Compliance, covered.
We follow strict global privacy and security standards to give you accurate data without the compliance risk.
Certifications & attestations
Lusha maintains SOC 2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 31700, and TRUSTe Responsible AI certifications. We are also fully aligned with GDPR, CCPA, and other global data protection regulations.
GDPR Compliant
Certified by European independent auditors ePrivacyseal GmbH.
CCPA Validation
Validated by TrustArc, global leaders in data privacy assurance
Accredited ISO 27701
The world’s leading standard for information security management systems (ISMS). Certified by independent 3rd-party auditors. Vetted & approved by ANAB.
ISO/IEC 27001
Certified for our Information Security Management System (ISMS), the foundation for all our other security and compliance certifications.
ISO/IEC 27017
Certified for cloud-specific security controls, extending our ISO 27001 information security management practices to cloud services.
SOC 2 Type 2
TRUSTe
Certification for data governance alignment with global ethical standards and regulation.
ISO/IEC 42001
Certified for our AI Management System (AIMS), ensuring responsible development and governance of AI capabilities.
ISO 31700
Privacy by design for consumer goods and services. Audited and certified by accredited 3rd-party auditors.
Regulatory compliance
GDPR (General Data Protection Regulation)
- Fully aligned with EU data protection requirements
- Data Processing Agreement (DPA) available for all customers
- Standard Contractual Clauses (SCCs) for international transfers
- Data subject rights support with automated request handling
- Article 14 notification mechanisms for data subjects
- Legitimate Interest Assessments (LIA) conducted and documented
- Data Protection Impact Assessments (DPIA) available
CCPA/CPRA (California Consumer Privacy Act)
- Fully aligned with California privacy requirements
- “Do Not Sell” mechanisms and opt-out support
- Consumer rights request processing (access, delete, opt-out)
- Transparency in data collection, usage, and sharing
- Service provider agreements meeting CCPA standards
Data residency & international transfers
- Personal data of customers is mainly stored in EU regions for GDPR compliance
- US data stored in US regions
- Standard Contractual Clauses (SCCs) for cross-border transfers
- Transfer Impact Assessments conducted
- Clear documentation of data flows and transfers
Compliance documentation
Available for download or upon request:
- SOC 2 Type II report (gated access)
- ISO certificates (27001, 27701, 27017, 31700)
- Data Processing Agreement (DPA)
- Standard Contractual Clauses (SCCs)
- Subprocessor list
- Security whitepaper
- Privacy whitepaper
- Penetration test summary (NDA required)
