> AI agents: this is one page from Mammoth Analytics documentation. The index of all pages as Markdown is https://docs.mammoth.io/llms.txt. Append `.md` to any docs URL, or send `Accept: text/markdown`, to get Markdown.

# Compliance

> Mammoth's SOC 2 Type II and ISO 27001 certifications, GDPR and HIPAA support, and how the Activity Log supports your own audit and reporting.

Mammoth is SOC 2 Type II and ISO 27001 certified and supports GDPR and HIPAA compliance. This page is for security and compliance reviewers. It covers what is certified and how the Activity Log supports your own audit and reporting obligations.

## Certifications

| Certification | Scope |
| --- | --- |
| **SOC 2 Type II** | Security controls attested by an independent audit |
| **ISO 27001** | Information security management system |

To request security documentation, contact your account manager or [support@mammoth.io](mailto:support@mammoth.io).

## GDPR

Customer data is stored in AWS Ireland (EU). Your organization is the data controller and Mammoth is the data processor.

Mammoth also handles GDPR deauthorization requests for third-party platform integrations (for example, Shopify) through webhooks when an end customer revokes consent.

## HIPAA

Mammoth supports HIPAA compliance for healthcare customers. To discuss your requirements, contact your account manager or [support@mammoth.io](mailto:support@mammoth.io).

## Audit trail for compliance reporting

The Activity Log records who did what and when across your workspace. See [Audit Logs](https://docs.mammoth.io/learn/security-overview/audit-logs/) for how to filter and export it.

---
Source: https://docs.mammoth.io/learn/security-overview/compliance.md · Updated: 2026-10-13