Trust Center
Overview
Welcome to Hootsuite's Trust Center. Our commitment to data privacy and security is embedded in every part of our business.
Our Information Security Management System and program is aligned with the NIST Cybersecurity Framework (CSF), and Hootsuite has a comprehensive suite of security policies based on NIST CSF, NIST 800-53, ISO 27001, SOC 2 Trust Services Criteria, FedRAMP, and GDPR. The security policies are grounded in the key principles of least privilege, need-to-know, least functionality, and segregation of duties, and govern facility, system, and data access. The policies are reviewed and approved by senior management, reviewed by our external auditors, and reviewed annually and updated as required. Our independent annual SOC 2 audit report and FedRAMP certification provide details on our ISMS and its relationship with the various standards.
Use this portal to learn about our security and privacy posture and request access to our security documentation.
Compliance
Hootsuite is reviewed and trusted by
Documents
Risk Profile
Product Security
Reports
Self-Assessments
Data Security
App Security
Legal
Data Privacy
Access Control
Infrastructure
Endpoint Security
Network Security
Corporate Security
Policies
Security Grades
Trust Center Updates
Hootsuite's third party led 2023 Penetration Test Summary Letters are now available for your review. Please check out the Documents section of the Trust Center to review and download as needed for your records.
Please note: for confidentiality reasons we do no distribute or share the full penetration report externally.
As you may be aware, vulnerabilities were disclosed by the MOVEit team recently. Hootsuite did a careful review of our platform and IT infrastructure and determined that we are not currently vulnerable to the CVE-2023-34362 and CVE-2023-35036 vulnerabilities that were disclosed on May 31 and June 9, 2023. We will continue to monitor the situation and will post updates on our Trust Center as necessary. Please contact security.support@hootsuite.com if you have questions.
The California Privacy Rights Act (CPRA) will come into effect on January 1, 2023. This amends and enhances the existing privacy law (the California Consumer Privacy Act) and it imposes new requirements on customers handling the personal information of Californian residents. We have prepared an Addendum to help our customers comply with these new requirements, and expanded the scope to include other US state privacy laws that are also coming into effect in 2023. Hootsuite's updated DPA is available here: https://hootsuite.com/legal/data-processing-addendum.
As you may be aware, two high severity vulnerabilities were disclosed by the OpenSSL team this week. Hootsuite did a careful review of our platform and IT infrastructure and determined that we are not currently vulnerable to the OpenSSL 3 vulnerabilities CVE-2022-3602 and CVE-2022-3786 that were disclosed on November 1, 2022. We will continue to monitor the situation and will post updates on our Trust Center as necessary. Please contact security.support@hootsuite.com if you have questions.
As an organization that is security conscious and values security, we are excited to announce the official launch of the Hootsuite Trust Center. By using this portal, you can request access to our compliance documents, review our standardized questionnaires such as the SIG and gain a general understanding of our security & privacy posture.
Over time, our team will be making changes to this portal as we implement new tools and processes in our environment. You can use the Subscribe button to receive email notifications for when our team has an important update, such as if we have an updated compliance report or if we have a status update regarding a major security vulnerability that has been recently discovered.
-Your Hootsuite Security Support Team
If you think you may have discovered a vulnerability, please send us a note.