Agorapulse

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• The trust center lists 'ISO 42001 Engagement Letter - Agorapulse - 2026.pdf' alongside completed certifications, which could create a misleading impression that the AI governance certification is held. It is not: an engagement letter means the audit process has been initiated, not completed, so ISO 42001 should not be treated as a certification Agorapulse currently holds.
• The Agorapulse security page lists CSA STAR Level 2, ISO 27017, ISO 27018, and PCI DSS Level 1 as AWS infrastructure certifications. These belong to AWS, not to Agorapulse, and a Microsoft attestation confirms Agorapulse itself holds none of them; hosting-provider certifications should not be attributed to the vendor itself.
• The Microsoft 365 App Certification self-attestation states 'Do you report data breaches to supervisory authorities and individuals within 72 hours? No'. This appears to contradict Agorapulse's stated GDPR compliance, which mandates 72-hour supervisory authority notification. It could be a form error or a genuine gap; ask Agorapulse to clarify before relying on breach notification commitments.
• The Microsoft attestation states 'Are all logs reviewed on a regular cadence by human or automated tooling? No'. This is a minor operational security gap for a SOC 2 Type 2 certified vendor and may have been corrected since the August 2025 attestation submission.
• There is no explicit public statement confirming AI models are never trained on customer data; protection currently derives from the terms-of-service prohibition on commercial use of customer data. The 'AI trust and privacy practices - March 2026' document in the trust center is access-gated, so until it can be examined, buyers should assume there is no public explicit opt-out and that AI features are opt-in only.