Pega Trust Center
Secure. Reliable. Compliant. Pega Cloud empowers the world’s biggest brands to meet – and exceed – the challenges of today and tomorrow. Learn how.
Security
Our security policies provide a framework for safeguarding against unauthorized access and preventing/mitigating attacks that
compromise performance and availability.
Privacy
Use our services to enable you to implement your own privacy and compliance strategies. We continually evolve our platform to provide the features and security measures that you may use to support your security and privacy strategy.
Compliance certifications, attestations, and accessibility
When evaluating the services listed under each compliance standard it should be noted that Pega relies on a common set of controls for the purposes of adherence. These common controls exist across the Pega Platform, the underlying infrastructure, and the operations, administration and management provided by Pega in Pega Cloud. Pega applications deployed within/on the Pega Platform inherit these controls which are attested to in the current scope
APRA
The Australian Prudential Regulation Authority (APRA) is Australia’s prudential regulator responsible for ensuring the safety, resilience, and stability of banks, insurers, and superannuation funds. APRA sets mandatory standards to strengthen financial institutions’ operational, information security, and risk-management capabilities. APRA issues prudential standards including the operational risk management standards of Prudential Standard 230 and the information security standards of Prudential Standard 234.
Resources
Last updated (YYYY-MM-DD)
2026-02-26
Assessment scope
Pega Cloud AWS
Products
Pega Cloud Platform
Pega Cloud Customer Instance*
Pega Diagnostic Cloud
Pega Blueprint
Pega GenAI
Pega Digital Messaging
Pega Blueprint
*Assessment status applicable if Co-Browse is not used
C5
The Cloud Computing Compliance Criteria Catalogue (C5) criteria catalogue specifies minimum requirements for secure cloud computing and is primarily intended for professional cloud providers, their auditors and customers.
Resources
Last updated (YYYY-MM-DD)
2024-11-15
2026-06-23
Assessment scope
Pega Cloud AWS
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega Diagnostic Center
Pega GenAI
Pega Blueprint
*Assessment status applicable if Co-Browse is not used
CSA STAR
The Security, Trust, Assurance, and Risk (STAR) Registry is a publicly accessible registry that documents the security and privacy controls provided by popular cloud computing offerings.
STAR encompasses the key principles of transparency, rigorous auditing, and harmonization of standards outlined in the Cloud Controls Matrix (CCM). Publishing to the registry allows organizations to show current and potential customers their security and compliance posture, including the regulations, standards, and frameworks they adhere to. It ultimately reduces complexity and helps alleviate the need to fill out multiple customer questionnaires.
Resources
Last updated (YYYY-MM-DD)
2025-11-06
Assessment scope
Pega Cloud AWS & GCP
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega GenAI
Pega Diagnostic Center
Digital Messaging
Pega Blueprint
*Assessment status applicable if Co-Browse is not used
Cyber Essentials
Cyber Essentials is a UK Government-backed, industry-supported certification scheme introduced in the UK to help organizations demonstrate operational security against common cyber-attacks.
Resources
Last updated (YYYY-MM-DD)
2026-01-22
Assessment scope
Pega Cloud AWS & GCP
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega Diagnostic Center
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
Cyber Essentials Plus
Cyber Essentials Plus is a UK Government-backed, industry-supported certification scheme introduced in the UK to help organizations demonstrate operational security against common cyber-attacks. It builds upon the Cyber Essentials certification by incorporating independent verification of technical controls.
Resources
Last updated (YYYY-MM-DD)
2026-02-09
Assessment scope
Pega Cloud AWS & GCP
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega Diagnostic Center
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
CyberGRX
CyberGRX provides a cybersecurity platform designed to assist businesses in handling cyber risks related to third-party vendors. Pega leverages CyberGRX to streamline our vendor risk assessment process. With CyberGRX, Pega can assess the security posture of our third-party vendors, identify possible risks, and prioritize necessary mitigation measures.
Resources
Last updated (YYYY-MM-DD)
2024-04-02
Assessment scope
Pega Cloud AWS
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Predictive Diagnostic Cloud
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
Cybervadis
Cybervadis is a platform for cybersecurity ratings designed to assess the cyber risk associated with a company’s third-party suppliers. At Pegasystems, a global technology company, Cybervadis is employed to evaluate the cybersecurity posture of our suppliers and partners. Through the assessment of cyber risk associated with our suppliers, Pegasystems can make well-informed decisions concerning the security and resilience of our supply chain.
