Kaseya
Provider of IT management, remote monitoring and security software for MSPs and internal IT teams, via its IT Complete suite.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| SOC 2 Type 2 | Not published (AICPA framework) | Kaseya entity; 2025 report. Auditor not published; report gated behind trust centre access. | — | — | Current |
| SOC 3 | Not published | Separate Kaseya and Datto SOC 3 reports for 2025. | — | — | Current |
| SOC 1 Type 2 | Not published | ConnectBooster product only; period ending 31 Oct 2025. | — | — | Current |
Compliance Frameworks
SOC 2 Type 2
Partial
SOC 2 Type 2 for Kaseya and a separate report for Datto; auditor and scope not published.
GDPR 2016/679
Partial
Published DPA template and public sub-processor list.
Incident & Breach History
| Date | Summary | Impact | Resolution | Report |
|---|---|---|---|---|
| July 2, 2021 | Attackers exploited zero-day flaws in Kaseya VSA to bypass authentication and push REvil ransomware through the product update mechanism to downstream endpoints. | Per Kaseya: fewer than 60 direct customers compromised, all running on-premises VSA, and fewer than 1,500 downstream businesses affected. No SaaS customers compromised. | Customers told to shut down VSA servers and SaaS infrastructure taken offline on 2 July; Compromise Detection Tool released 3 July; patch and phased restoration followed, with IOCs published. | Report ↗ |
Contact & Responsible Disclosure
- Security Contact [email protected]
- Responsible Disclosure View policy ↗
- Bug Bounty Platform HackerOne (public, paid)
Certification scope caution
**Kaseya is not ISO 27001 certified.** Its trust centre lists no ISO 27001 certificate. The "Earning Your Trust" page states only that the *datacenter facilities* used for IT Complete are maintained to the ISO 27001 standard — that is the hosting provider’s certification, not Kaseya’s ISMS.
NIST CSF, BSIMM and OWASP ASVS Level 2 are referenced as frameworks used, not certifications held. Most trust-centre documents are per-product Customer Responsibility Matrices rather than attestations.
Copyright © 2026 SnapGRC