Security & Privacy Compliance

Alibaba Cloud’s compliance program includes a comprehensive range of certifications, worldwide attestation reports, and our commitment to data protection.

Contact the Trust Center
Attestations & Certifications

Attestations & Certifications

Global

Alibaba Cloud adheres to international information security standards and is committed to using international best practices.

CSA STAR

CSA STAR Certification

ISO 27001

Information Security Management Systems (ISMS) Standard

ISO 20000

Information Technology Service Management Systems (SMS) Standard

ISO 22301

Business Continuity Management Systems (BCMS) Standard

ISO 9001

Quality Management Systems (QMS) Standard

ISO 27017

Information technology - Security techniques - Code of practice for information security controls based on ISO/IEC 27002 for cloud services

ISO 27018

Information technology - Security techniques - Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors

ISO 27701

Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management

ISO 29151

Information technology - Security techniques - Code of practice for personally identifiable information protection

ISO 27799

Health Information Security Management Guidelines

BS 10012

Personal Information Management System Standard

PCI DSS

Payment Card Industry Data Security Standard

PCI 3DS

Payment Card Industry 3DS Core Security Standard

SOC 1 Report

Service Organization Controls - SOC 1 Type 2 Report

SOC 2 Report

Service Organization Controls - SOC 2 Type 2 Report

SOC 3 Report

Service Organization Controls - SOC 3 Report

Regional

Alibaba Cloud adheres to all the domestic information security standards of the countries and regions where our cloud services are deployed.

MTCS (Singapore) SG

The Multi-Tier Cloud Security (MTCS) Standard

DPTM (Singapore) SG

The Data Protection Trustmark (DPTM)

C5 (German) DE

Cloud Computing Compliance Controls Catalog (C5)

AIC4 (German) DE

AI Cloud Service Compliance Criteria Catalog (AIC4)

Trusted Cloud (German) DE

The Trusted Cloud Label

NESA/ISR (United Arab Emirates) UAE

National Electronic Security Authority (NESA) / Information Security Regulation (ISR)

NIST (United States) US

NIST SP 800-53 Security and Privacy Controls for Information Systems and Organizations and NIST Cybersecurity Framework (CSF)

MLPS 2.0 (China) CN

Classified Protection of Cybersecurity

ITSS (China) CN

ITSS Cloud Computing Service Capability Assessment

NISC (Japan) JP

The National center of Incident readiness and Strategy for Cybersecurity (NISC)

TRUCS (China) CN

TRUCS Certification for Cloud Computing Services

CTM (Singapore) SG

Cyber Trust Mark (CTM) Certification

K-ISMS (Korea) KR

Korea Information Security Management System (K-ISMS) Certification

Industry

Alibaba Cloud adheres to industry-standard practices, continually conducts self-assessment reviews, and has obtained all of the relevant industry certifications.

GxP (United States) US

Good Clinical, Laboratory, and Manufacturing Practices (GxP)

TISAX (German) DE

Trusted Information Security Assessment Exchange (TISAX)

HIPAA (United States) US

The Health Insurance Portability and Accountability Act (HIPAA)

MPA (United States) US

The Motion Picture Association (MPA)

SEC Rule-17a (United States) US

Securities and Exchange Commission (SEC) Rule 17a

OSPAR (Singapore) SG

Outsourced Service Provider Audit Report (OSPAR)

FERPA & HECVAT (United States) US

The Family Educational Rights and Privacy Act (FERPA) and the Higher Education Cloud Vendor Assessment Toolkit (HECVAT)

COPPA (United States) US

The Children’s Online Privacy Protection Act (COPPA)

DPP - Broadcast (United Kingdom) UK

The Digital Production Partnership (DPP) Committed to Security Programme - Broadcast

DPP - Production (United Kingdom) UK

The Digital Production Partnership (DPP) Committed to Security Programme - Production

FISC (Japan) JP

The Center for Financial Industry Information Systems (FISC)

Data Protection & Privacy

Alibaba Cloud has completed independent cyber risk assessments to valid Alibaba Cloud’s security posture. Customers can leverage Alibaba Cloud’ third party cyber risk assessment report to reduce their supplier due-diligence burden.

GDPR (European Union) EU

The European Union General Data Protection Regulation (GDPR)

EU Cloud COC (European Union) EU

The European Union Cloud Code of Conduct (CoC)

PDPA (Singapore) SG

Personal Data Protection Act (PDPA)

PDPO (Hong Kong) HK

Personal Data (Privacy) Ordinance (PDPO)

PDPA (Malaysia) MY

Personal Data Protection Act (PDPA)

DPTM (Singapore) SG

The Data Protection Trustmark (DPTM)

APEC CBPR (Singapore) SG

The APEC Cross Border Privacy Rules (CBPR) System

APEC PRP (Singapore) SG

The APEC Privacy Recognition for Processors (PRP) System

Associations

Alibaba Cloud is a proud member of and proactively participates in security and privacy associations to share and collaborate the industry best practices.

Trusted Cloud

Trusted Cloud Competence Network

MESA

Media & Entertainment Services Alliance

DPP

The Digital Production Partnership

SRIW

Self-regulation of Information Economy

IAPP

International Association of Privacy Professionals (IAPP)

EU Cloud CoC

The European Union Cloud Code of Conduct (CoC)

W3C

The World Wide Web Consortium (W3C)

Still have questions?

For requests related to security compliance and privacy, please contact the Trust Center

Contact Trust Center
phone Contact Us