Question 1

Is Clay SOC 2 compliant?

Accepted Answer

Yes. Clay completed a SOC 2 Type II audit (announced September 2024) and lists the report in its Trust Center at trust.clay.com, available to request under NDA. SOC 2 Type II tests controls over a monitoring window rather than at a single point in time, which is the report type regulated buyers should request.

Question 2

Does Clay sign a Data Processing Agreement (DPA)?

Accepted Answer

Yes. Clay provides a signed Data Processing Agreement on request; buyers can obtain it by contacting security@clay.com. Clay acts as a data processor, states it uses customer data only to provide the service, and publishes its list of AI subprocessors in its Trust Center at trust.clay.com.

Question 3

Is Clay ISO 27001 certified?

Accepted Answer

ISO/IEC 27001 is listed on Clay's Trust Center at trust.clay.com and sits within Clay's Vanta-managed compliance program alongside its SOC 2 Type II report. Buyers requiring a formal certificate for a procurement file should request the current ISO 27001 certificate directly through the Trust Center before purchase.

Question 4

Does Clay have ISO 42001 (AI management) certification?

Accepted Answer

Not yet. Clay has publicly stated it plans to pursue additional certifications including ISO/IEC 42001, the AI management-system standard, but as of April 2026 it is not certified. This is the one criterion Clay does not clear, which is why Clay passes six of our seven criteria rather than seven.

Question 5

How many of the seven criteria does Clay pass?

Accepted Answer

Six of seven. Clay clears the security floor (SOC 2 Type II plus ISO 27001 on its Trust Center), publishes named reference customers including Anthropic, Notion, and Ramp, has public pricing ($185 to $495 per month after its March 2026 reset), a data residency and training opt-out statement backed by its DPA, a credits-based outcome model with published benchmarks, more than six months in production (founded 2017), and a public team page with named founders. The single miss is ISO 42001, which Clay has stated it plans to pursue.

Is Clay SOC 2 compliant? Yes, SOC 2 Type II. Does Clay sign a DPA? Yes, on request.

Clay

Security Certifications

Public Reference Customers

Pricing Transparency

Data Residency and Training Opt-Out

Outcome Accountability

Time in Market

Team Composition