We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

BigID review

Software product

BigID is data-discovery and AI-governance software from New York. Organisations run it themselves to find and classify their data and manage privacy tasks. It is software, not advice.

Relevant if you are in a regulated sector and want software, not advice, to find and classify data

Price Not published
Indemnity cover Not published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

BigID scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 4/5
What it publishes about fees 1/5
Knowledge of your sector 4/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 4/5

What BigID offers, and what it publishes

BigID sells software, not advice. Your team runs it to find and classify data and manage privacy tasks. It has pages for ten industries, including financial services, healthcare and insurance. The firm says it is SOC 2 Type II certified, and that an independent assessor evaluated its PCI DSS compliance and TX-RAMP Level 2 status.

BigID does not publish a price. Its pricing page shows no figures or tiers, only a 'Get a Demo' button. It says only that it is 'aligned with' ISO 27001, which is not a claim of certification. Its CSA STAR entry is a self-assessment. It does not publish an insurance figure.

BigID's terms cap liability at a year's fees, rising to the greater of $400,000 or twice annual fees if it breaks its security or data-protection duties. Service credits are the only remedy for missing its 99.5% monthly uptime promise. It names its AI providers and says it does not train its own models or share customer data for training.

Strengths

  • Its flagship security claim (SOC 2 Type II) and its PCI DSS and TX-RAMP Level 2 status are described as independently assessed by a third party, not merely self-declared marketing language.
  • Discloses granular detail about its own GenAI features: which LLM providers it uses (Azure OpenAI GPT, plus Anthropic and AWS Bedrock as optional sub-processors), a statement that it does not train models on customer data or share customer data for third-party LLM training, and specific technical safeguards (encrypted VPN channel, no prompt/response retention on BigChat).
  • Maintains ten named industry-specific solution pages (financial services, healthcare, insurance, pharma & life sciences, SLED, telecoms, etc.) rather than a single generic product pitch.
  • Publishes a concrete Cloud SLA with a numeric monthly uptime commitment (99.5%) and an explicit service-credit calculation, rather than leaving availability undefined.
  • Sets a specific, elevated liability cap (greater of $400,000 or 2x annual fees) carved out for security and data-protection breaches specifically, above its general contractual liability cap.

Things to check

  • No pricing information is published anywhere on BigID's site; every path to a quote routes through a 'Get a Demo' sales conversation, making cost comparison before contact impossible.
  • Not all of BigID's own compliance claims carry the same independent verification: ISO 27001 is described only as a framework it 'is aligned with' rather than a certified attestation, and its CSA STAR listing is an unaudited CAIQ self-assessment.
  • BigID's general contractual liability cap (outside the security/data-protection carve-out) limits its total aggregate liability to the fees paid in the then-current annual subscription term, and Service Credits are stated as the customer's 'exclusive remedy' for any SLA shortfall.

Common questions

Is BigID an adviser or software?

Software. BigID sells a data-discovery and AI-governance platform that your own team runs. It is not an outsourced-DPO firm or a consultancy.

Does BigID publish its pricing?

No. Its pricing page shows no figures or tiers and says pricing depends on factors specific to your team and data. The only next step offered is a demo.

Which certifications back BigID's own platform?

It says it is SOC 2 Type II certified, and that an independent assessor evaluated its PCI DSS and TX-RAMP Level 2 status. For ISO 27001 it says only that it is 'aligned with' the standard. Its CSA STAR entry is a self-assessment.

What do users say about BigID?

Little so far. Capterra shows 5.0 out of 5 from two reviews, which praise how it finds personal data but say it needs expert guidance. Its Trustpilot profile has no reviews, and G2's page blocked our check.

