Magnite’s security program is designed to meet the expectations of sophisticated enterprise clients and regulatory authorities alike. Through a comprehensive and continuously evolving approach that includes layered technical defenses, strict governance policies, and a culture of security awareness, Magnite ensures the protection and resiliency of its platforms, services, and client data. For questions or audit documentation requests, including SOC 2 Type I and recent Penetration test reports, clients are encouraged to click here.

Magnite is committed to protecting the confidentiality, integrity, and availability of its services and client data through a well-established and continuously evolving information security program. Led by the Chief Information Security Officer (CISO), the program is governed by internal policies and subject to regular review by executive leadership and the Board of Directors. The CISO delivers quarterly updates to the Audit Committee, maintaining high levels of visibility and accountability across the organization.

Magnite operates a hybrid infrastructure model consisting of both on-premises systems and cloud based cloud environments. All cloud-hosted infrastructure adheres to the cloud provider’s recommended security best practices, including strict access control, encrypted communications, and continuous monitoring. Public and internal network data is encrypted using Transport Layer Security (TLS), while data at rest in the cloud is protected by AES-256 encryption. Network segmentation, firewalls, and VPN gateways with Multi-Factor Authentication (MFA) provide strong boundaries around all production and corporate environments.

Access to Magnite’s systems is governed by a formalized access control process that ensures only authorized personnel with a legitimate business need are granted access. Access rights are reviewed regularly and promptly revoked upon employee departure. Authentication mechanisms include Single Sign-On (SSO) and MFA enforcement for all internet-facing services. For highly sensitive systems, such as those subject to Sarbanes-Oxley (SOX) regulations, additional layers of approval and privileged access monitoring are in place.

Role-Based Access Control (RBAC) ensures appropriate permissioning across internal platforms, including DV+, which leverages an operation-role-feature model to further refine access.

Magnite’s Incident Response Plan (IRP) is designed to provide a structured approach to detecting, managing, and resolving security incidents. The process defines severity levels, escalation protocols, and internal and external communication procedures to ensure consistency and speed during incident response. Business Continuity and Disaster Recovery (BC/DR) procedures are also maintained for critical services and infrastructure. These are tested annually through structured exercises, ensuring operational resilience and recovery capabilities in the event of an unplanned disruption.

Magnite maintains a mature privacy program aligned with global privacy frameworks, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Data collected and processed through the DV+ and CTV platforms does include personally identifiable information (PII), however PII is obfuscated and clients retain control over the data they choose to share. The company is a registered vendor under the IAB’s Transparency and Consent Framework (TCF) 2.0 and complies with US privacy frameworks to process and honor user consent signals. These efforts ensure that privacy controls are embedded into Magnite’s services and ad delivery processes.

Security is integrated into every phase of Magnite’s Software Development Lifecycle. Development teams follow secure coding practices and undergo security-focused design and code reviews. Each change is tested and approved before deployment via an automated CI/CD pipeline. A structured change management process ensures that all deployments into production are traceable, validated, and aligned with business and security requirements.

To proactively identify and mitigate risks, Magnite performs weekly vulnerability scans and annual penetration testing with third-party security consultants. All systems are monitored in real time using a centralized Security Information and Event Management (SIEM) platform. The SIEM collects logs from authentication systems, applications, and infrastructure, enabling threat correlation, alerting, and rapid response to suspicious activity. This continuous monitoring framework supports compliance, visibility, and proactive risk mitigation.

Magnite employs industry-standard endpoint security and antivirus solutions across all corporate workstations and critical servers. Company-issued laptops are protected through full-disk encryption, secure operating system configurations, and enforced firewall controls. In addition, Magnite uses centralized device management to ensure timely patching, application governance, and consistent security configurations across all company-owned devices.

Third-party vendors and contractors are subject to thorough security assessments before onboarding and are bound by contractual agreements that define their responsibilities for data protection, breach notification, and privacy compliance. These contracts go beyond standard non-disclosure agreements by mandating specific technical and organizational controls. Magnite’s internal Security and Compliance teams ensure that third-party engagements meet the company’s security expectations and that downstream subcontractors adhere to the same standards.

Although Magnite does not currently maintain formal ISMS certifications such as ISO 27001, it undergoes regular internal and external audits to demonstrate compliance with industry standards and regulatory requirements. As a publicly traded company, Magnite is subject to SOX requirements and maintains a comprehensive suite of IT General Controls (ITGCs). In addition, Magnite has completed a SOC 2 Type I audit and received the corresponding audit report, and is actively working toward achieving SOC 2 Type II, which it expects to complete by the end of 2026. Independent auditors also produce SOC 1 Type II reports annually for the DV+ and CTV platforms.

Magnite’s global infrastructure is built for high availability, low latency, and scalability. These platforms operate across distributed data centers in the United States, Europe, and Asia. This geographic diversity supports global ad delivery with minimal latency and redundancy. Across its platforms, Magnite has consistently demonstrated a service uptime of 99.97%, reflecting its operational resilience and reliability.

Security awareness is promoted throughout Magnite’s workforce. All employees are required to complete security and privacy training annually, including modules on phishing, secure data handling, and incident response. These training efforts are reinforced with policy acknowledgments and are monitored for compliance. A strong culture of security is foundational to Magnite’s operations, ensuring that every employee plays a role in protecting company and customer assets.