Q39
Are you PCI DSS compliant? At what level?
PCI DSS compliance claim found on trust page (Vendor attested)
Public evidencemedium confidence
SendGrid Vendor Risk & Security Assessment
ThirdProof independently checks public intelligence sources to show what your team can verify about SendGrid before SendGrid sends a questionnaire or a security document.
SendGrid's SOC 2 report is confidential. There is no public registry for SOC 2, so the report itself has to come from SendGrid — ThirdProof does not hold or distribute it. What this page gives you is an independent assessment built from evidence anyone can check, and a record of which certifications are registry-verified versus claimed on SendGrid's own trust page.
⚠ SendGrid was not found in the FedRAMP Marketplace. Checked August 2026.
This matters if you place federal workloads with this vendor: agencies may only use cloud services holding a FedRAMP certification. It carries no weight for a purely commercial deployment.
Risk
Tier 3 — Moderate RiskEvidence confidence
100%25 of 27 sources returned data
Questionnaire
77 / 133 answered58% from public evidence
Last assessed
Aug 27, 2026Evidence confidence measures how much of the evidence ThirdProof set out to gather it was able to gather and corroborate. It is not a statement that every fact about this vendor is known.
🟢IP Reputation: Abuse score: 0%, 0 reports🟡SSL/TLS: TLSv1.3🟢Domain Age: 17.4 years🟢Infrastructure: 2 open ports, 0 CVEs
- FedRAMP Status
- SendGrid is not listed on the FedRAMP Marketplace (checked August 2026).
- SOC 2 Status
- SendGrid — SOC 2: Vendor attested — trust page. SOC 2 reports are confidential with no public registry, so compliance status is not publicly verifiable. Request the full Type II report and bridge letter directly from the vendor.
- Sanctions Screening
- SendGrid returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
- Risk Tier
- ThirdProof assigned SendGrid a Moderate Risk tier across 27 intelligence sources, 25 of which returned usable evidence (evidence confidence 100%).
27 sources queried, 25 returning usable evidence. The SendGrid assessment ThirdProof has already run covers both a risk report and an auto-filled security questionnaire, with anything the evidence could not settle listed as an open question.
Get the Latest SendGrid Vendor Assessment →Full risk assessment + 133-question security questionnaire|Free · Delivered by email
Certification & Compliance Status
Security questionnaire — auto-filled
77 questions answered before SendGrid responds.
ThirdProof used public evidence to pre-fill 58% of a 133-question vendor security questionnaire — without waiting for SendGrid. The remaining 56 are listed as open, so the follow-up you send is short and specific.
Q37
Do you have a current SOC 2 Type II report?
SOC 2 Type II: Vendor attested — trust page
Public evidencemedium confidence
Q42
Are you GDPR compliant? Do you have a DPA available?
SendGrid is GDPR compliant and provides a Data Processing Addendum (DPA) available at craemer.com and Twilio's resource center for processing personal data under GDPR.
Public evidencehigh confidence
Q40
Are you HIPAA compliant? Do you sign BAAs?
HIPAA compliance / BAA claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q23
Is data encrypted at rest? What encryption standard is used (e.g., AES-256)?
SendGrid encrypts data at rest using AES-256 bit encryption and enforces TLS encryption for data in transit.
Public evidencehigh confidence
+ 72 additional evidence-backed answers
Get the Complete SendGrid Assessment →
See all 133 questions, evidence links, findings, and the vendor follow-ups still required.
What you can verify before SendGrid sends anything
Independent evidence settles part of the review. The rest still needs the vendor.
Public evidence establishes
- No Sanctions Matches Found
- No SEC Enforcement Filings Found
- Legal Entity Actively Registered
- Clean domain reputation
- Clean Safe Browsing Status
Still requires vendor confirmation
- Current SOC 2 report and its audit scope
- Access Control — 8 of 12 questions need vendor input
- Data Security — 7 of 14 questions need vendor input
- Incident Response — 7 of 10 questions need vendor input
- Vulnerability Management — 6 of 8 questions need vendor input
Reviewing SendGrid for your company?
Get the complete ThirdProof assessment now, then use the same workflow to assess the rest of your vendor stack.
5 vendors free · No credit card
Need ongoing vendor reviews? ThirdProof includes up to 50 vendor assessments per month for $399. See pricing
Executive Summary
Narrative analysis for SendGrid
SendGrid is a mature, well-established email delivery and marketing platform owned by Twilio, serving a global customer base with multi-region infrastructure and a 99.99% uptime SLA.
Area Requiring Attention
The vendor demonstrates strong foundational security practices, including AES-256 encryption at rest, TLS 1.3 in transit, valid SAML 2.0 SSO, and a 24/7 incident response capability. However, the assessment identifies three material areas requiring attention: (1) unverified certification claims—SOC 2, ISO 27001, PCI DSS, and HIPAA are vendor-attested but lack independent registry confirmation; (2) AI data practices that favor vendor interests—customer data may be used for AI model training by default unless customers actively opt out, with indefinite retention for AI processing; and (3) HTTP security header gaps—the marketing site received a D- grade (25/100) from HTTP security scanner, indicating missing or misconfigured security headers despite valid TLS and HSTS configuration.
The full risk rationale, every finding and the recommended vendor follow-ups are in the complete assessment below.
Independence Statement
All evidence was independently sourced from external registries, public threat intelligence platforms, domain registries, and automated security scans conducted without vendor participation.
