Is Make.com safe? Ownership, certifications and data handling

Who runs Make and where it came from

Make started life as Integromat, a Czech automation startup. TechCrunch reported on October 14, 2020 that Celonis, the process mining company, had acquired Integromat; terms were not disclosed, though Celonis CEO Alexander Rinke told TechCrunch the deal was worth more than $100 million. [5] The same report said Integromat launched in 2012, had not raised outside money, served more than 11,000 customers and would continue as a standalone product. [5]

Integromat was later renamed. Make's own announcement page says Integromat evolved into Make, which became the name of the brand, business and flagship platform, and that Integromat became a legacy product. The page said support for Integromat would end in 2023 and that existing customers could move to Make paying the same prices they already paid. [6] Today the Make security and privacy pages carry a Celonis, Inc. copyright and link to the Celonis trust center. [1][3]

For a buyer this matters in two ways. You are contracting with a subsidiary of a large software company rather than a small independent startup, and the compliance documents you will review are published through Celonis.

Published certifications and audits

Make states that its information security program is ISO 27001 certified and that, alongside GDPR adherence, it has completed SOC 2 Type II and SOC 3 audits. [1] The SOC 2 report covers internal controls; the SOC 3 is the public summary. [1]

The Celonis trust center lists a SOC 2 Type 2 report for the Make product covering November 1, 2025 to April 30, 2026, earlier reports going back to the period starting November 1, 2024, and a bridge letter covering November 1, 2025 to January 31, 2026. [2] A bridge letter is a statement covering the gap between the end of the last audited period and the next report. The trust center also shows ISO/IEC 27001, 27701 and ISO 9001 badges, but the fetched page did not state whether each covers the Make product specifically, so ask for the certificate scope if that matters to your client contract. [2]

How data is hosted and encrypted

Make says its infrastructure runs on Amazon AWS EC2 private instances inside Amazon VPC, deployed across two availability zones, and that the hosting environment is reachable only from a private network via VPN. [1] Enterprise plans run in a separately managed AWS environment. [1]

Data at rest uses full-disk AES-256 encryption with keys in AWS Key Management Service, and data in transit uses TLS 1.2 and 1.3. [1] For some connection types, such as FTP and databases, you set the security level yourself, so a plain FTP connection is only as safe as the settings you choose. [1]

Make organizations are assigned a data zone: US1, US2, EU1 or EU2. [4] Make's help center is explicit that choosing EU1 or EU2 does not guarantee every request stays in the EU. Maia, Make AI Web Search, all OpenAI models in Make's AI Provider and some AI Content Extractor modules always route to the US, and some Claude models are served from a UK region. [4] If you bring your own AI provider connection, routing follows that provider's defaults and Make's EU guarantee no longer applies. [4]

GDPR documents and data transfers

Make's privacy page links to its contractual documentation, the Data processing agreement and the subprocessor list, and points to its information security page for security measures. [3][1] It states that Celonis Inc. is registered to the EU-US Data Privacy Framework and that appropriate transfer mechanisms such as Standard Contractual Clauses are used for subprocessors in countries without an EU adequacy decision. [3]

On retention, Make says data should be kept only as long as necessary for its purpose, and after a subscription ends you can request deletion of all personal data. [3] Separately, the Keep data confidential scenario setting stops Make from retaining the data processed in a run; logs record that the run happened but not the payload, which also leaves you with very few options for fixing errors. [8]

What a small business should check before connecting client accounts

Most practical risk sits in how you set up your own workspace rather than in Make's infrastructure. Make documents that every user in a team can use and manage any connection created in that team, and a connection can be reused in any module for the same app across scenarios. [7] If you build automations for several clients in one team, every teammate can reach every client's connected account.

By default Make emails you when a teammate first adds a connection or key you created to a scenario; you can switch this off per connection, and Enterprise plans also log these events in organization audit logs. [9] Keep those notifications on while you have more than one person building scenarios.

• Consider a separate team per client so client connections are not shared with unrelated work; Make itself suggests a separate team where you are the only member to keep personal accounts isolated. [7]
• Grant each connection only the scopes the scenario needs; Make cannot check that an edited connection has the right scopes. [7]
• Turn on Keep data confidential for scenarios that move sensitive personal data, and accept the reduced debugging that comes with it. [8]
• Check the data zone of the organization before you build, and list any AI steps against Make's US-routed features. [4]
• Request the SOC 2 Type 2 report through the Celonis trust center if your client asks for vendor evidence. [2]
• Read the DPA and subprocessor list and file a copy with your own client records. [3]

What this guide does not cover

This is a research guide built from Make, Celonis and press documents fetched on the date shown. We have not audited Make's systems and do not aggregate user reviews. Certifications show that controls were assessed over a period; they do not guarantee that an incident cannot happen, and your own configuration choices still decide who in your team can see client data.

Sources & verification

Product details and prices can change. Check the linked provider before buying.

1. Make: Security Accessed 30 Oct 2026
2. Celonis Trust Center: Make Accessed 30 Oct 2026
3. Make: Privacy and GDPR Accessed 30 Oct 2026
4. Make Help: AI providers and data zones in Make Accessed 30 Oct 2026
5. TechCrunch: Celonis acquires Czech startup Integromat (Oct 14, 2020) Accessed 30 Oct 2026
6. Make: Integromat evolves to Make Accessed 30 Oct 2026
7. Make Help: Connect an application Accessed 30 Oct 2026
8. Make Help: Scenario settings Accessed 30 Oct 2026
9. Make Help: Manage connection and key usage notifications Accessed 30 Oct 2026