View Thoughtspot's compliance certifications, resources and subprocessors.

ThoughtSpot Security Portal

Welcome to **ThoughtSpot's Security Portal!**

At ThoughtSpot, our mission is to help everyone create a more fact-driven world. To achieve this, we recognize that trust is the essential foundation. Our Security Portal provides you with access to the information you need to validate our commitment to the security and privacy of your data.

You can easily access and download information about our comprehensive security program and posture, key compliance certifications, and how we use artificial intelligence to bring you more insight into your data.

We aim to be transparent, so you can be confident in ThoughtSpot's security and data protection practices, allowing you to focus on using AI-powered analytics to drive your organization forward.

Certifications

This trust portal is being prepared and will be available soon.

Trust portal coming soon

Controls

Trusted by

Documentation

Documents will appear here once they are published.

By requesting access, you agree to {companyName}'s <privacyPolicy>Privacy Policy</privacyPolicy>. This trust center is powered by <wolfiaPrivacy>Wolfia</wolfiaPrivacy>.

Fill out this form to request access. We'll review your request and get back to you shortly.

Error submitting request

Your access request for this trust center is still being reviewed. We'll email you as soon as it's approved, so there's no need to submit it again.

We've already received your access request.

Your request is under review

You already have access to this trust center. Open the link we just emailed you to view the documentation. There's no need to fill out the form again.

We've sent a fresh access link to your email.

Check your email

We'll review your request to access our private documents and get back to you shortly.

Your access request has been successfully submitted.

Access request submitted

Request access to documentation

We will process your questionnaire and email {email} when it's ready.

Questionnaire submitted

Submit a questionnaire

Subprocessors

By signing up for email notifications, you agree to {companyName}'s <privacyPolicy>Privacy Policy</privacyPolicy>. Notifications are powered by <wolfiaPrivacy>Wolfia</wolfiaPrivacy>.

Receive email notifications when {companyName} publishes important updates to their Trust Center.

You will now receive email notifications when {companyName} publishes important updates.

Subscribed!

Subscribe to updates

Updates

Premier international standard for information security management systems requiring risk-based approach to protecting information assets. ISO 27001 certification involves rigorous third-party audit of policies, procedures, and controls across 114 requirements in 14 domains. Organizations demonstrate systematic approach to managing sensitive information ensuring confidentiality, integrity, and availability.

Information Security Management System

ThoughtSpot Cloud

Comprehensive audit examining both design and operating effectiveness of controls over a period of time, typically 6-12 months. SOC 2 Type II reports provide detailed testing of security, availability, processing integrity, confidentiality, and privacy controls in operation. This rigorous assessment offers stakeholders highest assurance that controls consistently protect data and systems as designed.

System and Organization Controls Type II

Mode Analytics

Public-facing summary report of SOC 2 audit results suitable for general distribution and marketing purposes. SOC 3 reports confirm successful completion of SOC 2 audit without revealing detailed control descriptions or testing procedures. Organizations use SOC 3 seals to publicly demonstrate third-party validated security and compliance while protecting sensitive control information.

System and Organization Controls 3

US federal law establishing national standards for protecting sensitive patient health information privacy and security. HIPAA compliance requires administrative, physical, and technical safeguards including encryption, access controls, and audit logs. Healthcare providers, health plans, and business associates must implement comprehensive protections for electronic protected health information (ePHI).

Health Insurance Portability and Accountability Act

California's landmark privacy law granting consumers rights over their personal information collected by businesses. CCPA compliance requires transparency in data collection, consumer rights fulfillment processes, and security measures protecting personal information. Organizations must enable data access, deletion, and opt-out rights while maintaining detailed records of data processing activities.

California Consumer Privacy Act

Analyst Studio

ThoughtSpot Software

The EU's comprehensive data protection law that sets strict guidelines for collecting and processing personal information. GDPR compliance demonstrates accountability in data handling, requiring organizations to implement privacy by design, maintain detailed records, and respect individual rights. Organizations must ensure lawful basis for processing, enable data portability, and provide breach notifications within 72 hours.