Cybervadis offers a comprehensive risk assessment based on various factors, including data security, infrastructure security, and regulatory compliance. Pegasystems utilizes these ratings to identify potential vulnerabilities within the supply chain and to take effective measures to mitigate associated risks.
Ultimately, by leveraging Cybervadis, Pegasystems is positioned to enhance our security posture, strengthen risk management processes, and ensure the security and integrity of our operations.
Resources
Last updated (YYYY-MM-DD)
2024-03-21
Assessment scope
Pega Cloud AWS
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Predictive Diagnostic Cloud
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
ENS
The Esquema Nacional de Seguridad (ENS) is the Spanish National Security Framework. It is a set of security requirements and guidelines that are mandatory for all organizations that handle sensitive information on behalf of the Spanish government. The ENS is based on the principles of confidentiality, integrity, availability, and accountability. It is designed to protect sensitive information from unauthorized access, modification, or disclosure, and to ensure that it can be used only for authorized purposes.
Resources
Last updated (YYYY-MM-DD)
2025-09-26
Assessment scope
Pega Cloud AWS & GCP
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega Diagnostic Center
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
FedRAMP
The Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach to security authorizations for Cloud Service Offerings
Resources
Last updated (YYYY-MM-DD)
2021-02-17
Assessment scope
Pega Cloud for Government
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Sales Automation Standard Edition
Predictive Diagnostic Cloud
*Digital Messaging, Co-Browse, and VoiceAI are not supported in Pega Cloud for Government
French HDS
The Hébergeurs de Données de Santé (HDS) certification is required for entities such as cloud service providers that host the personal health data governed by French laws and collected for delivering preventive, diagnostic, and other health services. The HDS regulation was issued by ASIP SANTÉ which, under the French Ministry of Health, is responsible for promoting electronically based healthcare solutions in France.
Resources
Certificate #37066
Bureau Veritas Certification
Subcontractors Table
Last updated (YYYY-MM-DD)
2026-09-15
Assessment scope
Pega Cloud AWS
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega Diagnostic Center
*Assessment status applicable if VoiceAI and Co-Browse are not used
HITRUST
The Hébergeurs de Données de Santé (HDS) certification is required for entities such as cloud service providers that host the personal health data governed by French laws and collected for delivering preventive, diagnostic, and other health services. The HDS regulation was issued by ASIP SANTÉ which, under the French Ministry of Health, is responsible for promoting electronically based healthcare solutions in France.
Resources
Last updated (YYYY-MM-DD)
2025-12-06
2025-12-06
Assessment scope
Pega Cloud AWS & Pega Cloud GCP
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega Diagnostic Center
Pega GenAI**
Pega Blueprint
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
**Inclusive of AWS Bedrock, GCP Vertex, and Azure OpenAI
IL4
The Defense Information Systems Agency (DISA) published the Department of Defense Cloud Computing Security Requirements Guide (DoD CC SRG) that outlines the security model and requirements by which DoD will leverage cloud computing along with the security controls and requirements necessary for using cloud-based solutions. IL4 information covers controlled unclassified information (CUI), non-CUI information, non-critical mission information, and non-national security systems.
Resources
Last updated (YYYY-MM-DD)
2019-03-15
Assessment scope
Pega Cloud for Government
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Sales Automation
Predictive Diagnostic Cloud
*Digital Messaging, Co-Browse, and VoiceAI are not supported in Pega Cloud for Government
IRAP
The Infosec Registered Assessors Program (IRAP) ensures entities can access high-quality security assessment services.
Resources
Last updated (YYYY-MM-DD)
2024-10-22
2025-11-10
Assessment scope
Pega Cloud AWS
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega Diagnostic Center
Digital Messaging
Pega GenAI**
Pega Blueprint
*Assessment status applicable if Co-Browse is not used
**Inclusive of AWS Bedrock, GCP Vertex, and Azure OpenAI
ISMAP
The Information System Security Management and Assessment Program (ISMAP) is a Japanese government program that assesses the security of cloud service providers (CSPs).
