SaaSDossier™

What a SaaS Vendor Security Evidence Dossier Looks Like — Free Example

A SaaSDossier record covers 55 fixed fields across 10 domains, from identity and attestations to AI governance and secure development. Each field is either Documented or marked as a Question surfaced for review — never a judgment. The free OpenAI Public Edition shows the exact format end to end.

The format exists to carry a job. Before a vendor security questionnaire or DDQ, SaaSDossier organises the vendor's published security evidence into a finished, source-linked record, so a review team can see what is Documented, what becomes a Question surfaced, and what still needs follow-up before procurement, onboarding or deeper review. It supports the buyer's work; it does not complete the questionnaire, score the vendor or make the approval decision.

A SaaSDossier™ record covers 55 fixed fields across 10 domains — identity, attestations, privacy, encryption, hosting, access, incident response, subprocessors, AI governance, and secure development. Each field is marked Documented or is marked Question surfaced for review. The free OpenAI Public Edition shows the exact format end to end.

See all 55 fields Download the free OpenAI dossier Methodology

Two states. No third. No judgment.

Documented

The field was found in the vendor's published sources, quoted and cited in the vendor's own words.

Question surfaced

Reviewed vendor-published sources did not establish the field for the evidence date. This does not establish absence of the control.

Free example · What's inside

Evidence ledger

All 55 fields across 10 domains, each recorded in one of two states, with the vendor's own words quoted and cited where Documented.

Source register

Every vendor-published page reviewed, listed with its URL, so each line traces back to where it was found.

Integrity record

Each dossier includes a SHA-256 identifier tied to the reviewed evidence record used for that release.

Buyer-ready vendor follow-up questions

Field-level follow-ups generated from Question surfaced entries, used to help buyers decide what to confirm with the vendor in writing.

47 Documented8 Questions surfacedof 55

The OpenAI Public Edition is free and complete. Read all 55 fields →

Frequently asked

Can I see the format before I buy?
Yes. The OpenAI Public Edition is free and complete — the same 55-field framework, evidence ledger, source register, and integrity record as every Licensed Edition. The clearest way to inspect the format before licensing a vendor dossier.
What is a SaaSDossier?
A SaaSDossier is a finished PDF record of what a software vendor publishes about its security, privacy, and compliance — the vendor's own record, made reviewable. Every field is either Documented, with the vendor's words quoted and cited, or a Question surfaced for you to raise. It is one structured, source-linked document, not a folder of raw links.
What do “Documented” and “Question surfaced” mean?
Those are the only two states. Documented means the field was found in the vendor's published sources, quoted and cited. Question surfaced means: “Reviewed vendor-published sources did not establish the field for the evidence date. This does not establish absence of the control.” It is a prompt for your own follow-up, never a judgment.
Where does the evidence come from?
Only from the vendor's own published pages — trust and security centers, privacy and legal pages, data-processing terms, status pages, and subprocessor lists. Every line traces to a source. Each dossier includes a SHA-256 identifier tied to the reviewed evidence record used for that release. No third-party articles or opinions are used as evidence.
Disclaimer. SaaSDossier is independent documentation research and is not affiliated with, endorsed by, or certified by any vendor reviewed. Built from vendor-published sources reviewed at the time of preparation. SaaSDossier is a compiled evidence record — not an audit, certification, rating, legal opinion, vendor approval, or substitute for professional vendor-risk, legal, procurement, GRC, vCISO, or security review.

Related references

See the free OpenAI ledger Methodology Whop store