checking The Predictive Index here. Claim predictiveindex.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.

Claim free

The Predictive Index

predictiveindex.com · United States

Security overview Compliance Penetration test

Trust level

Listed

Unverified

Listed

Domain

Report

Live

Sourced from public information. Not yet verified by the company.

The Predictive Index is SOC 2 Type II compliant. The Predictive Index also holds ISO 27001, PCI DSS, and NIST CSF.

Request report access Claim this profile

Framework

Auditor

Last report

Renewal

View official trust center ↗

About

The Predictive Index (PI) is the data-driven HR platform used to hire top performers, develop effective managers, and retain your people. More than 65 years of proven science, software, and a curriculum of insightful management workshops make PI the solution for any company looking to design great teams and culture, make objective hiring decisions, foster engagement, and inspire greatness in their people anywhere in the world. More than 10,000 clients and 480+ partners use PI across 90+ countries. Access to the Trust Center is available exclusively to our existing and prospective customers. If

Compliance & infrastructure

ISO 27001 SOC 2 Type II PCI DSSNIST CSF

Hosting

Azure

Subprocessors

A
Auth0 · Identity Management
USA
C
CircleCI · Continuous Integration Tool
USA
C
ChurnZero · Customer Communication Platform
USA
D
Datadog · Application Performance Monitoring
USA
D
Domo · Product Analytics
USA
G
GitHub · Continuous Integration Tool
USA
G
Gong.io · Sales prospect communication & recordings (client optional)
USA
G
Google Workspace · Communication
USA
H
Hubspot · Marketing Automation Platform
USA
I
Intercom · Customer Communication Platform
USA
K
Knock · Notification Infrastructure
USA
L
Launchdarkly · Feature flagging
USA

Show all 30 subprocessors

L
Leandata · CRM Tool
USA
L
LogRocket · Product Analytics and Customer Support
USA
M
Merg · Integration Services
USA
M
Microsoft Azure · Data Hosting
USA
O
Outreach · Sales engagement platform
USA
P
Pendo · Product Analytics
USA
Q
Qualified · Live Chat
USA
R
Recall · AI tool used for Notetaker application
USA
S
Salesforce · CRM Platform
USA
S
SendGrid · Email
USA
S
Slack · Client Support
USA
S
Snowflake · Data warehouse
USA
S
Sumo Logic · Security Monitoring and Analysis
USA
S
Survey Monkey · Survey
USA
W
WorkOS · Identity Management for PI Perform
USA
Z
Zoominfo · Business Intelligence Platform
USA
S
Scribe · AI Tool used for internal documentation and training
USA
C
Claude · AI Tool used for internal productivity & analytics
USA

Compliance leadership

The person who leads The Predictive Index's SOC 2 isn't listed yet. Claim this profile to add it.

Penetration test

Unknown. The Predictive Index's penetration test vendor isn't listed yet.

Claim this profile to add it.

Recent updates

Security Update – Drift/Salesforce Integration and Your Data with PIAug 2025

Our internal team was notified on August 25, 2025 that Salesforce detected unusual activity on our account via a third-party application, Drift (owned by Salesloft). We immediately initiated our incident response protocol, which included isolating the affected systems and engaging our Security and Legal teams to conduct a thorough investigation. We have since successfully contained the threat and ensured all of our services are fully & safely operational. The investigation revealed that an unauthorized party gained access through a third-party application we no longer utilize, to a limited portion of our systems between August 12 and August 17, 2025. The information involved in the incident is limited to information for those who have submitted cases themselves, or on behalf of clients of PI, and may contain: - Full Name - Email - Business Name - Phone Number For any questions or concerns, please contact us directly at our support form for this issue: Contact Us.

ISO 27001:2022 and SOC 2 updatesNov 2024

We are thrilled to announce that Predictive Index (PI) has successfully achieved ISO 27001:2022 and SOC 2 certifications, underscoring our unwavering commitment to the highest standards in information security and data protection. Why This Matters ISO 27001:2022 is an internationally recognized standard for information security management systems, and achieving this certification validates that PI meets stringent criteria for protecting and managing sensitive information. SOC 2 certification further ensures that we adhere to rigorous controls around data security, confidentiality, and availability. --- What This Means for You These certifications affirm PI's dedication to safeguarding your data and maintaining robust security practices at every level of our organization. From secure data encryption to comprehensive access controls and incident management protocols, our approach to security has been thoroughly vetted to give you confidence in the resilience and reliability of our services. --- Our Commitment to Trust and Transparency At PI, trust and transparency form the foundation of our relationships with clients, partners, and stakeholders. We will continue to uphold these values by constantly refining our security practices, investing in cutting-edge technologies, and fostering a culture of security-first principles. Thank you for your ongoing trust in PI. We look forward…

This listing is partial

6/11 details · 55%

SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.

