View Handshake Trust center's compliance certifications, resources and subprocessors

Handshake Trust center

At Handshake, we're committed to delivering industry-leading privacy and security infrastructure with transparency. We ensure the information we receive is handled with care, and complies with all applicable standards, laws and regulations globally.

Handshake’s commitment to protecting data privacy goes beyond basic compliance; we continuously evaluate and refine our processes and policies to lead the industry in responsible data stewardship, continuous employer screening, and full student control.

Handshake Trust Portal

Certifications

This trust portal is being prepared and will be available soon.

Trust portal coming soon

Controls

Trusted by

Documentation

Documents will appear here once they are published.

By requesting access, you agree to {companyName}'s <privacyPolicy>Privacy Policy</privacyPolicy>. This trust center is powered by <wolfiaPrivacy>Wolfia</wolfiaPrivacy>.

Fill out this form to request access. We'll review your request and get back to you shortly.

Error submitting request

We'll review your request to access our private documents and get back to you shortly.

Your access request has been successfully submitted.

Access request submitted

Request access to documentation

We will process your questionnaire and email {email} when it's ready.

Questionnaire submitted

Submit a questionnaire

Subprocessors

By signing up for email notifications, you agree to {companyName}'s <privacyPolicy>Privacy Policy</privacyPolicy>. Notifications are powered by <wolfiaPrivacy>Wolfia</wolfiaPrivacy>.

Receive email notifications when {companyName} publishes important updates to their Trust Center.

You will now receive email notifications when {companyName} publishes important updates.

Subscribed!

Subscribe to updates

Updates

Independent auditor assessment of an organization's controls at a specific point in time, based on AICPA Trust Services Criteria. SOC 2 Type I reports evaluate the design of security, availability, processing integrity, confidentiality, and privacy controls. This certification provides stakeholders with assurance that appropriate controls are properly designed to meet the selected trust principles.

System and Organization Controls Type I

Global security standard developed by the Payment Card Industry Security Standards Council to protect cardholder data. PCI DSS compliance requires organizations handling payment information to implement strict technical and operational controls, including encryption, access restrictions, network monitoring, and regular vulnerability testing. Certification demonstrates adherence to the industry’s benchmark for securing payment systems and reducing risk of data breaches.

Payment Card Industry Data Security Standard

UK government-backed certification demonstrating protection against common cyber threats. Cyber Essentials certification verifies implementation of fundamental security controls including boundary firewalls, secure configuration, access control, malware protection, and security update management.

UK Cyber Essentials

Texas Risk and Authorization Management Program certification framework for cloud services used by Texas state agencies. TX-RAMP provides standardized security requirements and assessment procedures to ensure vendors meet state-level data protection obligations. Certification levels validate the cloud provider’s ability to safeguard sensitive government information and maintain compliance with Texas administrative code requirements.

Texas Risk and Authorization Management Program

Self-assessment against Cloud Security Alliance's comprehensive cloud control matrix demonstrating security posture transparency. Organizations complete detailed questionnaires covering 197 control areas across 16 domains including data security, identity management, and incident response. STAR Level 1 provides public registry entry enabling customers to evaluate cloud provider security practices.

CSA Security, Trust & Assurance Registry Level 1

Legal mechanism enabling compliant personal data transfers from the European Union to certified US organizations. Participating companies self-certify adherence to privacy principles including notice, choice, accountability, and data security enforced by the FTC. This framework replaces Privacy Shield, providing renewed legal basis for transatlantic data flows essential for digital commerce.

EU-U.S. Data Privacy Framework

Enables compliant personal data transfers between Switzerland and the United States through self-certification to agreed privacy principles. Organizations must commit to robust privacy protections including notice, choice, accountability for onward transfer, and data integrity. This framework ensures Swiss data receives adequate protection when processed by US organizations, meeting Swiss Federal Data Protection Act requirements.

