
Trust at Yubico
Trust at Yubico | Yubico Enterprise Security
Everything you need to complete your security review is here. Browse documents, certifications, and compliance details with confidence. Our Trust Center is regularly updated to reflect the latest audit results, and subprocessor disclosures.
Yubico's Customer Trust and Security Philosophy
The YES team defines requirements, provides capabilities, and offers training to enable Yubico to mitigate threats, maintain customer trust, and comply with our legal obligations. Our success depends on the ability to prove our consistent adherence to requirements, the adoption of capabilities, that we operate with care, and incorporate secure by design principles.

Chad Thunberg
CISO
Coming Soon
SOC 2 Type 2 assessment currently in progress. Updated report expected October 2026
Quick Summary
One or more annual third-party audit(s)
Annual third-party penetration testing
Has a disaster recovery plan
Subprocessors list available
Has cyber insurance
Will enter into a DPA
Has a bug bounty or vulnerability disclosure program
Has an API available
Uses a centralized IAM solution (SSO) to manage employee access
Has a status page
Has a privacy policy
Has an AI policy
Trust at Yubico Documents
What we offer
YubiKey
The industry's #1 security key, the YubiKey provides hardware-backed, phishing-resistant authentication to secure your digital ecosystem.
- Unmatched Security: Eliminates account takeovers by replacing vulnerable passwords and SMS codes with robust public key cryptography.
- Seamless User Experience: Easier and safer than authenticator apps—just plug it in and tap or touch for instant access.
- Multi-Protocol Flexibility: Supports FIDO2/WebAuthn, U2F, Smart Card, OpenPGP, and OTP on a single device.
- Universal Compatibility: Works seamlessly out-of-the-box with Windows, macOS, Google Workspace, Microsoft 365, and hundreds of top IAM platforms.
- High Assurance & Compliance: Available in FIPS-certified models to meet the strictest regulatory requirements (AAL3/NIST SP800-63B) and biometric models for secure passwordless login.
Typical data access: None - The YubiKey does not communicate customer data to Yubico
YubiKey as a Service
YubiKey as a Service is an enterprise subscription program designed to fast-track organizations to strong, phishing-resistant, and passwordless authentication at scale.
- Flexible Subscription Model: Converts hardware authentication into a predictable operational expenditure (OpEx) with lower initial entry costs.
- Tiered Hardware Options: Offers Base, Advanced, and Compliance tiers to match organizational needs—covering FIDO-only, multi-protocol, and FIPS-validated hardware passkeys.
- Turnkey Deployment & Global Delivery: Streamlines onboarding with global logistics across 199 locations, self-service user ordering, and pre-enrollment capabilities.
- Future-Proof Protection: Allows organizations to upgrade to the latest YubiKey models within their subscription tier as technology evolves.
- Built-in Resilience & Support: Includes an annual replacement allowance of up to 25% for lost keys or employee turnover, backup key discounts, dedicated Customer Success Managers, and Professional Services.
Typical data access: Customer Name, Address, Phone, and Email to support delivery of YubiKeys through shipping carriers.
Certifications: SOC 2 Type 2
Featured Documents
Subprocessors23

aftership.com

Atlassian

Avalara

AWS

Clozd

DHL

EasyPost

Endicia

FedEx

Gainsight


Lob
Loop

Marketo

Oracle

Rush Order

Salesforce

Sentry

ShipEngine

Sumo Logic

TecEx

Transnet
