# BigID - **Type:** Software product - **Website:** https://bigid.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) BigID is data-discovery and AI-governance software from New York. Organisations run it themselves to find and classify their data and manage privacy tasks. It is software, not advice. ## BigID scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 No public case studies, named practitioners, or specific breach-notification timeframe were found; BigID's Data Processing Addendum references Standard Contractual Clauses and the UK IDTA but no concrete incident-response commitment was independently confirmed in the publicly available text, and its SLA covers infrastructure uptime, not data-incident response. ### Qualifications of the people who do the work: 4/5 BigID discloses independently certified SOC 2 Type II status plus independently assessed PCI DSS and TX-RAMP Level 2 compliance (bigid.com/certifications-and-assessments/), but its ISO 27001 claim is only 'aligned with' the standard rather than a certified attestation, so the credential set is strong but not uniformly third-party verified. ### What it publishes about fees: 1/5 No fee information is published anywhere; home.bigid.com/pricing routes entirely to a sales conversation with no tiers, ranges or worked examples disclosed. ### Knowledge of your sector: 4/5 BigID publishes ten named industry pages (financial services, healthcare, insurance, pharma & life sciences, SLED, telecoms, retail, transportation, high tech, sports) each framed around that sector's risk, though only the healthcare page names a specific regulation (HIPAA) and the rest describe 'compliance' and 'regulatory risk' generically. ### Independence from what it sells: 4/5 Its central compliance claims (SOC 2 Type II, PCI DSS, TX-RAMP Level 2) are independently audited by named third-party assessors rather than self-declared, but its CSA STAR entry is an unaudited self-assessment and its ISO 27001 claim is 'aligned with' rather than certified, so not every claim about its own product carries equal independent verification. ### Who carries the risk if the advice is wrong: 4/5 BigID publishes a Cloud SLA with a specific 99.5% monthly uptime commitment and service-credit formula, and its EULA sets an elevated liability cap (greater of $400,000 or 2x annual fees) specifically for security/data-protection breaches; however, Service Credits are stated as the customer's sole remedy for downtime and no public cyber/professional-indemnity insurance figure was found. ## Sources for BigID Every line carries the page it was read on and the date it was checked. - Legal entity, jurisdiction and business address (SEC EDGAR) - Source: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001668449&type=D&dateb=&owner=include&count=40 - Checked: 2026-09-20 - Contracting entity and current NYC address (own EULA) - Source: https://bigid.com/wp-content/uploads/2025/05/BigID_EULA_Template_May-2025.pdf - Checked: 2026-09-20 - Own security certifications and their audit status - Source: https://bigid.com/certifications-and-assessments/ - Checked: 2026-09-20 - Disclosure of own GenAI architecture and data handling - Source: https://bigid.com/bigid-responsible-ai/ - Checked: 2026-09-20 - Published SLA uptime commitment and liability terms - Source: https://bigid.com/wp-content/uploads/2025/06/BigID-Cloud-SLA-Nov.-2024-1.pdf - Checked: 2026-09-20 - No published pricing - Source: https://home.bigid.com/pricing - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Published - Client results: Not published - How it uses AI: Published ## Strengths - Its flagship security claim (SOC 2 Type II) and its PCI DSS and TX-RAMP Level 2 status are described as independently assessed by a third party, not merely self-declared marketing language. - Discloses granular detail about its own GenAI features: which LLM providers it uses (Azure OpenAI GPT, plus Anthropic and AWS Bedrock as optional sub-processors), a statement that it does not train models on customer data or share customer data for third-party LLM training, and specific technical safeguards (encrypted VPN channel, no prompt/response retention on BigChat). - Maintains ten named industry-specific solution pages (financial services, healthcare, insurance, pharma & life sciences, SLED, telecoms, etc.) rather than a single generic product pitch. - Publishes a concrete Cloud SLA with a numeric monthly uptime commitment (99.5%) and an explicit service-credit calculation, rather than leaving availability undefined. - Sets a specific, elevated liability cap (greater of $400,000 or 2x annual fees) carved out for security and data-protection breaches specifically, above its general contractual liability cap. ## Things to check Each one carries the factual basis it rests on. - No pricing information is published anywhere on BigID's site; every path to a quote routes through a 'Get a Demo' sales conversation, making cost comparison before contact impossible. - Basis: home.bigid.com/pricing states pricing 'depends on a few factors... we'll need to get in touch to give you accurate pricing info' with no tiers or figures shown. - Not all of BigID's own compliance claims carry the same independent verification: ISO 27001 is described only as a framework it 'is aligned with' rather than a certified attestation, and its CSA STAR listing is an unaudited CAIQ self-assessment. - Basis: bigid.com/certifications-and-assessments/ separates 'independently audited/certified' items (SOC 2, PCI DSS, TX-RAMP) from ISO 27001 ('aligned with') and CSA STAR ('published its completed CAIQ self-assessment'). - BigID's general contractual liability cap (outside the security/data-protection carve-out) limits its total aggregate liability to the fees paid in the then-current annual subscription term, and Service Credits are stated as the customer's 'exclusive remedy' for any SLA shortfall. - Basis: EULA Section 11.2 (Mutual Limitation of Liability) and the Cloud SLA's 'Exclusive Remedies' clause, both dated 2024/2025 and published on bigid.com. ## Where this firm appears - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.