Prisma compliance: SOC 2 Type II, HIPAA, GDPR and ISO 27001

In June 2024, we announced that Prisma had put in place every process and control needed for SOC 2 Type II, HIPAA, GDPR and ISO 27001

. More than two years later, we are still compliant, and the program has grown with our products, including Prisma Postgres.

This post was updated in October 2026 to reflect where things stand today.

Then and now

Compliance is not a box you tick once. We first completed these requirements in 2024 and have kept them current ever since through regular audits, reviews and continuous monitoring.

How we stay compliant with Vanta

We use Vanta to run our compliance program day to day. Vanta continuously monitors our infrastructure, systems and policies against the controls each framework requires, collects evidence automatically and alerts us when something drifts. That lets us find and fix gaps as they happen, not just before an audit.

Our audit reports, policies and control details are available in the Prisma Trust Center.

SOC 2 Type II

SOC 2 Type II is an independent audit of how well an organization's controls for security, availability, processing integrity, confidentiality and privacy work over time. Prisma's SOC 2 Type II report is available in the Trust Center, and SOC 2 Type II is included with the Prisma Postgres Business plan.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for protecting patient data. HIPAA does not certify vendors or databases. A provider is suitable for protected health information (PHI) when it signs a Business Associate Agreement (BAA) with you and protects the data with appropriate safeguards.

Prisma runs a HIPAA compliance program, and Prisma Postgres offers HIPAA compliant Postgres on the Business plan:

• Prisma signs a BAA with Business customers before they store PHI. You can read our standard Business Associate Agreement before you sign up.
• Every database is encrypted at rest and in transit and isolated from other tenants.
• Business keeps daily backups for 30 days.

GDPR

The General Data Protection Regulation (GDPR) sets strict rules for how organizations collect, store and process the personal data of people in the EU. GDPR applies on every Prisma Postgres plan, and you can keep data in one of our EU regions, Paris or Frankfurt.

ISO 27001

ISO 27001 is the international standard for information security management systems (ISMS). It covers how we identify and manage risk, protect data integrity and prevent unauthorized access. Our ISO 27001 report is available in the Trust Center and is included with the Business plan.

What compliance means for you

1. Security by default: encryption, tenant isolation and backups are built in.
2. Regulatory confidence: HIPAA and GDPR support lets you build for healthcare and the EU without starting from scratch.
3. Faster security reviews: audit reports and policies are ready in the Trust Center.
4. Ongoing risk management: continuous monitoring with Vanta keeps controls current between audits.
5. Room to grow: you can enter regulated markets without switching databases.

Get started

Compliance at Prisma is an ongoing commitment, not a one-time milestone. Building a healthcare app? Start with HIPAA on the Business plan. For audit reports, visit the Trust Center. For anything else, contact compliance@prisma.io.