Eighteen customer feedback analytics platforms say on their own websites that they hold a SOC 2 Type II report as of November 2026: Alchemer, Amplitude, Bagel AI, Canny, Caplena, Chattermill, Dovetail, Enterpret, Medallia, Pendo, Productboard, Qualtrics, SentiSum, Sprinklr, Thematic, unitQ, Unwrap and UserVoice. Two more, Kapiche and Usersnap, didn’t state Type II on the pages I checked. A claim on a website is where the check starts, so the second half of this post covers what to ask for before security signs off.
A disclosure: I work at Bagel AI, which is on the list. Every row below comes from the vendor’s own security or trust page, and each name links to that page.
The list
| Platform | Other certifications listed | How to get the report | What it does with feedback |
|---|---|---|---|
| Alchemer | ISO 27001:2022 | Ask sales; security whitepaper online | Surveys, reviews and social feedback, analyzed with AI |
| Amplitude | ISO 27001, 27017, 27018; SOC 1 Type 2 | Trust center | Product analytics, with AI Feedback for reviews, tickets and calls |
| Bagel AI | GDPR and CCPA covered | Trust center | Product brain that ranks feedback by revenue and hands decisions to coding agents |
| Canny | None listed | On request | Feature request boards, with Autopilot pulling requests from calls and tickets |
| Caplena | None of its own (hosting is ISO certified) | Trust center | Open-text analysis of customer and employee feedback |
| Chattermill | ISO 27001:2022 | Trust center | CX and VoC analytics across surveys, reviews, support and calls |
| Dovetail | ISO 27001, ISO 42001 | Trust center | Research repository for calls, interviews, tickets and surveys |
| Enterpret | Says it aligns with ISO 27001, 27701 and 42001 | Email the security team | Feedback analytics weighted by revenue, with an MCP server |
| Medallia | ISO 27001, 27017, 27018, 27701; HITRUST | Trust center, per product | Enterprise CX feedback collection and analysis |
| Pendo | HIPAA, TX-RAMP | Ask your account team | Product analytics with Listen for feedback and ideas |
| Productboard | ISO 27001:2022 | Trust center | Roadmapping, with Spark analyzing feedback |
| Qualtrics | ISO 27001, 27017, 27018, 27701; FedRAMP; HITRUST | Trust center | Experience management across surveys and feedback |
| SentiSum | None listed | Trust center | Root causes and cost of customer problems from tickets, calls and reviews |
| Sprinklr | ISO 27001; SOC 1 Type II; FedRAMP | Trust center | Customer conversation and feedback analysis across channels |
| Thematic | None listed | Ask your CSM or sales | Theme analysis of feedback, scored by business impact |
| unitQ | Hosting is ISO certified | On request | Feedback from 100+ channels scored against quality standards |
| Unwrap | None listed | Ask sales | Feedback analysis with trend alerts and digests |
| UserVoice | PCI-DSS | Email the compliance team | Feedback collection with account and revenue context |
A few notes on the rows. Canny’s security page says “SOC 2 certified”, and its Autopilot page specifies Type 2. Medallia lists Type II reports per product in its trust center, so check that the product you’re buying is covered. Enterpret’s homepage says it is ISO certified, while its security page says it aligns with those standards, so ask which is current.
Couldn’t confirm Type II
- Kapiche lists SOC 2 and CSA STAR on its trust page, without saying Type I or Type II. The report sits behind a request in its trust center.
- Usersnap lists SOC 1 and SOC 2 for its AWS data centers, which covers the hosting, not Usersnap itself.
What SOC 2 Type II tells you, and what it doesn’t
SOC 2 is an audit standard from the AICPA. A Type I report checks that the controls were designed properly on a single date. A Type II report checks that they actually worked over a period, usually six to twelve months, which is why security teams ask for Type II.
It doesn’t tell you everything. Feedback tools read sales calls, support tickets and chats, so they hold names, emails and sometimes contract details. These are the questions worth asking once you have the report:
- Is the report current? Check the audit period. If it ended more than a few months ago, ask for a bridge letter.
- Which product and trust criteria does it cover? Security is always in scope. Availability, confidentiality and privacy are optional.
- Which subprocessors see your data? That includes the LLM provider behind the AI features.
- Does your data train a shared model? Some tools train one model across customers, and others train a separate model per customer.
- How is PII handled? Ask whether it’s removed before the data reaches the model, and how long raw transcripts are kept.
- Is there SSO, role-based access and an audit log? These matter once sales, CS and product all have accounts.
Bagel AI is SOC 2 Type II certified, covers GDPR and CCPA, and runs a dedicated model for each customer, so your data never trains another customer’s model. PII is reduced before the data reaches the model. The report and DPA are in the Bagel AI Trust Center, and the security page covers the rest.
FAQ – You ask, we answer
As of November 2026, these platforms state SOC 2 Type II on their own security or trust pages: Alchemer, Amplitude, Bagel AI, Canny, Caplena, Chattermill, Dovetail, Enterpret, Medallia, Pendo, Productboard, Qualtrics, SentiSum, Sprinklr, Thematic, unitQ, Unwrap and UserVoice. Kapiche lists SOC 2 without stating the type, and Usersnap lists SOC 2 only for its hosting provider.
A Type I report checks that security controls were designed correctly on one date. A Type II report checks that they worked over a period, usually six to twelve months. Most enterprise security reviews ask for Type II.
Most vendors share it under NDA, through a trust center or on request from sales or their security team. Check the audit period, which product it covers and which trust criteria are in scope.
Yes. Bagel AI is SOC 2 Type II certified and covers GDPR and CCPA. The report and DPA are available through the Bagel AI Trust Center at trust.bagel.ai.
Still have questions? Ask your AI about Bagel AI
