Question 1

Is Decagon SOC 2 compliant?

Accepted Answer

Yes. Decagon lists a SOC 2 Type II report on its trust center at trust.decagon.ai, available to enterprise buyers on request under NDA. Its security page at decagon.ai/security also shows the SOC 2 mark alongside ISO 27001, HIPAA, CCPA and PCI DSS.

Question 2

Is Decagon ISO 27001 certified?

Accepted Answer

Yes. Decagon carries ISO/IEC 27001, the international information-security management-system standard. It is listed on Decagon's security page (decagon.ai/security) and trust center (trust.decagon.ai). Decagon does not hold ISO 42001, the AI-specific management standard, so ISO 27001 is its secondary security certification for our vetting bar.

Question 3

Is Decagon HIPAA compliant?

Accepted Answer

Yes. Decagon supports HIPAA workflows for healthcare and healthcare-adjacent deployments and will sign a Business Associate Agreement (BAA) with enterprise customers handling protected health information. Confirm the current BAA scope directly with Decagon before purchase.

Question 4

Is Decagon GDPR and CCPA compliant?

Accepted Answer

Yes. Decagon's security page lists both GDPR and CCPA, and it processes customer data under a Data Processing Agreement. Personal data can be handled under the GDPR for EU and UK deployments and the CCPA for California consumers. Retention is configurable per the DPA.

Question 5

Does Decagon have ISO 42001 (AI management) certification?

Accepted Answer

No. As of our August 2026 review, Decagon has not disclosed ISO 42001 (the AI management system standard) or an AIUC-1 attestation. It meets our security criterion through SOC 2 Type II plus ISO 27001 and HIPAA rather than an AI-specific certification, and still passes all seven criteria (7 of 7).

Question 6

Does Decagon offer EU data residency, and does it train on customer data?

Accepted Answer

Decagon runs multi-region infrastructure and its security page names both US and EU regions, so EU-region hosting is available for teams that require it; confirm the exact region and configuration with Decagon before purchase. Decagon states it does not train its models on customer data and offers a training opt-out by default, with retention configurable per the Data Processing Agreement.

Question 7

Which companies use Decagon?

Accepted Answer

Decagon publicly names customers including Notion, Duolingo, Substack, Bilt, Rippling and ClassPass across its case studies at decagon.ai/case-studies, and Forbes has reported it is used by more than 100 companies. These are publicly cited references, which is why Decagon passes the reference-customer criterion.

Is Decagon SOC 2 compliant? Yes, SOC 2 Type II, plus ISO 27001 and HIPAA.

Decagon data residency, training opt-out and HIPAA, in detail

Where is Decagon data stored, and does it offer EU data residency?

Does Decagon train its models on customer data?

Does Decagon support HIPAA and sign a BAA?

Decagon

Security Certifications

Public Reference Customers

Pricing Transparency

Data Residency and Training Opt-Out

Outcome Accountability

Time in Market

Team Composition