Trust Center - sonatype
Security You Can Trust
Trust is foundational to the success of our business. Trust = Transparency + Accountability. We strive for transparency through clear communication across functions and levels. We hold ourselves accountable for the promise we make to our employees, investors, and customers.
To earn your trust, we share our security and compliance programs with you. We continuously evolve with the ever-changing world around us to safely manage the confidentiality, integrity, and availability of not only Sonatype's but also the customers' data and services that we manage.
Security at Sonatype | Bug Bounty Program | Security Advisories
Security Compliance & Assurance
| #### ISO 27001 2022 Certificate Copy link for ISO 27001 2022 Certificate ISO 27001 Certification 2024-2027 View ISO 27001 2022 Certificate |
| #### SOC 2 Type II Report Copy link for SOC 2 Type II Report SOC 2 Type II Report 2024-2025 Request access SOC 2 Type II Report |
| #### DHS CISA Secure Software Attestation Copy link for DHS CISA Secure Software Attestation DHS CISA Secure Software Attestation 2025 Request access DHS CISA Secure Software Attestation |
| #### Sonatype SOC 2 Bridge Letter Copy link for Sonatype SOC 2 Bridge Letter 2026 Sonatype SOC 2 Bridge Letter Request access Sonatype SOC 2 Bridge Letter |
Security Policies
| #### Acceptable Use Policy Copy link for Acceptable Use Policy Request access Acceptable Use Policy |
| #### Business Continuity and Disaster Recovery Policy Copy link for Business Continuity and Disaster Recovery Policy Request access Business Continuity and Disaster Recovery Policy |
| #### Change Management Policy Copy link for Change Management Policy Request access Change Management Policy |
| #### AI Acceptable Use Policy Copy link for AI Acceptable Use Policy Request access AI Acceptable Use Policy |
| #### Cryptographic Management Policy Copy link for Cryptographic Management Policy Request access Cryptographic Management Policy |
| #### Data Classification Policy Copy link for Data Classification Policy Request access Data Classification Policy |
| #### Global Information Security Policy Copy link for Global Information Security Policy Request access Global Information Security Policy |
| #### Information Security Management System Policy Copy link for Information Security Management System Policy Request access Information Security Management System Policy |
| #### Patch Management Policy Copy link for Patch Management Policy Request access Patch Management Policy |
| #### Risk Management Policy Copy link for Risk Management Policy Request access Risk Management Policy |
| #### Secure Software and Systems Development Policy Copy link for Secure Software and Systems Development Policy Request access Secure Software and Systems Development Policy |
| #### Security Incident Management Policy Copy link for Security Incident Management Policy Request access Security Incident Management Policy |
| #### Third Party Risk Assessment Policy Copy link for Third Party Risk Assessment Policy Request access Third Party Risk Assessment Policy |
| #### Vulnerability Management and Monitoring Policy Copy link for Vulnerability Management and Monitoring Policy Request access Vulnerability Management and Monitoring Policy |
Independent Security Assessment
| #### Maven Central Copy link for Maven Central External Penetration Test Report Request access Maven Central |
| #### Sonatype Nexus Repository Copy link for Sonatype Nexus Repository External Penetration Test Report Request access Sonatype Nexus Repository |
| #### Sonatype Lifecycle & Firewall (EU) Copy link for Sonatype Lifecycle & Firewall (EU) External Penetration Test Report (EU Region) Request access Sonatype Lifecycle & Firewall (EU) |
| #### Sonatype Lifecycle (Private Cloud) Copy link for Sonatype Lifecycle (Private Cloud) External Penetration Test Report Request access Sonatype Lifecycle (Private Cloud) |
| #### Sonatype Lifecycle & Firewall (US) Copy link for Sonatype Lifecycle & Firewall (US) External Penetration Test Report (US Region) Request access Sonatype Lifecycle & Firewall (US) |
| #### Sonatype Guide Copy link for Sonatype Guide External Penetration Test Report Request access Sonatype Guide |
| #### Hosted Data Service Copy link for Hosted Data Service HDS Pentest Report Request access Hosted Data Service |
| #### Customer Experience Platforms Copy link for Customer Experience Platforms External Penetration Test Report Request access Customer Experience Platforms |
Other resources
| #### Information Security Management Program Auditing Policy Copy link for Information Security Management Program Auditing Policy Request access Information Security Management Program Auditing Policy |
| #### Sonatype Statement of Applicability ISO 27001:2022 Copy link for Sonatype Statement of Applicability ISO 27001:2022 Request access Sonatype Statement of Applicability ISO 27001:2022 |
Bulk download will only work on resources that are accessible and not view only.