Trust Center
Welcome to the Yotpo Trust Center.
Our commitment to security and data privacy is embedded in every part of our business and in every phase of our platform development. Here, you can access our comprehensive compliance documentation, find answers to frequently asked questions related to security and privacy, and explore our robust security practices. We believe in maintaining transparency and building trust with our customers, and this portal is designed to provide you with the information and assurance you need to feel confident in our ability to protect your data.
Allbirds
Patagonia
PRINCESS POLLY
Steve Madden
Chubbies
Dr. Martens
Goodr
GoPro
MVMT
– MUSCLE REPUBLIC
Moroccanoil
LSKD
ThirdLove
Theory
Supergoop
Ruohonjuuri
REVOLUTION BEAUTY
REFY
Subprocessors
- Do you provide a copy of your penetration test reports?
- Do you provide a copy of your SOC 2 Reprot?
Trust Center Updates
Response to emerging threats
Response to PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
The Yotpo platform, including our Shopify app, on-site widgets and the backend services that process merchant and customer data, is not built on PHP and does not run the PHP runtime. Because these vulnerabilities are in the PHP engine itself, they do not apply to our platform.
Action required by customers: None. No changes are needed to the Yotpo app, its configuration or your storefronts.
Our security team continuously monitors emerging threats and vendor advisories, and we will contact you directly if anything changes. Please don't hesitate to reach out with any further questions.
General Updates
Yotpo Discover now included in our ISMS scope
We’re pleased to announce that Yotpo has extended the scope of its Information Security Management System (ISMS) to include Yotpo Discover (AI Discoverability & Optimization). The extension follows a successful audit by Standards Institution of Israel.
Yotpo Discover is now covered by the same certified management systems as the rest of the Yotpo platform:
- ISO/IEC 27001: Information Security Management Systems.
- ISO/IEC 27017: Code of practice for information security controls for cloud services.
- ISO/IEC 27018: Code of practice for protecting personally identifiable information (PII) in public clouds.
- ISO/IEC 27701: Privacy Information Management, an extension to ISO/IEC 27001.
What this means for you:
Yotpo Discover was built from the start on the same security and privacy controls that protect the rest of the Yotpo platform. These cover risk management, access control, secure development, cloud security, incident response and how personal data is handled throughout its lifecycle. With this scope extension, an independent auditor has now formally verified those controls for Yotpo Discover.
Extending our certifications to new products as they launch is part of our ongoing commitment to security and privacy by design.
Documentation:
The updated certificates are available in the Documents section of our Trust Center. For questions or more information, contact [security@yotpo.com].