// Trust & Security Report
Postman
Postman API Platform (API Client, Spec Hub, Mock Servers, Collection Runner, Monitors, API Catalog, Insights) plus AI features (AI Engineer, Agent Mode, Postbot), Postman CLI, Postman MCP Server, and Enterprise add-ons (Advanced Security Administration: BYOK, Secret Scanner, Vault)
Certifications held
11
Maturity
Enterprise
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on security.postman.com“Trust Reports All Public Private Get access Bulk download Featured Documents SOC 2 TYPE 2 REPORTS Data Flow Diagram (DFD) REGULATORY COMPLIANCE AND STANDARDS SOC 2 Type 2 APPLICATION SECURITY”
Verify on security.postman.com“Standards CCPA Cloud Security Guidance CSA STAR GDPR PCI DSS SOC 2 SOC 2 Type 2 SOC 3 TX-RAMP Certi-Trust ISO 27001 HIPAA ISO/IEC 27001 ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 42001:2023 Customer”
Verify on security.postman.com“Guidance CSA STAR GDPR PCI DSS SOC 2 SOC 2 Type 2 SOC 3 TX-RAMP Certi-Trust ISO 27001 HIPAA ISO/IEC 27001 ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 42001:2023 Customer Trust Portal Updates Subscribe”
Verify on security.postman.com“2 SOC 3 TX-RAMP Certi-Trust ISO 27001 HIPAA ISO/IEC 27001 ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 42001:2023 Customer Trust Portal Updates Subscribe Notice of Security Incident Incidents June 23, 2026 On”
Verify on security.postman.com“Certi-Trust ISO 27001 HIPAA ISO/IEC 27001 ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 42001:2023 Customer Trust Portal Updates Subscribe Notice of Security Incident Incidents June 23, 2026 On June 13, Postman”
Verify on blog.postman.com“Skip to content Blog Postman is HIPAA-Compliant Sam Chehab May 6, 2026 Every security team evaluating a vendor is asking the same core questions: Where is my”
Verify on postman.com“"Postman complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the DPF (UK DPF Extension), and the Swiss-U.S. Data Privacy Framework (Swiss DPF)." GDPR is also listed as a Regulatory Compliance badge on the trust portal, and the Privacy Policy documents GDPR legal-basis processing.”
Verify on postman.com“responses are available via the Postman Customer Trust Portal. SOC 2 Type II PCI DSS HIPAA GDPR CCPA / CPRA CSA STAR TX-RAMP ISO 27001 ISO 42001 SOC 2 Type II reports, penetration test summaries, security”
Verify on security.postman.com“. Regulatory Compliance and Standards CCPA Cloud Security Guidance CSA STAR GDPR PCI DSS SOC 2 SOC 2 Type 2 SOC 3 TX-RAMP Certi-Trust ISO 27001 HIPAA ISO/IEC 27001 ISO/IEC 27001:2022 ISO/IEC”
Verify on postman.com“"We do not sell your data for commercial purposes or 'share' data as defined under the CCPA and CPRA." Also listed as a badge on the trust portal.”
Verify on security.postman.com“"TX-RAMP" listed as a Regulatory Compliance and Standards badge on the Customer Trust Portal.”
> Show 1 unconfirmed / not-held certifications
source: security.postman.comFedRAMP does not appear in the Regulatory Compliance and Standards section of Postman's Customer Trust Portal, which lists SOC 2, ISO 27001, ISO 27017, ISO 42001, HIPAA, PCI DSS, GDPR, CCPA, and TX-RAMP. Third-party aggregator sites claim FedRAMP compliance, but this is not corroborated on postman.com or security.postman.com, and Postman does not appear in the FedRAMP Marketplace.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
Product data and backups hosted on AWS servers in the EU and the U.S.; Enterprise customers can use Bring Your Own Key (BYOK) to manage their own encryption keys.
The Privacy Policy states: 'We may also use information you provide to develop artificial intelligence (AI) tools and systems as set forth in our Postman AI Terms.' The Security page states: 'Postman does not use customer data in internal testing. All validation and QA efforts are conducted on a production-mirrored internal stack using fictitious data only,' though that statement is scoped to internal QA/testing rather than AI feature training (Postbot, AI Engineer, Agent Mode).
// Security controls
Encryption at rest
AES-256-GCM for data at rest; sensitive data (environment variables, secrets, access tokens) encrypted at the application layer and managed via a key management system (KMS). Enterprise customers can enable Bring Your Own Key (BYOK).
postman.comAccess control
Role-based access control (RBAC) and multi-factor authentication (MFA) cited as baseline Enterprise controls supporting HIPAA technical safeguards; Azure AD SCIM user provisioning also supported.
blog.postman.comTenant isolation
Tenant isolation and governed access to production systems cited as baseline Enterprise controls.
blog.postman.comPenetration testing
Application Penetration Testing and Network Penetration Testing reports available (gated) via the Customer Trust Portal.
security.postman.comData storage redundancy
"All user data is encrypted and stored across six copies in three locations."
postman.com// Products & data scope
Data it handles: API requests, collections, environments, workspace content; may be private or public workspaces
Core product available to individuals and small teams; SOC 2 and ISO certifications apply to the shared platform infrastructure.
Data it handles: Same workspace content plus admin/org-level controls, SCIM provisioning, audit logs
Baseline Enterprise security controls now independently satisfy HIPAA technical safeguards without requiring the ASA add-on, per Postman's own 2026 HIPAA compliance announcement.
Data it handles: Encryption keys (BYOK), scanned secrets, vaulted credentials
Includes Bring Your Own Key (BYOK), Secret Scanner, and Vault. Formerly required for HIPAA compliance; now optional/'a plus' rather than mandatory per the vendor's 2026 blog post.
Data it handles: Workspace and API context is used to ground AI suggestions
Governed by the separate Postman AI Terms. The Privacy Policy states user-provided information may be used to develop Postman's AI tools and systems, which differs in scope from the security page's statement that customer data is not used in internal testing (that statement covers QA rather than AI training).
Data it handles: Publicly published APIs, docs, and MCP server listings
Public-by-design; not in scope for confidential customer data handling.
// What to watch
- AI training posture: the Privacy Policy states customer-provided information may be used 'to develop artificial intelligence (AI) tools and systems as set forth in our Postman AI Terms,' while the Security page states customer data is not used in 'internal testing.' These are different scopes, AI feature training versus QA, and the AI Terms document does not spell out which controls apply to AI Engineer, Agent Mode, and Postbot.
- FedRAMP is claimed by several third-party aggregator sites (not Postman-owned) but does not appear on Postman's own Customer Trust Portal certification list.
- The Customer Trust Portal (security.postman.com) gates most underlying audit reports and documents (SOC 2 report, penetration test reports, DPA) behind a 'Get access' / request flow; only the certification labels themselves are publicly visible without a request.
// At a glance
Pricing model
Freemium SaaS (Free tier, paid Basic/Professional tiers, custom-priced Enterprise tier with add-ons)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Postman, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
security.postman.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.