02.01 · Standards & attestations
DocumentedSOC 2 Type II report
OpenAI has undergone an independent SOC 2 Type 2 examination of controls relevant to Security, Availability, and Confidentiality.trust.openai.com
Independent documentation research
Before the questionnaire arrives, know what the vendor has already published.
The vendor's own record, made reviewable.
SaaSDossier records what a SaaS vendor publishes about its security across 55 fields reviewed — each line carrying the source it came from, and marked either Documented or Question surfaced. A dated record of the published evidence, never a judgment.
55fields reviewed
10Evidence domains
2States · no judgment
From a real evidence ledgerDocumented
02.01 · Standards & attestations
SOC 2 Type II report
OpenAI has undergone an independent SOC 2 Type 2 examination of controls relevant to Security, Availability, and Confidentiality.trust.openai.com
What the record covers: security, privacy, AI data use, subprocessors, data retention, and incident terms — as published by the vendor, with the source shown for every line.
The released dossiers
Four records. Released and reviewed.
True counts, taken straight from each released dossier. See what each vendor publishes — and the questions to ask next.
StripeLicensed Edition · No. 00146 Documented · 9 Question surfaced
HubSpotLicensed Edition · No. 00249 Documented · 6 Question surfaced
OpenAIPublic Edition · No. 003 · Free47 Documented · 8 Question surfaced
AnthropicLicensed Edition · No. 00447 Documented · 8 Question surfaced
Licensed Edition · No. 004
Anthropic
47Documented
8Question surfaced
55Control fields
Real pages · released Public Edition · free in full
What a dossier is
One finished record.
Every line accountable.
A finished PDF record of what a software vendor publishes about its security, privacy, and compliance — the vendor's own record, made reviewable. One structured, source-linked document, not a folder of raw links.
The moment it's built for
Built for the moment before.
Walk into the vendor call with the vendor's own published record already organized, and your follow-up questions already clear.
Before a vendor call
Read the record first
The vendor's published evidence, organized — so the vendor review starts at the real questions.
Find your vendor →Before connecting client data
See what's published on data handling
Training use, retention, and data boundaries — what the vendor states, and what remains a question.
Read real fields →Before renewal
Review before you re-sign
One finished record to re-check the vendor's published posture against last year's assumptions.
See what you receive →Before procurement approval
Attach a source-linked record
A reviewable file for the approval chain — every line traceable to a vendor-published source.
How it's built →Before a security questionnaire
Draft from what's already published
Start from the vendor's own answers, and keep the unanswered fields as your follow-ups.
Before legal reviews the DPA
Arrive with the published terms
What the vendor publishes on DPAs, subprocessors, and deletion — gathered before counsel's clock starts.
The two-state model
Two states. No third. No judgment.
Every field lands in exactly one of two states. Color is never the only signal — each is labelled in words.
Documented
The field was found in the vendor's published sources, quoted and cited in the vendor's own words.
Question surfaced
Not identified in the vendor-published sources reviewed. This does not establish absence of the control.
What you receive
A fixed 55-field evidence record, four ways in.
- LedgerEvidence ledgerAll 55 fields, each in one of two states, the vendor's own words quoted and cited where Documented.
- RegisterSource registerEvery vendor-published page reviewed, listed with its URL — each line traces back to where it was found.
- IntegrityIntegrity recordEach dossier includes a SHA-256 identifier tied to the reviewed evidence record used for that release.
- QuestionsBuyer-ready follow-upsThe questions to ask the vendor, drafted from every Question surfaced — field-level, ready to send in writing.
Human review + machine use
Every released dossier is designed for both human review and machine use: PDF for the meeting, JSON/CSV for filing, search, and GRC workflows.
PDFJSONCSVMachine-readable exportSource-linked record
How it's built
Checked against the source record before release.
Each dossier is built only from vendor-published sources reviewed at the time of preparation. Documented fields quote and cite those sources. Fields not established in them are surfaced as buyer-ready follow-up questions — never as a judgment.
Read the full methodology →Discipline of record
- SourcesVendor-published pages only — nothing inferred, nothing borrowed.
- StatesDocumented / Question surfaced. Nothing else exists.
- SealSHA-256 integrity record on every released file.
- ReviewReviewed before release, against the source register.
A single vendor review cycle can take hours or days across procurement, GRC, legal, and security. SaaSDossier compresses the vendor-published evidence into a source-linked record your team can review before the call.
