Datadog AI Vendor Risk Profile
Cloud monitoring and security platform that has expanded into AI observability with LLM Observability for monitoring model performance, cost, and quality. Integrates AI-powered features across its APM, logging, and security products.
Risk overview
Risk score: 24/100
Risk tier: Moderate
Safety rating: 76/100 (higher is better)
Lower risk scores indicate lower assessed risk.
Last verified: Apr 19, 2026 Aging
Risk dimensions
| Dimension | Risk score |
|---|---|
| Data Handling | 31/100 |
| IP Exposure | 16/100 |
| Jurisdiction | 13/100 |
| Security | 18/100 |
| Regulatory Compliance | 35/100 |
| Transparency | 55/100 |
| Business Stability | 12/100 |
| Dependency Chain | 24/100 |
| Agent Governance | Not assessed |
Analyst summary
Rating: Recommended
Datadog (Nasdaq: DDOG) is an enterprise-grade observability platform with deep LLM observability features, SOC 2 Type II, ISO 27001, FedRAMP Moderate, and HIPAA BAA. Profitable public company with strong financials. The 2023 API-key exposure was handled transparently; more broadly, LLM observability inevitably handles sensitive customer prompts and requires careful data-retention configuration.
Bottom line: Recommended for enterprise observability; configure LLM trace retention deliberately.
Strengths
- SOC 2 Type II, ISO 27001, FedRAMP Moderate, HIPAA BAA
- No training on customer telemetry without consent
- Deep LLM observability (prompt tracing, token cost, evaluations) integrated with infra and APM
- Profitable public company with strong financials ($2.5B+ annual revenue)
Concerns
- LLM observability inherently stores customer prompts and responses; requires DLP-aware retention configuration
- 2023 API-key exposure incident (disclosed and remediated) reflects the scale of attack surface
- Pricing opacity and cost overruns are a recurring customer complaint at scale
- US-incorporated, so CLOUD Act exposure applies to US-region data
Best for
- Enterprises standardizing on a single observability pane across infra, APM, security, and LLM
- Regulated industries needing FedRAMP-Moderate and HIPAA-eligible observability
- Teams needing integrated LLM cost and quality monitoring alongside traditional APM
Avoid if
- Your compliance team cannot accept customer prompts stored in observability tooling at all
- Your budget cannot tolerate Datadog's usage-based pricing scaling
- You need FedRAMP High (Datadog is Moderate today, not High)
Citations
- Data Handling — Hipaa Baa Available
Datadog offers HIPAA Business Associate Agreements for customers using the platform to process protected health information.
- Data Handling — Trains On User Data
Datadog does not use customer telemetry, logs, or LLM observability traces to train its own models without explicit customer consent.
- Governance — Financial Stability
Datadog, Inc. (Nasdaq: DDOG) is a profitable public company with over $2.5 billion in annual revenue and strong free cash flow generation.
- Governance — Security Incidents
In March 2023 Datadog disclosed that a limited subset of customer API keys had been exposed; Datadog rotated keys and notified affected customers.
- Jurisdiction Profiles — Incorporation Country
Datadog, Inc. is a Delaware corporation headquartered in New York City, publicly traded on Nasdaq under ticker DDOG.
- Security Compliance — Fedramp Authorized
Datadog is FedRAMP Moderate authorized (GovCloud deployment) for US federal agency workloads.
- Security Compliance — Soc2 Type2
Datadog is SOC 2 Type II certified and ISO 27001/27017/27018 certified covering the full observability platform.