Maze Trust Center

·Maze

·Maze empowers researchers to be change makers - turning research into a center of influence and customer insights into enduring competitive advantage. By bringing recruiting, testing, and analysis together, Maze helps organizations move from intuition to evidence, faster. From Researchers to Designers and PMs, anyone can run studies that answer any question and drive better decisions at any altitude. Equipped with Maze's research-grade AI, teams can focus on what matters most: understanding people, uncovering insights, and shaping change with confidence. security@maze.design Privacy PolicyOpens in new tab

·Controls

·Updated 16 minutes ago View all

• ·Unique production database authentication enforced Encryption key access restricted Unique account authentication enforced

·View 11 more Infrastructure security controls Production inventory maintained Portable media encrypted

• ·Code of Conduct acknowledged by contractors

·View 7 more Organizational security controls Data encryption utilized Control self-assessments conducted Penetration testing performed

• ·Continuity and Disaster Recovery plans established
• ·Continuity and Disaster Recovery plans tested Cybersecurity insurance maintained

·View 24 more Internal security procedures controls Data retention procedures established Data classification policy established

·Data collected

·Customer personally identifiable information

·Employee personally identifiable information Credit card information Personal health information

·Sub-processors

·View all

·Amazon Web Services (AWS) • Infrastructure Hosting United States 🇺🇸 Core Product Google Cloud Platform • AI Inference United States 🇺🇸 Core Product AuraDB (Neo4j Inc.) • Database Hosting United States 🇺🇸 Core Product OpenAI • AI Inference United States 🇺🇸 Core Product

·FAQ

·View all

·Is Maze SOC 2 certified?

·Does Maze comply with GDPR?

·Where are Maze's servers located?

·Does Maze encrypt data?

·Updates

·View all Compliance

·Sub-processor update

·Published February 26, 2026

·Maze is updating our list of authorized sub-processors to include:

• ·Pylon

·A complete list of all sub-processors and their respective roles is available in our Data Processing AddendumOpens in new tab.

·All sub-processors engaged by Maze undergo rigorous privacy, security, and compliance assessments as part of our Vendor Risk Management process, in accordance with Article 28(1) of the GDPR.

·If you have any questions or concerns regarding this update, please contact our Privacy Team at privacy@maze.design. Compliance

·Sub-processor update

·Published February 24, 2026

·Maze is updating our list of authorized sub-processors to include:

• ·Google Cloud Platform
• ·Instantly.ai
• ·OutboundSync

·A complete list of all sub-processors and their respective roles is available in our Data Processing AddendumOpens in new tab.

·All sub-processors engaged by Maze undergo rigorous privacy, security, and compliance assessments as part of our Vendor Risk Management process, in accordance with Article 28(1) of the GDPR.

·If you have any questions or concerns regarding this update, please contact our Privacy Team at privacy@maze.design. Compliance

·Sub-processor update

·Published February 5, 2026

·Maze is updating our list of authorized sub-processors to include:

• ·Temporal - Distributed workflow orchestration and reliability infrastructure

·A complete list of all sub-processors and their respective roles is available in our Data Processing AddendumOpens in new tab.

·All sub-processors engaged by Maze undergo rigorous privacy, security, and compliance assessments as part of our Vendor Risk Management process, in accordance with Article 28(1) of the GDPR.

·If you have any questions or concerns regarding this update, please contact our Privacy Team at privacy@maze.design. General

·Sub-processor Update

·Published January 13, 2026

·Maze is updating our list of authorised sub-processors.

• ·Omni Analytics
• ·Deepgram
• ·Turbopuffer

·Details on all our sub-processors and their respective roles are available on https://maze.co/data-processing-addendum/#sub-processorsOpens in new tab

·All sub-processors engaged by Maze undergo rigorous privacy, security, and compliance assessments as part of our Vendor Risk Management Process, in line with Article 28(1) of the GDPR.

·If you have any questions, please feel free to reach out to [privacy@maze.design]