General Data Protection Regulation

Self-assessment against Cloud Security Alliance's comprehensive cloud control matrix demonstrating security posture transparency. Organizations complete detailed questionnaires covering 197 control areas across 16 domains including data security, identity management, and incident response. STAR Level 1 provides public registry entry enabling customers to evaluate cloud provider security practices.

CSA Security, Trust & Assurance Registry Level 1

Legal mechanism enabling compliant personal data transfers from the European Union to certified US organizations. Participating companies self-certify adherence to privacy principles including notice, choice, accountability, and data security enforced by the FTC. This framework replaces Privacy Shield, providing renewed legal basis for transatlantic data flows essential for digital commerce.

EU-U.S. Data Privacy Framework

Enables compliant personal data transfers between Switzerland and the United States through self-certification to agreed privacy principles. Organizations must commit to robust privacy protections including notice, choice, accountability for onward transfer, and data integrity. This framework ensures Swiss data receives adequate protection when processed by US organizations, meeting Swiss Federal Data Protection Act requirements.

Swiss-U.S. Data Privacy Framework

Extends EU-US Data Privacy Framework protections to UK data transfers, enabling compliant data flows between the UK and US. Organizations certified under this framework demonstrate commitment to UK data protection standards while facilitating international business operations. This certification builds upon the EU-US DPF foundation with UK-specific requirements.

UK Extension to the EU-U.S. Data Privacy Framework

Voluntary Product Accessibility Template documenting a product’s conformance with accessibility standards such as Section 508, WCAG, and EN 301 549. A VPAT enables organizations to transparently communicate how their technologies support users with disabilities. Completion of a VPAT facilitates accessibility compliance, procurement decisions, and demonstrates a commitment to inclusive design.

Voluntary Product Accessibility Template

Below are key documents, information, and other resources related to ThoughtSpot's AI services and agentic analytics.

## Trust Layer
* [Trust Center](https://www.thoughtspot.com/trust): The Trust Center outlines our commitment to security and responsible enterprise AI.
* [AI Principles](https://www.thoughtspot.com/trust/ai-principles): Our AI principles outline six core pillars we follow to ensure AI results are grounded, verifiable, and governed.
* [Sub-processor Page](https://www.thoughtspot.com/legal/sub-processors): The sub-processors page lists the enterprise Large Language Model (LLM) providers we use.

## Security and Compliance
* [SOC 2 Type II Report](https://security.thoughtspot.com/?tab=documentation): The SOC 2 is a comprehensive audit of controls and includes details about our AI systems and data handling practices.
* [Protections for OWASP Top 10 LLM Application Risks](https://security.thoughtspot.com/?tab=documentation&doc=1a5f2b30-0989-4311-91f1-f50069bf12f4): Describes how we protects against the OWASP Top 10 for LLM Applications risks.
* [EU AI Act Compliance](https://www.thoughtspot.com/trust/eu-ai-act): Outlines our commitment to how we help customers meet their regulatory obligations under the EU AI Act.

## AI Agents, Architecture, and Governance
* [AI Overview](https://security.thoughtspot.com/?tab=documentation&doc=529b108e-6677-4880-8ae7-a99a587b2cbf): High-level overview of ThoughtSpot's AI products, LLM and machine learning models used, and how data is processed by our AI services.
* [Data Governance and Security in ThoughtSpot](https://docs.thoughtspot.com/cloud/latest/data-security): Information about administrative and user-level permissions to ensure you can govern the use of AI features and data.
* [Spotter: The AI Analytics Agent](https://www.thoughtspot.com/product/agents/spotter): Details how ThoughtSpot’s agentic AI uses search tokens rather than direct text-to-SQL to ensure deterministic, verifiable results.
* [SpotterModel (AI-Ready Data)](https://www.thoughtspot.com/product/agents/spottermodel): Information on how AI automates semantic modeling while maintaining human-in-the-loop governance and review checkpoints.
* [ThoughtSpot Embedded AI](https://www.thoughtspot.com/product/embedded): Resources for developers on securely integrating AI-driven conversations into custom applications.

