Datto
MSP-focused business continuity, backup, disaster recovery, RMM and networking vendor, acquired by Kaseya in 2022 and run as a Kaseya brand.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| SOC 2 Type II | Not published | Datto-scoped report, distinct from the Kaseya report; period appears to end 31 Oct 2025. Access gated. | — | — | Current |
| SOC 3 | Not published | Datto SOC 3 Report 2025. Access gated. | — | — | Current |
Compliance Frameworks
SOC 2 Type 2
Partial
Datto-scoped SOC 2 Type II, separate from Kaseya’s; auditor not published.
GDPR 2016/679
Partial
Now governed by Kaseya’s privacy statement, DPA and sub-processor list.
Data Handling
Data Residency Regions
Datto RMM: eu-west-1 Ireland, us-west-2 Oregon, us-east-1 Virginia, ap-southeast Sydney (isolated platforms)
Encryption at Rest
No
Encryption in Transit
No
Contact & Responsible Disclosure
- Security Contact [email protected]
- Responsible Disclosure View policy ↗
- Bug Bounty Platform HackerOne (via Kaseya)
Consolidation into Kaseya
Datto’s trust centre, legal pages and vulnerability disclosure programme now redirect to Kaseya. Datto’s former in-house bug bounty ($101–$10,101) is **superseded** — reports go to Kaseya’s HackerOne programme.
**No public evidence** of a security incident compromising Datto’s own products. Note that the 2021 Kaseya VSA incident predates Kaseya’s 2022 acquisition of Datto and did not involve Datto products.
Kaseya’s trust pages still reference EU-U.S. Privacy Shield, which is defunct as a transfer mechanism — treat that claim as stale.
Copyright © 2026 SnapGRC