Netlify: Trust page changed

Trust / securityChanged (not classified) (rule)Changed 2026-11-07 08:45 UTCwww.netlify.com

Summary

Netlify’s Trust page removed listings for several security certifications, compliance frameworks, penetration testing, and its Data Processing Addendum. Customers evaluating compliance requirements now have less information on this page; the removals do not establish that the underlying certifications, safeguards, or terms changed.

Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.

What changed

~~Struck in red~~ is what Netlify removed; blue is what they added. Muted text is unchanged context.

Removed#1

…Netlify is reviewed and trusted by Compliance programs SOC 2 Type II Independent audit of our security, availability, and confidentiality controls. ISO/IEC 27001 Certified information security management system. ISO/IEC 27018:2019 Certified controls for protecting personal data in public cloud services. Penetration Test Regular third-party penetration testing of our platform. PCI DSS Compliance with the Payment Card Industry Data Security Standard. PCI DSS v4.0.0 Compliance with version 4.0.0 of the Payment Card Industry Data Security Standard. GDPR Aligned with the EU General Data Protection…

…Netlify is reviewed and trusted by Compliance programs removed GDPR Aligned with the EU General Data Protection…

Removed#2

…Aligned with the EU General Data Protection Regulation. CCPA Aligned with the California Consumer Privacy Act. HIPAA Safeguards for handling protected health information. DORA Aligned with the EU Digital Operational Resilience Act. Data Processing Addendum GDPR-aligned data processing terms available to customers. EU-US Data Privacy Framework Certified participant in the EU-US Data Privacy Framework. Swiss-US Data Privacy Framework Certified participant in the Swiss-US Data Privacy Framework. VPAT Accessibility conformance reported in a Voluntary Product Accessibility Template. Document inventory Security and compliance reports, policies, and…

…Aligned with the EU General Data Protection Regulation. removed Document inventory Security and compliance reports, policies, and…

Compared with the previous archived version (#15386 to #16987). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).

Archive proof

Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Nov 5
Before captured 08:45 UTC
In the 2026-11-05 checkpoint, timestamped by FreeTSA and DigiCert on Nov 6, 00:44 UTC. Record hash 67e411cd39095774…
Download proof
Nov 7
After captured 08:45 UTC
In the 2026-11-07 checkpoint, timestamped by FreeTSA and DigiCert on Nov 8, 00:41 UTC. Record hash eef3587c9b6ac946…
Download proof

History of this page

Saturday, November 7

1 page change

Content changed
08:45Page change
Trust pagechangedthis change
Netlify’s Trust page removed listings for several security certifications, compliance frameworks, penetration testing, and its Data Processing Addendum. Customers evaluating compliance requirements now have less information on this page; the removals do not establish that the underlying certifications, safeguards, or terms changed.

Thursday, November 5

1 page change

Content changed
08:45Page change
Trust pagechanged
Netlify’s Trust page added ten repeated “Access on request” entries in its document-sharing section. The diff identifies no specific new documents or changed access terms, so this appears to be a display-only update.

Thursday, October 29

1 page change

Content changed
08:44Page change
Trust pagechanged
Netlify’s Trust page added compliance disclosures covering SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27018:2019, PCI DSS, privacy frameworks, and other regulatory safeguards. It also lists HECVAT415 as available on request, giving customers another document to request during security and compliance reviews.

Saturday, October 24

1 page change

Content changed
08:45Page change
Trust pagechanged
Netlify’s Trust page replaced its SOC 2 Type II independent-audit statement with a GDPR alignment statement. The page no longer displays that audit description in this section; this does not establish that Netlify’s certification or compliance status changed.

Thursday, October 22

1 page change

Content changed
08:44Page change
Trust pagechanged
Netlify’s trust page removed references to ISO/IEC 27001, ISO/IEC 27018:2019, third-party penetration testing, PCI DSS, PCI DSS v4.0.0 and GDPR alignment. Customers reviewing security and compliance have less information on this page; the removal does not establish that the underlying certifications or practices changed.

Monday, October 19

1 page change

Content changed
08:45Page change
Trust pagechanged
Netlify’s Trust page added request-only access to “PCI-DSS-v4.0.1-AOC-SAQ-D-SP-” and “PCI DSS v4.0.1 Responsibility Matrix,” giving customers additional PCI DSS documentation to request for compliance reviews.

Cite this

Trust page changed on Netlify’s Trust page, changed 2026-11-07 08:45 UTC (change 6 of 6).

Title: Trust page changed
Vendor: Netlify
Date: 2026-11-07 08:45 UTC
URL: https://rewindex.com/change/p16987

All Netlify changes Netlify profile Markdown JSON