Methodology · How a dossier is built
Calm, bounded, and traceable.
Every dossier records what a vendor publishes — nothing inferred, nothing judged. Here is exactly how each one is prepared.
How the record supports questionnaire preparation
A fixed 55-field evidence record
Every dossier follows the same framework of 55 review fields across 10 domains, so any two dossiers are directly comparable. Identity and legal entity are treated as their own domain; the remaining nine cover attestations, privacy, encryption, infrastructure, access, incident practice, subprocessors, AI governance, and secure development.
- Identity & legal entity
- Standards & attestations
- Privacy & compliance
- Encryption & key management
- Infrastructure & hosting
- Access control
- Vulnerability & incident response
- Subprocessors & supply chain
- AI governance
- Secure development & organization
Checked against the source record before release.
Each dossier is built from vendor-published sources reviewed at the time of preparation. Documented findings are checked against the reviewed source record before release, and items not established in those sources are surfaced as buyer-ready follow-up questions. Each dossier includes a SHA-256 identifier tied to the reviewed evidence record used for that release.
Source rules
Built only from vendor-published sources — trust and security centers, privacy and legal pages, data-processing terms, status pages, subprocessor lists, and published documentation. No third-party articles, news, or opinions are used as evidence. Every line traces to a source in the register. Each dossier includes a SHA-256 identifier tied to the reviewed evidence record used for that release.
The two states
Documented
Found in the vendor's published sources, quoted and cited in the vendor's own words.
Question surfaced
Reviewed vendor-published sources did not establish the field for the evidence date. This does not establish absence of the control.
Frequently asked
What is a SaaSDossier?
A SaaSDossier is a finished PDF record of what a software vendor publishes about its security, privacy, and compliance — the vendor's own record, made reviewable. Every field is either Documented, with the vendor's words quoted and cited, or a Question surfaced for you to raise. It is one structured, source-linked document, not a folder of raw links.
What do “Documented” and “Question surfaced” mean?
Those are the only two states. Documented means the field was found in the vendor's published sources, quoted and cited. Question surfaced means: “Reviewed vendor-published sources did not establish the field for the evidence date. This does not establish absence of the control.” It is a prompt for your own follow-up, never a judgment.
Does a dossier decide whether a vendor is good or bad?
No. A dossier records what the vendor publishes — nothing more. There is no third state and no number that says good or bad. It gives you the vendor's own record so you can reach your own conclusion: clarity before commitment.
Where does the evidence come from?
Only from the vendor's own published pages — trust and security centers, privacy and legal pages, data-processing terms, status pages, and subprocessor lists. Every line traces to a source. Each dossier includes a SHA-256 identifier tied to the reviewed evidence record used for that release. No third-party articles or opinions are used as evidence.
How is each dossier prepared?
Each dossier is built from vendor-published sources reviewed at the time of preparation. Documented findings are checked against the reviewed source record before release, and items not established in those sources are surfaced as buyer-ready follow-up questions. Each dossier includes a SHA-256 identifier tied to the reviewed evidence record used for that release.
Can I see the format before I buy?
Yes. The OpenAI Public Edition is free and complete — the same 55-field framework, evidence ledger, source register, and integrity record as every Licensed Edition. The clearest way to inspect the format before licensing a vendor dossier.
How should my team use a Licensed Edition?
Use it as an internal evidence record before vendor calls, procurement review, GRC/security review, renewal decisions, or consultant client work. It helps your team see what the vendor publishes, what questions to ask next, and where the source record sits. It is not an audit, certification, rating, legal opinion, or vendor approval.
Disclaimer. SaaSDossier is independent documentation research and is not affiliated with, endorsed by, or certified by any vendor reviewed. Built from vendor-published sources reviewed at the time of preparation. SaaSDossier is a compiled evidence record — not an audit, certification, rating, legal opinion, vendor approval, or substitute for professional vendor-risk, legal, procurement, GRC, vCISO, or security review. Built only from the vendor's own published pages, reviewed as of each dossier's evidence date; those pages may change after preparation. No relationship with, or endorsement by, any vendor is implied.
