Betterment

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• A January 9, 2026 data breach exposed PII of approximately 1.4 million customers (names, email addresses, postal addresses, phone numbers, dates of birth) via social engineering against a third-party communications/marketing platform account. The ShinyHunters threat group claimed responsibility and demanded ransom; it also claimed to have exfiltrated 401k retirement plan data for ~181K individuals including plan assets and participant counts. Betterment engaged CrowdStrike for forensic investigation and confirmed no account passwords or login credentials were compromised. The final post-incident report was published March 30, 2026.
• Betterment added a 'noindex' meta tag to its breach disclosure page (https://www.betterment.com/customer-update) to prevent search engines from indexing it, making the breach harder for prospective customers to discover. This transparency concern runs contrary to responsible disclosure best practices.
• The January 2026 breach was caused by social engineering of a third-party platform vendor (marketing/communications), not a direct breach of Betterment systems. This highlights supply-chain and vendor security as a residual risk despite Betterment's own controls.
• No data processing agreement (DPA) or GDPR compliance posture was found. Betterment appears to serve US-domiciled customers only. EU-based customers or enterprises requiring GDPR data processing terms cannot use this service without additional verification.
• Despite enterprise scale ($70B+ AUM, 1M+ customers), Betterment holds no ISO 27001 certification. Only SOC 1/2 and DOL Cybersecurity frameworks are evidenced.
• The trust center at trust.betterment.com is rendered with JavaScript (Conveyor platform), so it is not readable by standard web crawlers. Certification status here reflects the trust center's published badges (SOC 1 Type II, SOC 2 Type II, SIG, DOL Cybersecurity); the full FAQ and document details have not been independently confirmed, so buyers who need them should request access through the trust center directly.
• HIPAA does not apply: Betterment is a financial services company regulated by the SEC and FINRA, not a healthcare entity, and the vendor makes no HIPAA claims.