Auditorraises trust
Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
Report dateraises trust
Add your most recent report period so buyers see how current your SOC 2 is.
Renewal date
Add your renewal window so buyers know your coverage is active.
Documents
List the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
Security controls
Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.

Claim free to control your listing

Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.

Frequently asked

Is The Predictive Index SOC 2 compliant?

The Predictive Index is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Is The Predictive Index ISO 27001 certified?

According to The Predictive Index's public trust center, The Predictive Index is ISO 27001 certified. On SOC2C this listing is Listed.

Is The Predictive Index PCI DSS compliant?

According to The Predictive Index's public trust center, The Predictive Index is PCI DSS compliant. On SOC2C this listing is Listed.

Is The Predictive Index NIST CSF compliant?

According to The Predictive Index's public trust center, The Predictive Index is NIST CSF compliant. On SOC2C this listing is Listed.

Is The Predictive Index SOC 2 Type I or Type II?

The Predictive Index is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Show 7 more questions

Answers published by The Predictive Index

Reproduced from The Predictive Index's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗

Do you provide a public status page that displays real-time and historical uptime information for your services?

https://status.predictiveindex.com

Do you encrypt data at rest?

Yes. We have strong encryption for the data at rest (while it is stored) and in transit (while it is being transmitted). Our production assets only allow TLS 1.3 or above. The access to the stored customer data is on a Need to Know basis. Typical personnel who are authorized to access are Customer Support and Engineering Developers while troubleshooting issues and DevOps personnel for deploying services.

Where are your servers located?

The Predictive Index servers are hosted on Microsoft Azure in the eastern USA.

I found a security bug. Do you have an established bug bounty program?

Please visit this page for more information: https://www.predictiveindex.com/security/responsible-disclosure/ Please submit your findings to (vulns@predictiveindex.com) and include the following: 1. Location of the vulnerability. 2. Full description of the vulnerability being reported, including exploitability and impact. 3. Steps to replicate the vulnerability. 4. Supporting evidence such as screenshots, traffic logs, requests and responses. Please keep information about the vulnerability confidential until we review and resolve the issue. The timeframe for resolution depends on factors such as the severity, exploitability, and impact of the vulnerability, and the complexity of the solution. We will confirm the expected timeframe for resolution with you following the disclosure of the vulnerability.

Do you support Single Sign-On (SSO)?

SSO is a high priority for future inclusion but not yet supported. For authentication, the web application uses Oauth 2.0 by Auth0 and is managed by our software engineers. Our software supports MFA, and SSO is on our roadmap. More information can be found here: - https://docs.predictiveindex.com/admin-guide/account-creation/single-sign-on-sso/ - https://www.predictiveindex.com/learn/support/multi-factor-authentication/

What Security settings are available?

Security settings include Role-Based Access Control, encryption, firewalls, multifactor authentication, and regular reviews. We have strong security controls in the product, including Role-Based Access Control (RBAC), Data Segregation, Data Anonymization, and Login Attack Protection. PI application’s RBAC has six different user roles, helping ensure that our customers have the ability to provide their users the right level of access. The PI RBAC also has a role for 3rd party users, enabling our customers to securely share data with consultants. Our data segregation features provide the ability to restrict access to the data within the application. This enables our customers to segregate data, for instance, by organizational unit or geographical location, so that only users that are responsible for those organizational units or geographical locations could be provided access to the data. We utilize industry-leading Auth0 as the identity and access management partner in our product. User logins into our application are secured by Auth0. Our product utilizes the Auth0 attack protection features in order to prevent malicious activities such as brute-forcing.

Could you provide an attestation or summary of your most recent penetration test, including the scope of the assessment and confirmation that any identified vulnerabilities have been addressed?

We prioritize the security of our systems and data by conducting annual penetration tests through reputable third-party security firms. These assessments are comprehensive and designed to identify vulnerabilities that could impact our security posture. While we do not publicly disclose the detailed results of these penetration tests to maintain security integrity, we undergo annual security compliance audits. During these audits, independent third-party auditors verify that thorough testing is conducted and that any identified findings are promptly addressed. This process ensures that our security measures are not only effective but also continuously improved upon.

What categories of personal data does Predictive Index collect from its customers and users?

Our Services Privacy Policy provides a detailed chart describing the types of personal data we collect from our customers and users. The policy also explains the purposes for which we collect the data and how it may be shared with third parties. For a comprehensive understanding of how we handle personal data, we encourage you to review the entire policy. If you have any questions or require further clarification, please feel free to contact us at [privacy@predictiveindex.com](mailto:privacy@predictiveindex.com).

Show 3 more questions

Business & Industrial peers that completed SOC 2

Compare vs Newsworthy.ai Compare vs Octopus Deploy Compare vs 1099-Prep