Trainline

Other United Kingdom Website Reviewed Sept. 22, 2026

Rail and coach ticketing platform; Trainline Business provides UK and European train booking, expense reporting and travel management for companies.

Report an issue with this profile

Certifications & Accreditations

Certification Certifying Body Scope Achieved Expiry Status
ISO 27001 BSI Certificate IS 775108, stated as Trainline. Revision year not stated, no detailed scope statement and no issue or expiry dates published. — — Current
ISO 22301 BSI Certificate BCMS 763415, stated as Trainline. No scope statement or dates published. — — Current
PCI DSS Level 1 No QSA named Stated as "PCI Level 1 compliant both as a merchant and as a service provider". No certificate number or dates published. — — Current

Compliance Frameworks

ISO/IEC 27001:2022
Partial
BSI certificate IS 775108 cited, but the revision year (2013 vs 2022), covered legal entity and dates are not published — verify the number with BSI.
ISO 22301:2019
Partial
BSI certificate BCMS 763415 cited; scope and dates not published.
PCI DSS v4.0
Partial
Level 1 claimed as both merchant and service provider; no QSA, AoC or dates published.
GDPR 2016/679
Full
DPO contact published ([email protected]); ICO registration Z5402080. Controllers: Trainline.com Limited and Trainline SAS. No public DPA.

Contact & Responsible Disclosure

Verify the certificate numbers

Trainline is one of the few vendors here to publish **certificate numbers with a named certifying body** (BSI: IS 775108 and BCMS 763415). They could not be confirmed against the BSI directory automatically — **verify at bsigroup.com/validate-bsi-issued-certificates or via [email protected] before relying on them.**

The security page does not state the ISO 27001 revision year, does not name the covered legal entity and publishes no issue or expiry dates.

No SOC 2 or Cyber Essentials claimed. Trainline.com Limited, 1 Stonecutter Street, London EC4A 4AH.

Assess Trainline in your own vendor risk programme

SnapGRC lets you send security questionnaires, track DPA status, manage sub-processors, and maintain a supplier risk register — all audit-ready.

Supplier Management Free Risk Register