Certificate Number: ISO20240105

Certificate of Registration
Information technology — Security techniques — Code of practice for
information security controls based on ISO/IEC 27002 for cloud services
Awarded to:HashiCorp, Inc.
with its HQ location at
101 Second Street, Suite 600 &700
San Francisco, CA 94105
USAAuthorized by:Moss Adams Certifications LLC performed a certification examination toassess HashiCorp’s conformity with the defined requirements in thestandard ISO/IEC 27017:2015 over its information security management
system (ISMS).
Moss Adams Certifications LLC will perform surveillance audits according
to the certification agreement dated November 7, 2023, and will
acknowledge this certificate until the expiration date noted below or theexpiration of the corresponding ISO/IEC 27001:2022 certification #ISO20240104.

Bryan Schader | Director of ISO Services, Moss Adams Certifications LLC
Registration date: Issue date of certificate: Expiration date of certificate:January 18, 2024
December 11, 2021
December 10, 2026
This certificate was issued electronically and remains the property of Moss Adams Certifications LLC and is bound by the conditions ofcontract. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere to
the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certificationassessments, this certificate is not meant to express any form of assurance on the performance of the organization being certified to thereferred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. Questions about this certificate can be
1made by visiting www.mossadamscertifications.com.

Certificate Number: ISO20240105

HashiCorpScope for certificate
The scope of this ISO/IEC 27017:2015 certificate includes HashiCorp’s products, teams, and ISMS managed atits HQ location in San Francisco, CA, USA. The in-scope people, processes, technology, and location are definedwithin the HashiCorp ISMS Scope, dated September 1, 2023, and the Statement of Applicability, dated October
5, 2023.
The scope of the ISMS implemented by HashiCorp includes the following elements:
Location:• HashiCorp San Francisco Headquarters, 101 Second Street, Suite 600 & 700, San Francisco, CA 94105,
United States

Registration date: Issue date of certificate: Expiration date of certificate:January 18, 2024
December 11, 2021
December 10, 2026
This certificate was issued electronically and remains the property of Moss Adams Certifications LLC and is bound by the conditions ofcontract. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere to
the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certificationassessments, this certificate is not meant to express any form of assurance on the performance of the organization being certified to thereferred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. Questions about this certificate can be2
made by visiting www.mossadamscertifications.com.

Certificate Number: ISO20240105

HashiCorp
Scope for certificate
Products / Services:•
HashiCorp on-premises products• Vault Enterprise• Nomad Enterprise• Consul Enterprise• Terraform Enterprise• Boundary Enterprise•HashiCorp Software-as-a- Service (SaaS) Platform• Terraform Cloud (TFC)• HashiCorp Cloud Platform (HCP)• HCP Vault on AWS• HCP Vault on Azure• HCP Consul on AWS• HCP Consul on Azure• HCP Boundary• HCP Packer•
Assets, technologies, and processes employed by HashiCorp for processing, management, and delivery ofservices to its customers
Registration date: Issue date of certificate: Expiration date of certificate:January 18, 2024
December 11, 2021
December 10, 2026
This certificate was issued electronically and remains the property of Moss Adams Certifications LLC and is bound by the conditions ofcontract. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere to
the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certificationassessments, this certificate is not meant to express any form of assurance on the performance of the organization being certified to thereferred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. Questions about this certificate can bemade by visiting www.mossadamscertifications.com.

33