Investigation Findings
4 findings identified for SendGrid
3 medium1 low
medium
Aging adverse media in historical archives
Historical news archives reference SendGrid account compromise in OpenAI invoice scams and alleged breach claims, but these articles are aged (511+ days) and severity has been downgraded accordingly. The 'alleged massive SendGrid breach' was repudiated by the vendor, and phishing/account takeover incidents reflect attacker exploitation of customer credentials rather than platform vulnerabilities. …
medium
AI model training requires customer opt-out
[SendGrid's privacy policy](https://www.twilio.com/en-us/legal/privacy) indicates that customer data may be used for AI model training unless customers actively opt out. This is a material data practice difference from vendors that commit to zero training by default. …
medium
Indefinite data retention for AI processing
SendGrid's [privacy policy](https://www.twilio.com/en-us/legal/privacy) permits indefinite retention of customer data for AI processing purposes, separate from the standard 30–60 day deletion window for transactional content. This means data retained for AI purposes may persist beyond normal data lifecycle expectations, increasing exposure over time.
low
Subprocessor list could not be parsed
A subprocessor page (https://sendgrid.com/subprocessors) was discovered but automated parsing could not extract individual subprocessor entries. The page may use dynamic JavaScript rendering, embedded formats, or proprietary markup that prevents automated extraction. …
Showing the 4 most severe of 5 findings.
✓
Security Strengths
Evidence that positively supports SendGrid's posture
Neutral observations, source coverage notes and items ThirdProof could not independently establish are recorded separately in the complete assessment — they are not counted as strengths.
✓
No Sanctions Matches Found
Sanctions & Watchlist Screening →✓
No SEC Enforcement Filings Found
SEC Filing Search →✓
Legal Entity Actively Registered
Business Registration →✓
Clean domain reputation
Threat Intelligence →✓
Clean Safe Browsing Status
Malware & Phishing Check →✓
Clean Website Security Scan
Website Security Scan →✓
Clean IP Reputation
IP Reputation →SendGrid complete vendor assessment
Tier 3
Moderate Risk
77 / 133
questionnaire answers
27
sources checked
Aug 27, 2026
assessment date
- Complete 133-question security questionnaire
- Evidence behind every answered item
- Full findings and risk rationale
- Recommended vendor follow-ups
- Source and evidence inventory
- Source-cited PDF assessment
Risk tiers are set by a deterministic rules engine. AI summarises sourced evidence and writes the narrative; it does not assign the tier. Read the full methodology.
Compliance Resources
→ SOC 2 Vendor Assessment: What Your Auditor Actually Reviews→ SOC 2 CC9.2 Vendor Management with ThirdProof→ HIPAA Vendor Risk Assessment with ThirdProof→ FedRAMP Authorized Vendor List→ FedRAMP Vendor Authorization Status Guide→ Sanctions Screening for Vendor Due Diligence→ Vendor Due Diligence Checklist→ All 27 Intelligence Sources
Frequently asked about SendGrid
Is SendGrid FedRAMP authorized?+
SendGrid was not found in the FedRAMP Marketplace when it was checked on August 27, 2026. Absence of a public record is not evidence that the certification is absent; organisations with a hard requirement should confirm directly with the vendor.
Does SendGrid have SOC 2 Type II?+
SendGrid states that it maintains SOC 2 on its trust page. Because SOC 2 reports are generally confidential and there is no public SOC 2 registry, ThirdProof classifies this as vendor-attested until the current report and its scope have been reviewed. Request the report directly to confirm the audit period and which systems are in scope.
Is SendGrid on the OFAC sanctions list?+
SendGrid returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of August 2026.
What is SendGrid's vendor risk tier?+
ThirdProof assigned SendGrid a risk tier of Moderate Risk as of August 2026, with an evidence confidence of 100% across 27 intelligence sources. Evidence confidence describes how much of the evidence ThirdProof set out to gather it was able to gather — not certainty about every fact concerning SendGrid.
Has SendGrid had any data breaches or security incidents?+
ThirdProof's assessment as of August 2026 records 1 incident-related finding for SendGrid. The most severe concerns aging adverse media in historical archives. Each finding states whether the incident affected SendGrid's own systems, a customer's environment, or a third party — a distinction that changes what you should ask about — and links to the source it was drawn from. The complete assessment carries all of them with their evidence.
Is SendGrid PCI DSS compliant?+
PCI DSS compliance claim found on trust page (Vendor attested) ThirdProof records this from SendGrid's published compliance evidence; request the current Attestation of Compliance to confirm the scope that applies to your integration.
Does SendGrid support HIPAA and sign BAAs?+
HIPAA compliance / BAA claim found on trust page (Vendor attested) If protected health information is in scope for your use, confirm BAA availability in writing before contracting.
Can ThirdProof pre-fill a SendGrid security questionnaire?+
Yes. ThirdProof answered 77 of 133 questions (58%) about SendGrid from public evidence, before contacting the vendor. Each answered item carries the evidence it was drawn from. The remaining 56 are listed as open, so the follow-up you send SendGrid is short and specific.
Represent SendGrid? Submit updated security evidence.
If SendGrid is in your vendor stack, can you prove you assessed them?
SOC 2 CC9.2, HIPAA, PCI DSS and CMMC all require documented vendor due diligence — not just knowing the answer, but holding evidence that you verified it. The SendGrid assessment above is already written; ask for it and it lands in your inbox.
✓ This assessment: free, no account required✓ Your first 5 vendor investigations are free✓ No credit card required