SaaSDossier

No. 003 · Public Edition

OpenAI — Security Evidence Dossier

Question
What security evidence does OpenAI publish?
Answer
OpenAI publishes a trust portal and enterprise-privacy pages covering SOC 2 Type II, ISO/IEC 27001, CSA STAR, and business-data handling. The free Public Edition records 47 of 55 fields as Documented and surfaces 8 buyer follow-up questions.
47 Documented8 Questions surfacedof 55
Cover of the OpenAI Security Evidence Dossier — Public Edition, Dossier No. 003
Edition
Public Edition
Reference
Dossier No. 003
Framework
55 fields · 10 domains
Documented
47 of 55
Questions surfaced
8
Evidence date
22 June 2026
Release date
2026-07-02
Vendor pages reviewed
14
Price
Free — Public Edition

10 domains reviewed

  • Identity & legal entity
  • Standards & attestations
  • Privacy & compliance
  • Encryption & key management
  • Infrastructure & hosting
  • Access control
  • Vulnerability & incident response
  • Subprocessors & supply chain
  • AI governance
  • Secure development & organization

A sample of the evidence ledger

A preview of the discipline — one Documented, one Question surfaced. The full 55-field ledger is in the dossier.

Documented
SOC 2 Type II
Question surfaced
SOC 2 Type I report

What's inside

Evidence ledger

All 55 fields across 10 domains, each recorded in one of two states, with the vendor's own words quoted and cited where Documented.

Source register

Every vendor-published page reviewed, listed with its URL, so each line traces back to where it was found.

Integrity record

Each dossier includes a SHA-256 identifier tied to the reviewed evidence record used for that release.

Buyer-ready vendor follow-up questions

Field-level follow-ups generated from Question surfaced entries, used to help buyers decide what to confirm with the vendor in writing.

Question surfaced means: Reviewed vendor-published sources did not establish the field for the evidence date. This does not establish absence of the control.

Using this record for a vendor security questionnaire or DDQ? See how SaaSDossier supports the review without completing or deciding it for you.