NinjaOne
Cloud-based endpoint management, patching, remote access and backup platform used by MSPs and internal IT teams.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| ISO/IEC 27001:2022 | Schellman | Company ISMS; Statement of Applicability published on the trust page. Certificate document listed as NinjaOne ISO 27001 2025. | — | — | Current |
| SOC 2 Type 2 | Not published | 2025 report; access requires a mutual NDA. | — | — | Current |
| SOC 3 Type 2 | Not published | 2025 report, publicly viewable on the trust page. | — | — | Current |
| FedRAMP Moderate (Authorized) | FedRAMP (Agency path, Rev5) | NinjaOne for Government only — a separate offering, NOT the commercial NinjaOne platform. | Sept. 10, 2025 | — | Current |
| FedRAMP High (Ready) | FedRAMP | NinjaOne for Government. Ready designation only — not authorized. | — | — | Current |
| TX-RAMP | Texas DIR | Badge shown on trust page; detail not published. | — | — | Current |
| PCI DSS self-assessment | Self-assessed (no QSA) | Trust centre lists PCI self-assessment reports — SAQ, not QSA-validated certification. | — | — | Current |
Compliance Frameworks
ISO/IEC 27001:2022
Full
ISO 27001:2022 certified by Schellman with a published Statement of Applicability.
SOC 2 Type 2
Full
SOC 2 Type 2 (2025) under MNDA; SOC 3 Type 2 publicly viewable.
PCI DSS v4.0
Partial
Self-assessment questionnaires only; not QSA-validated.
GDPR 2016/679
Partial
Published DPA template and public per-vendor sub-processor list. NinjaOne describes GDPR alignment via contractual addendums.
Data Handling
Data Residency Regions
Customer-selectable AWS region; sub-processor regions span USA, Canada, Germany, Australia, Ireland, UK, Singapore, Japan
Encryption at Rest
No
Encryption in Transit
No
Contact & Responsible Disclosure
- Security Contact [email protected]
- Responsible Disclosure View policy ↗
- Bug Bounty Platform HackerOne (private, invitation-only)
Read the FedRAMP scope carefully
NinjaOne’s FedRAMP Moderate authorization covers **"NinjaOne for Government"**, a distinct offering — not the commercial platform most MSPs buy. FedRAMP High is **Ready**, not Authorized.
DORA, GDPR and HIPAA are described by NinjaOne as alignment "through contractual addendums", not certifications.
**No public evidence** of a compromise of NinjaOne’s own infrastructure. Researchers have documented threat actors abusing NinjaOne RMM trials as an attack tool against third parties — that is platform abuse, not a NinjaOne breach.
Copyright © 2026 SnapGRC