## Additional Resources
* [AI security: How to protect your data in 2026](https://www.thoughtspot.com/data-trends/artificial-intelligence/ai-security): A guide on implementing AI security controls, including data classification, access policies, and NIST alignment.
* [AI & Analytics Resource Library](https://www.thoughtspot.com/resources#ai_driven_insights): A list of white papers, ebooks, and webinars focused on agentic analytics.
* [The Data Chief Podcast](https://www.thoughtspot.com/resources#podcast): Features interviews with industry leaders on scaling AI responsibly and more.

Enterprise AI Resources

Activision Blizzard

Ally

Bank of America

Canadian Tire Corporation

Capital One

Chick

Cola Company

Comcast

Guidewire Software

Siemens

Snowflake

Sprint

Verizon

ThoughtSpot Cloud 2025 ISO 27001 Certificate

ThoughtSpot Cloud 2025 SOC 2 Type II

ThoughtSpot Data Security Field Guide - 4th Edition

ThoughtSpot Documentation

ThoughtSpot AI Overview

Add 'Authorization: Bearer <access_token>' header to access private documents. Request access via the trust center to get a token.

*Update May 13, 2026 8:30 p.m. UTC: ThoughtSpot completed its investigation and has not found any impact to ThoughtSpot products and services.*

*Update May 13, 2026 4:00 a.m. UTC: ThoughtSpot is still actively investigating if there is any impact of the supply chain attack on ThoughtSpot products and services.*



We are aware of the supply chain attack affecting npm and PyPl packages ([May 11, 2026](https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised)) in which several open source packages were compromised as part of a coordinated supply chain campaign. 

**Status: ThoughtSpot Cloud platform and products are not affected.**

We have completed our investigation into the npm and PyPI supply chain attack. After a thorough review of our systems and dependencies, we have found no evidence of exposure or compromise. 

We will continue to monitor the situation as it develops.

Security Advisory: Supply Chain Attack Affecting npm and PyPl Packages

*Update April 2, 2026: The security advisory was updated to reflect that ThoughtSpot is not impacted by the Axios supply chain compromise.*



We are aware of the recent supply chain attacks affecting Aqua Security’s Trivy ([March 19, 2026](https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/)), the LiteLLM Python package on PyPI ([March 24, 2026](https://github.com/BerriAI/litellm/issues/24512)), and the Axios NPM package ([March 30, 2026](https://github.com/axios/axios/issues/10604)). The supply chain attacks involve potential malicious code capable of credential harvesting, data exfiltration, and lateral movement across environments.

**Status: ThoughtSpot is not impacted**

We have completed a thorough review of our GitHub organizations, repository dependencies, and build environments. ThoughtSpot's products, services, and infrastructure are not impacted by the incidents.

* **Trivy**: No compromised Trivy versions or affected GitHub Actions were present in our environments during the impacted time windows.
* **LiteLLM**: The affected LiteLLM versions (1.82.7 and 1.82.8) are not and were not used across any ThoughtSpot platform.
* **Axios**: No compromised axios versions were present or used by ThoughtSpot.

**No action is required from ThoughtSpot customers.** Your data remains secure, and our services continue to operate normally. We maintain continuous monitoring of our supply chain dependencies and will provide updates here if our assessment changes. Your trust is paramount, and we remain committed to maintaining the security of your data. 

We will continue to update this page as new information becomes available.

If you have further questions or require a deeper technical discussion, please reach out to us.

Security Advisory: Trivy, LiteLLM, and Axios Supply Chain Vulnerabilities

We are aware of the recently disclosed React2Shell [CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182) vulnerability in React and Next.js. These vulnerabilities involve unauthenticated Remote Code Execution and have understandably generated significant concern across the industry.

We have completed a review of the ThoughtSpot platform environments and determined that there is no impact on our customers' data or the ThoughtSpot platform. We will continue to monitor the situation and will provide an update if our status changes.

Your trust is paramount, and ThoughtSpot is committed to maintaining the security of your data. If you have any further questions or require a deeper technical discussion, please reach out to us.

\-

ThoughtSpot Security Portal Trust Center