Progress toward certification
Updated at least quarterly (MKT-IIP-DCP). Last updated .
Where we are
Pinecone is listed on the FedRAMP Marketplace in the Initial Implementation Phase (FedRAMP Package ID FR2634450946, listed 15 September 2026) and applied for a Class A Certification on 5 October 2026; the application is with FedRAMP for review. Pinecone holds a SOC 2 Type II report and an ISO/IEC 27001 certificate today; those, along with the security policy set and subprocessor list, are available now through the Pinecone Trust Center.
Milestones
| Milestone | Status | Target | Detail |
|---|---|---|---|
| Public certification data published | complete | 2026-09-15 | This portal — the public information required by CDS-CSO-PUB, published in both human-readable and machine-readable form and generated from a single source. |
| Marketplace Initial Implementation Phase listing | complete | 2026-09-15 | Listed on the FedRAMP Marketplace on 15 September 2026 as FedRAMP Package ID FR2634450946. Requires MKT-CSO-MLR (this portal), MKT-IIP-AGU (demonstrated federal use cases), and MKT-IIP-DLA (a Class B, C, or D assessment scheduled within two years). |
| Class A Certification | in review | 2026-11-04 | Application submitted to FedRAMP on 5 October 2026 with the Certification Package, which is supplied through the Pinecone Trust Center. The target date is FedRAMP's goal of an initial decision within 30 days of application, not a Pinecone commitment. No independent assessment is required for the certification itself (FRC-APP-FIA). FRC-CLA-ASF requires the SOC 2 to have been completed within the past twelve months; the current report is dated 9 February 2026 and its successor is due at the end of November 2026. |
| Class B assessment scheduled | planned | 2028-09-15 | A Class A Certification does not require an independent assessment: FRC-APP-FIA makes one optional and FRC-CLA-ASF accepts a current SOC 2 Type II instead. An assessment for Class B, C or D must be scheduled within two years of the Marketplace listing. |
Federal use cases
Indirect Use. Pinecone is a developer platform that customers embed as a component of their own applications and services. The federal use case is therefore indirect: Pinecone is intended for inclusion as a third-party information resource within other cloud service offerings that are used directly by federal agency customers.