PCI DSS-Compliant Analytics Vendors
Analytics vendors are evaluated against PCI DSS when they handle the workflows this framework governs. Currently, 3 vendors in our Analytics category hold PCI DSS certification and 3 hold it partially or conditionally. Each listing below links to the vendor's full compliance profile.
Analytics vendors that hold PCI DSS certification
Power BI
19/32Business intelligence and data visualization platform, part of Microsoft's compliance program (same certifications as Microsoft 365/Azure).
Looker
12/32Business intelligence and data analytics platform on Google Cloud with LookML semantic modeling.
PCI DSS certification at Google Cloud platform level. cardholder-data use case support not confirmed
Typeform
8/32Online form and survey builder.
PCI DSS Merchant Level 3 certified
Jotform
6/32Online form builder and workflow automation platform.
Hotjar
3/32Behavior analytics platform (heatmaps, session recordings, surveys) for websites.
SAQ-A self-assessment
SurveyMonkey
3/32Online survey and feedback platform.
These analytics vendors do not currently hold PCI DSS certification:
- Amplitude (not documented)
- Mixpanel (not documented)
- Tableau (not documented)
- Crazy Egg (not documented)
- Qlik (not documented)
- Domo (not documented)
- Sisense (not documented)
- ThoughtSpot (not documented)
- Heap (not documented)
- Google Analytics (not documented)
- Adobe Analytics (not documented)
- Qualtrics (not documented)
- Alchemer (not documented)
- Formstack (not documented)
- Pendo (not documented)
- FullStory (not documented)
- LogRocket (not documented)
- PostHog (not documented)
Know a vendor we're missing?