Resources
Last updated (YYYY-MM-DD)
2024-10-30
2025-09-01
Assessment scope
Pega Cloud AWS
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega Diagnostic Center
Pega GenAI
Pega Blueprint
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
ISO 22301
Published by the International Organization for Standardization, ISO 22301 is designed to help organizations prevent, prepare for, respond to and recover from unexpected and disruptive incidents. To do so, the standard provides a practical framework for setting up and managing an effective business continuity management system (BCMS). ISO 22301 aims to safeguard an organization from a wide range of potential threats and disruptions. The scope of the certification is limited to the BCMS supporting Pega Cloud and includes the organizations, systems, people and facilities directly involved in the deployment, maintenance, and monitoring of critical Pega Cloud services.
This standard may be right for your organization if you need to demonstrate to stakeholders that your organization can rapidly overcome operational disruption to provide continued and effective service.
Resources
Last updated (YYYY-MM-DD)
2024-11-04
2025-12-22
Assessment scope
Pega Cloud AWS
Pega Corporate
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega Diagnostic Center
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
ISO 27017
ISO 27017 is an international standard offering guidance on information security controls for cloud services. These controls supplement the guidance of ISO 27002 and are included in Pega Cloud’s ISO 27001 certification. It helps address cloud security challenges by advising on effective measures like provider responsibilities, information sharing, personnel security, and compliance.
Resources
Last updated (YYYY-MM-DD)
2024-11-26
Assessment scope
Pega Cloud AWS & GCP
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega GenAI
Pega Diagnostic Center
Digital Messaging
Pega Blueprint
*Assessment status applicable if Co-Browse is not used
ISO 27018
ISO 27018 is a standard that provides guidelines for protecting personally identifiable information (PII) in the cloud. These guidelines supplement the guidance of ISO 27002 and are included in Pega Cloud’s ISO 27001 certification.
Resources
Last updated (YYYY-MM-DD)
2024-11-26
Assessment scope
Pega Cloud AWS & GCP
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega GenAI
Pega Diagnostic Center
Digital Messaging
Pega Blueprint
*Assessment status applicable if Co-Browse is not used
ISO 42001
ISO 42001 is the first international standard for managing artificial intelligence (AI) responsibly. It provides a framework for establishing, implementing, maintaining, and continually improving an AI Management System (AIMS). It demonstrates commitment to ethical, transparent, and risk-aware AI practices.
Resources
Last updated (YYYY-MM-DD)
2025-12-16
Assessment scope
Pega Cloud AWS & GCP
Products
All Pega AI and GenAI
ISO 9001
ISO 9001 is an international standard for quality management systems that applies to software services by focusing on how an organization plans, delivers, monitors, and improves its software-related processes. It emphasizes consistent service delivery, clear requirements management, risk-based thinking, customer satisfaction, and continual improvement across software development, maintenance, support, and project management.
Resources
Last updated (YYYY-MM-DD)
2026-01-20
Assessment scope
Pega Cloud
Products
Pega Cloud
PCI/DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that ALL companies that accept, process, store or transmit credit card information maintain a secure environment.
Resources
Last updated (YYYY-MM-DD)
2024-08-22
2024-08-22
Assessment scope
Pega Cloud AWS & GCP
Pega Cloud AWS & GCP
Products
Pega Platform
Smart Dispute
Smart Investigate
Pega Foundation for Financial Services
SOC 1
The American Institute of Certified Public Accountants (AICPA) Service Organization Controls (SOC) reports give assurance over control environments as they relate to the retrieval, storage, processing, and transfer of data. The reports cover IT General controls and controls around availability, confidentiality and security of customer data. The SOC 1 reports are primarily concerned with examining controls that are relevant for the financial reporting of customers
Resources
Last updated (YYYY-MM-DD)
2025-10-23
Assessment scope
Pega Cloud AWS & GCP
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega GenAI
Pega Diagnostic Center
Pega Blueprint
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
SOC 2, Type 2
The American Institute of Certified Public Accountants (AICPA) Service Organization Controls (SOC) reports give assurance over control environments as they relate to the retrieval, storage, processing, and transfer of data. The reports cover IT General controls and controls around availability, confidentiality and security of customer data. The SOC 2 reports cover controls around security, availability, and confidentiality of customer data.