Swiss-U.S. Data Privacy Framework

Extends EU-US Data Privacy Framework protections to UK data transfers, enabling compliant data flows between the UK and US. Organizations certified under this framework demonstrate commitment to UK data protection standards while facilitating international business operations. This certification builds upon the EU-US DPF foundation with UK-specific requirements.

UK Extension to the EU-U.S. Data Privacy Framework

Voluntary Product Accessibility Template documenting a product’s conformance with accessibility standards such as Section 508, WCAG, and EN 301 549. A VPAT enables organizations to transparently communicate how their technologies support users with disabilities. Completion of a VPAT facilitates accessibility compliance, procurement decisions, and demonstrates a commitment to inclusive design.

Voluntary Product Accessibility Template

New York City law requiring bias audits for AI systems used in hiring and employment decisions. Organizations must conduct annual independent bias audits, publish results publicly, and provide notices to candidates about AI use. This pioneering regulation establishes transparency requirements and accountability measures for algorithmic hiring tools affecting NYC job seekers.

Automated Employment Decision Tools

Handshake uses **AI-powered autofill, messaging assistance, audience selection, and candidate relevance ranking** to reduce manual work for employers and surface more relevant students and applicants, while keeping employers fully in control and never using AI to make hiring decisions or train third-party models on employer data. 

For a detailed breakdown of each feature and our responsible AI principles, see **[About AI-Powered Features in Handshake for Employers](https://support.joinhandshake.com/hc/en-us/articles/34209924173207-About-AI-Powered-Features-in-Handshake-for-Employers)**.


AI Features

Disney

TikTok

McDonald's

Target

Johnson & Johnson

Teach For America

SOC 2 Type II Report

PCI DSS Attestation of Compliance and Self-Assessment Questionnaire D

Cloud Platform Architecture Diagram

Add 'Authorization: Bearer <access_token>' header to access private documents. Request access via the trust center to get a token.

# Handshake Security Update: Salesforce Drift Incident

Protecting customer data and maintaining transparency are at the core of Handshake’s mission. We are committed to keeping customers informed about security developments that may affect their organization and want to share a detailed update regarding the recent Salesforce Drift incident.

## What Happened?

On Wednesday, August 27, Handshake learned of a compromise involving a third-party application, **Salesloft’s Drift**, which resulted in unauthorized access and exfiltration of data stored in our Salesforce environment. Once notified, Handshake took immediate action to secure the environment, disconnecting the application from its Salesforce instance and launching a comprehensive investigation with our internal security team.

The impact of this event is confined to our Salesforce environment and did not implicate Handshake’s core products, services, systems, or infrastructure.

## What Information May Be Affected?

Our investigation determined that the exposed data is limited to business contact information and specific Salesforce-related content, which includes:

* **Customer (company) name**
* **Business address and contracting information**
* **The name, job title, business phone number, and company email address** of the customer representative

## What Did Handshake Do?

Handshake took immediate steps to secure our environment and mitigate risks:

* **Disconnected and revoked** Salesloft Drift’s access to Handshake’s Salesforce instance. Out of an abundance of caution, we also disconnected all integrations of Drift with other applications, such as Handshake’s core product, marketing portal, and other internal sales applications.
* **Rotated relevant API access tokens** to prevent further access.
* **Initiated a full investigation** into the scope and impact of the breach, working closely with Salesforce and external experts.
* **Prioritized additional safeguards** and protocol enhancements to prevent similar incidents in the future.
* Activated **continuous monitoring** for any potential exposure or misuse of exfiltrated data tied to the incident.

Handshake will continue to provide updates should any new developments arise.

## What You Can Do

We recommend the following actions to ensure your security:

* **Exercise caution** with unsolicited emails, phone calls, or requests for sensitive information. Always verify the source and do not disclose passwords or payment information through unverified channels.
* All communications from Handshake will come from trusted, official channels. Our email outreach will always come from **@joinhandshake.com**. Handshake Support will never ask for authentication or authorization details via unsolicited outreach, phone, or SMS.
* **Report any suspicious activity** to [security@joinhandshake.com](mailto:security@joinhandshake.com).

