Pax8
Cloud commerce marketplace through which managed service providers buy, provision and bill third-party software subscriptions.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| ISO/IEC 27001 | Not published | Badge shown on the Pax8 trust centre. No version year, auditor, scope statement or dates public; certificate gated. | — | — | Current |
| SOC 2 Type 2 | Not published | Badge shown on trust centre; report gated behind access request. | — | — | Current |
| Cyber Essentials | Not published | Badge shown on trust centre; certificate, scope and dates not public. | — | — | Current |
| PCI DSS | Not published | Badge shown on trust centre; level, AoC status and QSA not public. | — | — | Current |
Compliance Frameworks
ISO/IEC 27001:2022
Partial
Stated on the trust centre with no version, auditor, scope or dates publicly available.
SOC 2 Type 2
Partial
Stated on trust centre; report gated.
Cyber Essentials
Partial
Badge only; certificate not public.
PCI DSS v4.0
Partial
Badge only; no AoC or level published.
GDPR 2016/679
Partial
UK ICO registration certificate listed on the trust centre. DPA and sub-processor list exist but are gated.
Data Handling
Data Residency Regions
US storage with standard contractual clauses; no regional residency options published
Encryption at Rest
No
Encryption in Transit
No
Incident & Breach History
| Date | Summary | Impact | Resolution | Report |
|---|---|---|---|---|
| Jan. 13, 2026 | A Pax8 account manager emailed a CSV to fewer than 40 UK partners containing business data on approximately 1,800 partners across more than 56,000 rows. | Exposed customer organisation names, Microsoft SKUs and licence counts, NCE renewal dates, partner names and IDs, gross and net bookings, account owner details and commitment term end dates. Pax8 stated the file contained no personally identifiable information. Threat actors were subsequently reported approaching affected MSPs offering to buy the dataset. | Recipients were contacted immediately and asked to delete the email and attachment, with 1:1 follow-up calls to confirm deletion, and an internal review was launched. No vendor post-incident advisory was published. | — |
Legal & Privacy
- Privacy Policy View ↗
Contact & Responsible Disclosure
- Security Contact [email protected]
- Responsible Disclosure View policy ↗
- Bug Bounty Platform None — vendor states it has no formal bug bounty
Risk shape differs from the RMM vendors
Pax8 is a **distribution and marketplace intermediary with delegated admin (GDAP) into partner tenants** — a different risk profile from the RMM platforms, and worth assessing on that basis rather than by product certification alone.
All four certification badges are unauthenticated claims only; the certificates, auditors, scopes and dates sit behind a SafeBase access request. Pax8 has signed the CISA Secure by Design pledge and names its security leadership publicly (Chief Trust & Security Officer, DPO for EMEA).
Copyright © 2026 SnapGRC