SEOMoz, Inc. (d/b/a Moz), a Ziff Davis company

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• Evidence-capture gap: moz.com blocked automated fetch on every path attempted (homepage, /privacy, /security, /terms-privacy, /blog, help.moz.com) across this session. This is a tooling limitation, not proof that pages/certs don't exist - recommend a manual or browser-rendered re-check before finalizing any cert as held=false with high confidence.
• Third-party over-claim risk: vendor-risk aggregator Nudge Security lists Moz as SOC2 + PCI + HIPAA + GDPR + ISO27001 + FedRAMP + CSA-STAR compliant with zero sourcing, which directly conflicts with an independent UpGuard scan showing no certifications and with the absence of any public trust center. Treated as unverified and NOT used to grade any cert true - flagging for human review before this vendor is shown with any compliance badges.
• Identity-conflation risk (resolved, noting for audit trail): multiple unrelated 'Moz'-branded entities exist in search results - Mozverse (Web3/blockchain startup), MOZR (unrelated SaaS with its own public DPA at mozr.com), and Mozzaz (digital-health company that genuinely holds SOC 2). None were used as evidence for this assessment; identity for this assessment was anchored to the legal entity name captured directly from moz.com's own footer text: 'SEOMoz, Inc., a Ziff Davis company.'
• Parent-vs-product cert ambiguity: Ziff Davis, LLC (Moz's corporate parent) holds a TRUSTe privacy-framework verification, but this is a corporate-umbrella privacy seal, not a Moz-product SOC2/ISO27001 attestation - excluded from certifications[] to avoid misrepresenting it as a Moz-held technical security certification.
• No HIPAA BAA evidence found; Moz should not be marketed to customers needing PHI-safe tooling without direct vendor confirmation.