Evidence for each BigID score

Show our working

Notes behind each thing to check

  • No pricing information is published anywhere on BigID's site; every path to a quote routes through a 'Get a Demo' sales conversation, making cost comparison before contact impossible. (home.bigid.com/pricing states pricing 'depends on a few factors... we'll need to get in touch to give you accurate pricing info' with no tiers or figures shown.)
  • Not all of BigID's own compliance claims carry the same independent verification: ISO 27001 is described only as a framework it 'is aligned with' rather than a certified attestation, and its CSA STAR listing is an unaudited CAIQ self-assessment. (bigid.com/certifications-and-assessments/ separates 'independently audited/certified' items (SOC 2, PCI DSS, TX-RAMP) from ISO 27001 ('aligned with') and CSA STAR ('published its completed CAIQ self-assessment').)
  • BigID's general contractual liability cap (outside the security/data-protection carve-out) limits its total aggregate liability to the fees paid in the then-current annual subscription term, and Service Credits are stated as the customer's 'exclusive remedy' for any SLA shortfall. (EULA Section 11.2 (Mutual Limitation of Liability) and the Cloud SLA's 'Exclusive Remedies' clause, both dated 2024/2025 and published on bigid.com.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 No public case studies, named practitioners, or specific breach-notification timeframe were found; BigID's Data Processing Addendum references Standard Contractual Clauses and the UK IDTA but no concrete incident-response commitment was independently confirmed in the publicly available text, and its SLA covers infrastructure uptime, not data-incident response.
Qualifications of the people who do the work 4/5 BigID discloses independently certified SOC 2 Type II status plus independently assessed PCI DSS and TX-RAMP Level 2 compliance (bigid.com/certifications-and-assessments/), but its ISO 27001 claim is only 'aligned with' the standard rather than a certified attestation, so the credential set is strong but not uniformly third-party verified.
What it publishes about fees 1/5 No fee information is published anywhere; home.bigid.com/pricing routes entirely to a sales conversation with no tiers, ranges or worked examples disclosed.
Knowledge of your sector 4/5 BigID publishes ten named industry pages (financial services, healthcare, insurance, pharma & life sciences, SLED, telecoms, retail, transportation, high tech, sports) each framed around that sector's risk, though only the healthcare page names a specific regulation (HIPAA) and the rest describe 'compliance' and 'regulatory risk' generically.
Independence from what it sells 4/5 Its central compliance claims (SOC 2 Type II, PCI DSS, TX-RAMP Level 2) are independently audited by named third-party assessors rather than self-declared, but its CSA STAR entry is an unaudited self-assessment and its ISO 27001 claim is 'aligned with' rather than certified, so not every claim about its own product carries equal independent verification.
Who carries the risk if the advice is wrong 4/5 BigID publishes a Cloud SLA with a specific 99.5% monthly uptime commitment and service-credit formula, and its EULA sets an elevated liability cap (greater of $400,000 or 2x annual fees) specifically for security/data-protection breaches; however, Service Credits are stated as the customer's sole remedy for downtime and no public cyber/professional-indemnity insurance figure was found.

Sources for BigID

  • Legal entity, jurisdiction and business address (SEC EDGAR) (BigID Inc., a Delaware corporation, CIK 0001668449, business address 641 Avenue of the Americas Front 2, New York, NY 10011, has filed five Form D exempt-offering notices between March 2016 and February 2024.) (sec.gov, checked 20 September 2026)
  • Contracting entity and current NYC address (own EULA) (BigID's End User Software License Agreement (last updated May 2025) names the contracting party as 'BIGID INC., A DELAWARE CORPORATION HAVING AN ADDRESS OF 379 WEST BROADWAY, FL 2, NEW YORK, NY 10012', confirming a genuine New York City headquarters.) (bigid.com, checked 20 September 2026)
  • Own security certifications and their audit status (BigID's Certifications and Assessments page states it 'is SOC 2 [Type II] certified' and that its PCI DSS compliance and TX-RAMP Level 2 status have been 'evaluated by an independent assessor', while ISO 27001 is described only as a framework BigID 'is aligned with' (not stated as a certified attestation), and CSA STAR is a self-published CAIQ self-assessment.) (bigid.com, checked 20 September 2026)
  • Disclosure of own GenAI architecture and data handling (BigID's Responsible AI page discloses that it 'utilizes Azure OpenAI GPT to power BigChat and the Business Asset Mapping feature', states it 'does not train its own LLMs or share customer data with third party providers for LLM training', and that BigChat traffic runs over encrypted, VPN-managed connections to Azure using 'Limited Life Memory servers, which do not retain any transmitted prompts or responses'; its sub-processor list separately names Anthropic and AWS Bedrock as optional LLM-inference providers, both US-located.) (bigid.com, checked 20 September 2026)
  • Published SLA uptime commitment and liability terms (BigID's Cloud Software Service Level Agreement (last updated 26 November 2024) commits to '99.5% monthly uptime percentage' with a defined service-credit formula for shortfalls, while its EULA caps general liability at annual fees paid but carves out a higher cap of 'the greater of $400,000 or two (2) times the total of the annualized fees paid' specifically for breach of its security, data-privacy or data-protection obligations.) (bigid.com, checked 20 September 2026)
  • No published pricing (home.bigid.com/pricing carries no dollar figures or tiers; it states pricing 'depends on a few factors specific to your team and data, so we'll need to get in touch to give you accurate pricing info', with 'Get a Demo' as the only call to action.) (home.bigid.com, checked 20 September 2026)
  • Trustpilot: Trustpilot's BigID profile is unclaimed with 0 reviews, and G2's BigID reviews page returned a 403 (blocked) so could not be read. Capterra shows a 5.0/5 rating from 2 reviews (a very small sample): reviewers praise BigID for identifying PII with a simple UI and for addressing GDPR/security needs, but note it needs expert guidance rather than being simple self-serve, and flag integration limits with some data platforms. (Trustpilot, checked 20 September 2026)

SOC 2 Type II PCI DSS TX-RAMP Level 2

Regulated sectorsExposed to the EU AI Act

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.