// Trust & Security Report
Medallia, Inc. (formerly MonkeyLearn Inc., acquired 2022)
MonkeyLearn was a standalone no-code text analytics API/SaaS (sentiment, topic, and intent classification). Medallia, Inc. acquired MonkeyLearn Inc. in 2022 and merged its NLP technology into 'Medallia Text Analytics,' a module of the broader Medallia Experience Cloud (customer/employee experience management platform). monkeylearn.com no longer hosts an independent product.
Certifications held
13
Maturity
Enterprise
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on medallia.com“We possess SOC 2 Type II platform compliance, GDPR/SCCs, CCPA, and HIPAA in addition to HITRUST, ISO 27001, 27017, 27018, and 27701.”
Verify on trust.medallia.com“ISO/IEC 27001 (listed compliance badge); also referenced in: 'We possess SOC 2 Type II platform compliance, GDPR/SCCs, CCPA, and HIPAA in addition to HITRUST, ISO 27001, 27017, 27018, and 27701.'”
Verify on trust.medallia.com“ISO/IEC 27017:2015 (listed compliance badge on trust center)”
Verify on trust.medallia.com“ISO/IEC 27018:2019 (listed compliance badge on trust center)”
Verify on trust.medallia.com“ISO/IEC 27701 (listed compliance badge on trust center)”
Verify on trust.medallia.com“ISO/IEC 42001 (listed compliance badge on trust center)”
Verify on medallia.com“We possess SOC 2 Type II platform compliance, GDPR/SCCs, CCPA, and HIPAA in addition to HITRUST, ISO 27001, 27017, 27018, and 27701.”
Verify on medallia.com“We possess SOC 2 Type II platform compliance, GDPR/SCCs, CCPA, and HIPAA in addition to HITRUST, ISO 27001, 27017, 27018, and 27701.”
Verify on medallia.com“Medallia offers a data processing agreement (DPA) that includes the European Commission's model clauses, with updates to specifically address GDPR requirements.”
Verify on trust.medallia.com“FedRAMP Certified Class D (trust center badge); corroborated by vendor press release title 'Medallia Achieves FedRAMP JAB Authorization'”
Verify on trust.medallia.com“CSA STAR Level 1 ... The Medallia Experience Cloud product achieved this certification, demonstrating alignment with industry-standard CSA Consensus Assessments Initiative Questionnaire (CAIQ).”
Verify on trust.medallia.com“Privacy Shield (listed compliance badge on trust center); corroborated by data-protection page reference to 'certification under the Data Privacy Framework program for EU/UK/Swiss data processing'”
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
Not explicitly published as a self-service data-residency/region picker. Medallia states it operates 'a private cloud where we own and maintain our own hardware in Tier III colocation facilities' with single-tenant architecture, and covers EU data transfers via SCCs and Data Privacy Framework certification, but no public page enumerates selectable regions.
No public vendor-domain statement was found that explicitly confirms or denies whether customer text/feedback data (including data processed by the former MonkeyLearn NLP/text-analytics engine, now 'Medallia Text Analytics') is used to train Medallia's AI/ML models, nor is there a documented opt-out. The closest statement found is a general data-handling clause: Medallia 'does not review, share, distribute or reference any Customer Data except as provided in the customer's contract, and if applicable, in the Data Processing Agreement.' This implies contractual control but is not an explicit AI-training clause. Treat as unresolved; request written confirmation before publishing a training claim.
// Security controls
Infrastructure model
Private cloud, single-tenant architecture, Tier III colocation facilities, customer data segregation.
medallia.comField-level encryption
Bring Your Own Key (BYOK) field-level data encryption offered; general 'encryption in transit / at rest' language was not found on the public security or trust-center summary pages reviewed.
medallia.comSecure development lifecycle
Secure software development process including design reviews, threat modeling, risk assessment, and security touchpoints at every phase of development.
medallia.comOngoing assurance
Regular internal and external audits; annual SOC 2 Type II audit with report issued to customers.
medallia.com// Products & data scope
data: Text submitted via API or web app for sentiment analysis, topic detection, and custom text classification.
monkeylearn.com now returns a 301 permanent redirect to medallia.com. There is no live standalone MonkeyLearn signup, pricing page, or product as of 2026; it should not be treated as an active, independently operated tool.
data: Customer and employee feedback text ingested through the broader Medallia Experience Cloud platform.
MonkeyLearn's NLP technology and team were absorbed into this module following the 2022 acquisition. It is sold and secured as part of Medallia Experience Cloud, not as a separate product with its own trust documentation.
data: Full multi-channel experience data: surveys, digital feedback, contact-center conversations, and text/NLP analytics.
Holds the enterprise-grade certifications referenced in this assessment (SOC 2, ISO 27001 family, ISO 42001, HIPAA, HITRUST, FedRAMP, CSA STAR, PCI DSS). Text Analytics (formerly MonkeyLearn) inherits this platform-wide compliance posture rather than having its own separate audit scope.
// What to watch
- IDENTITY CHANGE: 'MonkeyLearn' is no longer an independently operating product. monkeylearn.com issues a permanent 301 redirect to medallia.com, confirming Medallia, Inc. acquired MonkeyLearn Inc. in 2022 and folded its technology into 'Medallia Text Analytics' inside Medallia Experience Cloud.
- PARENT-PLATFORM-VS-PRODUCT SCOPE: All certifications listed (SOC 2, ISO 27001 family, ISO 42001, HIPAA, HITRUST, FedRAMP, CSA STAR, PCI DSS) are held by Medallia, Inc. / Medallia Experience Cloud as a whole platform via its SafeBase trust center. No certificate or audit scoped specifically to the former MonkeyLearn text-analytics engine was found; these should be understood as the current legal entity's platform-wide posture, not a MonkeyLearn-specific audit.
- AI TRAINING UNRESOLVED: No public statement on medallia.com explicitly confirms or denies whether customer text data is used to train Medallia's (or the legacy MonkeyLearn) NLP/AI models, and no opt-out mechanism is documented. Do not claim 'no training on customer data' without written vendor confirmation.
- LISTING ACCURACY RISK: If AIFOXX's directory currently lists 'MonkeyLearn' as an active, independently signup-able AI tool, that listing is stale/inaccurate as of 2026 and should be corrected or clearly annotated as acquired/merged.
// At a glance
Pricing model
Enterprise, quote-based (Medallia does not publish self-serve pricing). Legacy MonkeyLearn previously offered a free tier and self-serve paid plans; these are no longer available since the product was absorbed into Medallia Experience Cloud.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Medallia, Inc. (formerly MonkeyLearn Inc., acquired 2022)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-08. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.medallia.com