// Trust & Security Report
CrowdStrike
Falcon Platform: unified AI-native cybersecurity suite spanning next-gen endpoint protection (antivirus, EDR, device control, firewall, IT hygiene), next-gen SIEM, identity security (ITDR, PAM, SaaS identity), cloud security (infrastructure, apps, data, AI models), and managed detection & response (MDR). All modules share a common agent and cloud-native architecture.
Certifications held
16
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.crowdstrike.com“CrowdStrike is pleased to announce the availability of our most recent SOC 2 Type II audit reports for 2026:”
Verify on trust.crowdstrike.com“SOC 2 Type I Report for The CrowdStrike Forensic Lab”
Verify on trust.crowdstrike.com“Updated ISO/IEC 27001:2022 Certification of CrowdStrike’s Information Security Management System, which now includes ISO/IEC 27017:2015”
Verify on trust.crowdstrike.com“Updated ISO/IEC 27001:2022 Certification of CrowdStrike’s Information Security Management System, which now includes ISO/IEC 27017:2015”
Verify on crowdstrike.com“and certifications from independent assessments or self-attested evaluations. ISO/IEC 42001:2023 CrowdStrike has achieved the ISO/IEC 42001 certification, a global standard that reflects our commitment to AI”
Verify on trust.crowdstrike.com“ISO 22301:2019 certification listed in trust center certifications”
Verify on crowdstrike.com“, transparent, and aligned with international best practices for AI governance. PCI DSS v4 This Coalfire report, a PCI Qualified Security Assessor (QSA), outlines the Falcon platform’s functionality with res”
Verify on trust.crowdstrike.com“2019 PCI DSS v4.0.1 Cyber Essentials DORA ENS EU-US DPF APEC CBPR APEC PRP GDPR Global CBPR Global PRP Swiss-US DPF UK Extension to EU-US DPF FedRAMP High GovRAMP TISAX VPAT View more Documents All”
Verify on crowdstrike.com“FedRAMP® High authorization. Visit FedRAMP Marketplace for more information. DoD IL5 The Falcon platform has been granted Provisional Authorizations (PA) by the DISA, meeting compliance with DoD standards”
Verify on crowdstrike.com“both the antivirus/endpoint protection platform (EPP) and EDR categories. UK Cyber Essentials CrowdStrike is fully compliant with the UK Cyber Essentials (CE) scheme, a testament to our commitment to our customers”
Verify on crowdstrike.com“Spain ENS High (EDR) - only modern endpoint security platform with the highest achievable level of accreditation”
Verify on crowdstrike.com“sures, ensuring the protection of our systems and the sensitive data they hold. TISAX CrowdStrike has been independently assessed and is registered to the Trust Information Security Assessment Exchange (TI”
Verify on trust.crowdstrike.com“GovRAMP certification listed in trust center certifications”
> Show 2 unconfirmed / not-held certifications
source: crowdstrike.comThe vendor's pages state this for a different product or company, not for this product.
source: trust.crowdstrike.comThe vendor's pages state this for a different product or company, not for this product.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Multiple geographic regions with data processing agreements and appropriate safeguards; compliant with GDPR adequacy requirements and US-EU/Swiss Data Privacy Frameworks
CrowdStrike employs Privacy-by-Design principles and uses synthetic data to train AI models rather than customer data. Privacy notice explicitly states: 'This Notice does not apply to the information our customers upload or provide to us when they use our Offerings,' with separate Data Protection Agreement governing customer data handling. Platform includes capabilities to detect and prevent movement of sensitive data to AI training systems (Amazon Bedrock, SageMaker).
// Security controls
Encryption in Transit
Data protected with encryption; specific protocols documented in Data Protection Agreement and security assessments
crowdstrike.comData Retention
Customer Personal Data deleted within 90 days of service deprovisioning unless retention required by law or agreement
crowdstrike.comData Discovery & Classification
Cloud data classification and visibility without proxies or added infrastructure via eBPF sensors
crowdstrike.comRuntime Data Monitoring
Monitors sensitive data in motion across APIs, cloud services, and applications to detect risky movement and exfiltration in real time
crowdstrike.comGenAI Data Protection
Detects movement of sensitive data to GenAI tools, APIs, and model training (Amazon Bedrock, SageMaker) with automated response integration
crowdstrike.com// Products & data scope
Data it handles: Endpoint telemetry, process execution, network connections, file activity
Includes antivirus, device control, mobile protection, firewall management, threat hunting, IT hygiene. SOC 2 Type II, ISO 27001, PCI DSS v4, HIPAA validated, FedRAMP High certified.
Data it handles: Log aggregation from endpoints, cloud, identity, SaaS; correlates cross-domain detections
AI-native SIEM engine optimized for speed and automation. Supports compliance reporting (NIST, GDPR, HIPAA). Part of Falcon Platform unified architecture.
Data it handles: Identity events, authentication logs, privilege escalation, SaaS identity, AI agent identity
Unified security for human, non-human, AI identities and SaaS. ITDR, PAM, SaaS identity security modules. ISO 27001, PCI DSS, HIPAA compliant.
Data it handles: Cloud infrastructure (AWS, Azure, GCP), container/Kubernetes, AI model scanning, data classification, API security
Agentless cloud workload protection with AI model scanning and security dashboards. ISO 27017, ISO 27001, HIPAA, PCI DSS compliant.
Data it handles: 24/7 expert-led monitoring of endpoint, cloud, identity, and SaaS security events
Fully managed service combining Falcon Platform telemetry with human expert analysis. Includes breach prevention warranty. FedRAMP High, SOC 2 Type II.
Data it handles: Connected devices, operational technology network traffic, industrial control systems
Extended IoT and OT security. FedRAMP High authorized. Serves federal agencies and critical infrastructure.
Data it handles: Aggregated security telemetry from all Falcon modules for agentic investigation and response
Agentic workflow automation for SOC operations. FedRAMP High authorized as of 2026. ISO 42001 (AI governance) certified.
// At a glance
Pricing model
Per-device annual or monthly subscriptions (Falcon Go $59.99, Pro $99.99, Enterprise $184.99 per device annually; Falcon Complete pricing on contract basis)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on CrowdStrike Holdings, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.crowdstrike.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.