Resources
Last updated (YYYY-MM-DD)
2025-10-23
Assessment scope
Pega Cloud AWS & GCP
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega GenAI
Pega Diagnostic Center
Workforce Intelligence
Pega Blueprint
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
TISAX
TISAX is an assessment and exchange mechanism for the information security of enterprises and allows recognition of assessment results among the participants.
If you want to process sensitive information from your customers or evaluate the information security of your own suppliers, TISAX supports you in reducing efforts.
Resources
Last updated (YYYY-MM-DD)
2025-04-24
Assessment scope
Pega Cloud AWS
Products
Pega Platform
Pega Customer Service Case Management Edition*
Pega Customer Service Enterprise Edition*
Pega Customer Decision Hub
Pega Sales Automation
Pega Cloud SFTP Service
Pega Diagnostic Center
Digital Messaging
Pega GenAI
Pega Blueprint
*Assessment status applicable if VoiceAI, digital messaging/web messaging, and Co-Browse are not used
Pega's security, privacy controls and policies allow clients to address a broad range of laws and regulations. Below are some examples:
California Consumer Privacy Act/ California Privacy Rights Act
The California Consumer Privacy Act (CCPA) was enacted into law on June 28, 2018. The CCPA seeks to ensure California consumers have a certain level of privacy rights. Adherence to applicable laws is a shared responsibility. Pega provides relevant security controls, guidance and feature capabilities that allow our clients to adhere to laws. Pega is designed to allow Clients to configure their own strategy for compliance with applicable laws.
On November 3, 2020, the California Privacy Rights Act (“CPRA”) passed. The CPRA amends the CCPA and includes additional privacy protection for consumers. The majority of CPRAs provisions will enter into effect on January 1, 2023, with a look-back to January, 2022.
FDA
Food Drug Administration CFR Title 21. Adherence to applicable laws is a shared responsibility. Pega provides relevant security controls, guidance and feature capabilities that allow our clients to adhere to laws. Pega is designed to allow Clients to configure their own strategy for compliance with applicable laws.
GDPR
The General Data Protection Regulation is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area. The GDPR is an important component of EU privacy law and of human rights law, in particular Article 8 of the Charter of Fundamental Rights of the European Union. Adherence to applicable laws is a shared responsibility. Pega provides relevant security controls, guidance and feature capabilities that allow our clients to adhere to laws. Pega is designed to allow Clients to configure their own strategy for compliance with applicable laws
HIPAA
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The HIPAA Security Rule protects a subset of information covered by the Privacy Rule. Adherence to applicable laws is a shared responsibility. Pega provides relevant security controls, guidance and feature capabilities that allow our clients to adhere to laws. Pega is designed to allow Clients to configure their own strategy for compliance with applicable laws.
Data Privacy Framework
The EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) were respectively developed in furtherance of transatlantic commerce by the U.S. Department of Commerce and the European Commission, the UK Government, and the Swiss Federal Administration to provide U.S. organizations with reliable mechanisms for personal data transfers to the United States from the European Union / European Economic Area, the United Kingdom (and Gibraltar), and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law.
The effective date of the EU-U.S. DPF Principles, including the Supplemental Principles and Annex I of the Principles is July 10, 2023, which is the date of entry into force of the European Commission’s adequacy decision for the EU-U.S. DPF. The adequacy decision enables the transfer of EU personal data to participating organizations consistent with EU law.
Effective as of July 17, 2023, eligible organizations in the United States that wish to self-certify their compliance pursuant to the UK Extension to the EU-U.S. DPF may do so; however, personal data cannot be received from the United Kingdom and Gibraltar in reliance on the UK Extension to the EU-U.S. DPF before the date that the adequacy regulations implementing the data bridge for the UK Extension to the EU-U.S. DPF enter into force. The data bridge will enable the transfer of UK and Gibraltar personal data to participating organizations consistent with UK law
To learn more about the Data Privacy Framework program, and how we comply with the Data Privacy Framework, please visit our Privacy & Security page here. To view our Data Privacy Framework notice and to view our participation, please visit https://www.dataprivacyframework.gov/s/
Resources
N/A
Last updated
7/31/2023
Accessibility
Service reliability
Whenever you need us, we’re there – 24/7, 365. Because reliability is the cornerstone of strong service.
"With more than 30 years of experience working with the world’s most respected brands, Pega understands the importance of security. This experience extends to Pega’s products and services that enable Pega to establish long-term partnerships with customers that are built on trust and transparency."