// Trust & Security Report
GitBook
AI-native documentation platform; sub-products include GitBook AI (writing assistance), GitBook Agent (stale content detection), GitBook Assistant (ask-your-docs chatbot), and Git Sync (repo-linked doc updates)
Certifications held
3
Maturity
Growth
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on security.gitbook.com“itself intelligently. legal@gitbook.com Overview Resources Controls Compliance SOC 2 Type II ISO 27001:2022 Resources View all ISO 27001:2022 Surveillance Audit – Year 1 2024 Penetration test Access Contr”
Verify on security.gitbook.com“igently. legal@gitbook.com Overview Resources Controls Compliance SOC 2 Type II ISO 27001:2022 Resources View all ISO 27001:2022 Surveillance Audit – Year 1 2024 Penetration test Access Control Policy Asset Ma”
Verify on gitbook.com“If you're visiting us from the EU, please see our global privacy practices: we are compliant with the General Data Protection Regulation (GDPR).”
> Show 7 unconfirmed / not-held certifications
source: security.gitbook.comNo mention of HIPAA compliance on the trust center, security FAQ, privacy statement, enterprise page, or pricing page. No BAA offering found. GitBook's security FAQ does not list HIPAA among supported compliance frameworks.
source: gitbook.comNo PCI DSS certification or attestation found on any GitBook-domain page. GitBook explicitly delegates payment card processing to Stripe; card data never reaches GitBook servers.
source: security.gitbook.comNo public evidence of ISO 27017 certification on any GitBook-domain page.
source: security.gitbook.comNo public evidence of ISO 27018 certification on any GitBook-domain page.
source: security.gitbook.comNo public evidence of CSA STAR certification or self-assessment on any GitBook-domain page.
source: security.gitbook.comNo mention of FedRAMP authorization on any GitBook-domain page.
source: security.gitbook.comNo public evidence of ISO 42001 AI management certification on any GitBook-domain page.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
United States (Google Cloud). CDN caching may occur globally via Cloudflare; application-layer data access is validated through US-based servers. No EU or other regional data residency option is offered.
GitBook AI Policy explicitly states: 'Customer data is never shared with OpenAI or used to train any AI models.' GitBook uses OpenAI as its AI provider for features like the AI Assistant and GitBook Agent. No opt-out mechanism is described because training is stated to be off by default for all tiers. No tier-level differences in this policy are documented publicly.
// Security controls
Encryption in transit
HTTPS/TLS for all traffic including custom domains (via Let's Encrypt and Cloudflare)
gitbook.comEncryption at rest
Multiple layers of AES-256 and AES-128 encryption on Google Cloud Platform
gitbook.comCloud infrastructure
Google Cloud Platform (primary); Cloudflare (CDN/DDoS); Vercel (hosting layer); PlanetScale (database)
gitbook.comTenant isolation
Each organization's data is logically isolated from other tenants; access automatically revoked on user removal
gitbook.comAccess control
Role-based permissions (reader, editor, admin) enforced at API level; SAML SSO on Enterprise tier
gitbook.comPenetration testing
Penetration testing performed (listed as a security control in trust center); test report available on request via trust center
security.gitbook.comBusiness continuity
Continuity and Disaster Recovery plans established and tested (listed in trust center controls)
security.gitbook.comCyber insurance
Cybersecurity insurance maintained (listed in trust center controls)
security.gitbook.comVulnerability management
Responsible disclosure program active; security bugs reported to security@gitbook.com
gitbook.comData deletion on offboarding
Customer data deleted upon leaving (listed in trust center Data and privacy controls)
security.gitbook.comPayment data
Credit card data processed by Stripe only; GitBook stores only partial card details and optional billing address
gitbook.com// Products & data scope
Data it handles: Public and private documentation content, user account data (email, username); SOC 2 + ISO 27001 protections apply
1 user, basic SSO (Google/email domain). No SAML SSO.
Data it handles: Public branded docs sites; same data protections as Free
$65/site/month + $12/user/month. No SAML SSO or legal/security reviews.
Data it handles: Documentation content + AI-processed queries via OpenAI; customer data explicitly not used for AI training
$249/site/month + $12/user/month. Includes AI Assistant and GitBook Agent. No SAML SSO.
Data it handles: Full documentation corpus + AI features; legal and security reviews included; SAML SSO for access control
Custom pricing. Adds SAML SSO, white-glove migration, 1:1 support, custom integrations, legal and security reviews.
// What to watch
- No HIPAA compliance claim and no BAA offering were found, so GitBook is not suitable for healthcare PHI workloads.
- Data residency: US-only storage on Google Cloud; no EU or regional residency option, which may affect GDPR-sensitive enterprise buyers in Europe
- ISO 27001 version: original 2023 certification was likely ISO 27001:2013; trust center now shows ISO 27001:2022, implying a successful transition before the October 2025 deadline - this is positive but the exact transition date is not publicly confirmed
- AI provider dependency: GitBook uses OpenAI as its AI provider; customers whose data flows through AI features should note OpenAI is a subprocessor, though GitBook states no customer data is used for training
- SaaS-only: no self-hosting or on-premises option available, meaning all data resides on GitBook-controlled infrastructure
// At a glance
Pricing model
Per-site + per-user subscription (Free / Premium at $65/site/mo / Ultimate at $249/site/mo / Enterprise at custom pricing)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on GitBook INC's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-09-30. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
security.gitbook.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.