## Need Assistance or Have Questions?

Handshake’s Customer Success and Support teams are available to assist you through all regular support channels. You may also contact the Handshake Security team directly at [security@joinhandshake.com](mailto:security@joinhandshake.com).

Your trust is paramount to us. Thank you for your continued partnership with Handshake.

Salesforce Drift Incident Impact Communication Aug 2025

Handshake has successfully completed its **PCI DSS v4.0.1** assessment as a **Service Provider**, using the **Self-Assessment Questionnaire D (SAQ-D)**. The assessment and resulting **Attestation of Compliance (AOC)** were completed by a **Qualified Security Assessor (QSA)** from our independent auditor.

As part of our commitment to transparency and security, we’ve made both the AOC and our PCI Responsibility Matrix available for download to our customers through our [**Trust Portal**](https://trust.joinhandshake.com/). These documents outline our compliance status and clarify the shared responsibilities between Handshake and our customers when handling cardholder data.

Thank you for your continued trust and support.

PCI DSS v4.0.1 Attestation of Compliance Now Available

We are pleased to inform our customers that we have successfully issued our **SOC 2 report for Handshake Education and Handshake Basic, Plus, Talent Engagement Suite and Talent Essentials system**. The report was designed and implemented throughout the period **March 1, 2024 to February 28, 2025**, in accordance with the description criteria. This achievement underscores our ongoing commitment to maintaining the highest standards of data security and privacy. For more details, please visit our [Trust Portal](https://trust.joinhandshake.com/).

Thank you for your continued trust and support.
**The Handshake Security Team**.

Handshake 2024-2025 SOC2, Type II

Dear Valued Customer,

We are pleased to announce the results of our latest penetration test, conducted in the second quarter of 2025. The assessment aimed to identify potential vulnerabilities and ensure the security of our systems. A letter of attestation can be downloaded from our trust portal.

## Key Findings

* **No Critical or High Findings:** The penetration test revealed no critical or high-risk vulnerabilities that remain unaddressed.

## Commitment to Security

At **Handshake**, we prioritize the security of our systems and data. Regular penetration testing is a key component of our proactive security strategy. We continually monitor and enhance our security practices to protect against emerging threats.

Thank you for your trust in us!

Best regards,
Handshake Security Team.

Handshake Latest Penetration Test Results

### Successful Completion of PCI Audit and Availability of AOC.

Dear Valued Customer,

We are excited to inform you that we have successfully completed our PCI audit and have received our Attestation of Compliance (AOC) from our Qualified Security Assessor (QSA). This achievement demonstrates our commitment to maintaining the highest standards of security and compliance. To provide you with the utmost transparency and assurance, we have made the AOC available on our customer trust portal. Alongside the AOC, you will also find our responsibility matrix, which outlines the roles and responsibilities regarding our compliance efforts.

We understand the importance of security and compliance in your business operations, and we are dedicated to continuously improving our processes to meet your needs. Should you have any questions or require further information, please do not hesitate to reach out.

Thank you for your trust and partnership.

Best regards,
**The Handshake Security Team**.

PCI Compliance Update!

We want to address a recent security incident involving the company Snowflake. Please rest assured, **Handshake does not use Snowflake and is not affected by this incident.** We are keeping an eye on the situation. At Handshake, the security of your data is our priority.

Statement about Snowflake Incident

We are pleased to inform our customers that we have successfully issued our SOC 2 report for the past year. This achievement underscores our ongoing commitment to maintaining the highest standards of data security and privacy.
In addition to our SOC 2 compliance, we have also renewed our Cyber Essentials certificate. This renewal further validates our dedication to robust cybersecurity practices and protecting our customers' information. For more details, please visit our [Trust Portal](https://trust.joinhandshake.com/).


Thank you for your continued trust and support.
**The Handshake Security Team**.

Handshake Trust Portal Trust Center