REAL DOSSIER PAGES
Three real pages from the OpenAI Public Edition: the cover, one evidence-ledger page, and the SHA-256 integrity record.
Public evidence preview
Inspect the evidence, not a marketing claim.
A small preview from the free Public Edition. Search the fields, or move between the two states.
01.03 · Data protection
DocumentedEncryption in transit & at rest
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).trust.openai.com
09.01 · AI governance
DocumentedAI usage disclosure
OpenAI discloses that it trains models on data from public sources, licensed third-party data, and data that trainers and users provide.trust.openai.com
06.02 · Access control
Question surfacedMulti-factor authentication enforced
Not identified in the vendor-published sources reviewed. This does not establish absence of the control.Buyer-ready follow-up
05.03 · Infrastructure & hosting
Question surfacedPrivate network connectivity
Not identified in the vendor-published sources reviewed. This does not establish absence of the control.Buyer-ready follow-up
No preview fields match. The complete edition contains all 55.
See all 55 fields →Request a vendor
Reviewing a vendor we haven't released?
Reviewing a vendor we haven't released yet? Tell us what you are reviewing — request it by email. We use request volume to decide future dossiers.
Licensing
Licensed Editions — US$1,500 per vendor.
Choose the vendor record your team needs. Each Licensed Edition continues to its dedicated Whop checkout.
Get the Stripe Licensed Edition — US$1,500
Get the HubSpot Licensed Edition — US$1,500
Get the Anthropic Licensed Edition — US$1,500
Need an invoice before purchase? Email contact@saasdossier.com. We can issue a Whop invoice for a Licensed Edition. Include any purchase-order reference in your email.
Licensed Edition use is for one purchasing organization. Excerpts may be shared with external auditors, vCISOs, counsel, procurement reviewers, or GRC advisors under confidentiality.
Start where it costs nothing
Read the complete free edition — the whole format, nothing held back.
The OpenAI Public Edition is free and complete: the same 55-field framework, evidence ledger, source register and integrity record as every Licensed Edition. Read a complete dossier end to end. See the format first, then decide.
Read the free OpenAI dossierNo account or password required.
Questions
Frequently asked.
What is a SaaSDossier?+
A finished PDF record of what a software vendor publishes about its security, privacy, and compliance — the vendor's own record, made reviewable. Every field is either Documented, with the vendor's words quoted and cited, or a Question surfaced for you to raise. One structured, source-linked document, not a folder of raw links.
What do “Documented” and “Question surfaced” mean?+
The only two states. Documented means the field was found in the vendor's published sources, quoted and cited. Question surfaced means: “Not identified in the vendor-published sources reviewed. This does not establish absence of the control.” A prompt for your own follow-up, never a judgment.
Does a dossier decide whether a vendor is good or bad?+
No. A dossier records what the vendor publishes — nothing more. There is no third state and no number that says good or bad. It gives you the vendor's own record so you can reach your own conclusion.
Does a SaaSDossier replace a SOC 2 report or security questionnaire?+
No. SaaSDossier is the buyer-side evidence layer before or alongside those steps. It organizes what the vendor has already published across 55 fields, links each Documented field to its source, and turns fields not established in the reviewed sources into questions for the vendor. It does not certify, approve, or determine whether a vendor is suitable for your organization.
Why pay when vendor trust-center pages may be free?+
You are not paying for access to a public webpage. You are paying for the finished, dated evidence record: the relevant sources gathered, the evidence organized across a fixed framework, each Documented line linked to its source, unresolved fields turned into buyer-ready questions, and the record reviewed before release.
What questions should I ask a SaaS vendor before a security review?+
Every dossier gathers buyer-ready follow-up questions from its Question surfaced fields — field-level questions your team can send to the vendor in writing, before a call, security review, procurement approval, or renewal.
Can I request a vendor you haven't released?+
Yes. Use the vendor search above — if the record isn't released yet, tell us what you are reviewing. We use request volume to decide future dossiers.
How should my team use a Licensed Edition?+
Use it as an internal evidence record before vendor calls, procurement review, GRC/security review, renewal decisions, or consultant client work.
Can I see the format before licensing?+
Yes — in full. The OpenAI Public Edition is free and complete: the same framework, ledger, source register and integrity record as every Licensed Edition. The clearest way to inspect the format before licensing a vendor dossier.
SaaSDossier is independent documentation research. It is not an audit, certification, rating, legal opinion, vendor approval, or a substitute for professional vendor-risk, legal, procurement, GRC, vCISO, or security review.