American Express Global Business Travel

Other United States Website Reviewed Sept. 22, 2026

Corporate travel management company providing travel, expense and meetings and events software and services to business clients worldwide.

Report an issue with this profile

Compliance Frameworks

GDPR 2016/679
Partial
EU-approved Binding Corporate Rules published as the accountability instrument (EDPB listing could not be independently verified). A DPO is referenced but not named; UK privacy operations at 5 Churchill Place, London. No ICO number and no DPA published.

Contact & Responsible Disclosure

Assurance position

**No public evidence of ISO 27001, SOC 2, PCI DSS or Cyber Essentials** — Amex GBT publishes no trust or certification page at all. The only verifiable formal accountability instrument is its **EU-approved Binding Corporate Rules**, which is a data protection mechanism, not a security certification. The EDPB listing returned a 404 on checking, so treat the BCR detail as unverified.

⚠️ Despite the URL path amexglobalbusinesstravel.com/**bugcrowd**/, the named operator of the disclosure programme is **Synack** — do not record Bugcrowd as the platform. The programme explicitly offers no compensation, with a 48-business-hour acknowledgement commitment and safe harbour.

Listed entity: Global Business Travel Group, Inc. (NYSE: GBTG).

Assess American Express Global Business Travel in your own vendor risk programme

SnapGRC lets you send security questionnaires, track DPA status, manage sub-processors, and maintain a supplier risk register — all audit-ready.

Supplier Management Free Risk Register