Black Kite

Yes. Black Kite's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Black Kite hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Black Kite is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR, ISO 27001, CSA STAR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Black Kite hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@blackkite.com or via a /security page (Black Kite lists a security contact).

Black Kite lists 5 subprocessors on its trust center, including Google Cloud Platform, Google Gemini, Pendo, Amazon, SendGrid. Buyers use this for fourth-party risk review.

Black Kite hosts on GCP, and handles Customer personally identifiable information. Data residency details are on its trust center.

Black Kite's trust center is at https://trust.blackkite.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Black Kite uses open source intelligence methods to gather data. This is accomplished using web crawlers and a variety of information feeds such as social media and dark-web forums.

Because Black Kite uses public data to perform its service, it does not require any sensitive personal data from users. Users of the platform will need to provide a functional business email address to create an account. Additionally, users may sign up using their full name, or an alias if they would prefer.

"Customer data" refers to any documents, files, or information uploaded to our platform by a customer for analysis or processing. This includes materials originating directly from the customer as well as documents they may have received from their own customers and subsequently uploaded to our platform. Such data is considered proprietary to the customer and is handled in accordance with our data privacy and security policies.

As described in our Core AI Tenets, Black Kite never uses customer data to train any public or private models.

Two ways: 1. Black Kite is revolutionizing OSINT data extraction with advanced AI and large language models (LLMs), enabling faster, more precise analysis. 2. With the upcoming update to our UniQuE Parser, we’re introducing a smarter, faster, and more efficient way to assess compliance documentation—without compromising your data privacy. For these solutions, Black Kite use Google Cloud Platform’s Vertex AI platform that includes the Gemini AI model.

Yes, Black Kite provides customers with the flexibility to decide whether to use AI-driven features. Customers can enable or disable AI-powered functionalities as needed to suit their preferences and compliance requirements.

Black Kite chose to use a commercial off-the-shelf AI solution that has robust Responsible AI guidelines.. Moreover Black Kite’s use of AI pertains to cybersecurity recommendations and decision augmentation which is not typically affiliated with AI bias topics.

Black Kite chose to use a commercial off-the-shelf AI solution that has robust governance and security guidelines. Moreover, Black Kite has established an internal AI governance committee who oversees risk associated with AI within Black Kite.

Yes, Black Kite leverages generative AI in specific areas to enhance our platform's capabilities. Generative AI is used to deliver insights such as data analysis, search and recommendation, and summarization. Importantly, we only use generative AI when directed by the user, ensuring customer control and alignment with our AI tenets.

Generative AI in Black Kite is utilized for: - Data Analysis: To uncover insights and relationships in data, such as detecting anomalies in cybersecurity logs or proposing remediation actions. - Analyze and Recommend: To analyze and recommend useful content, such as identifying regulations related to specific cybersecurity topics. - Summarization: To generate concise summaries of reports, frameworks, and other documents to help users identify key insights quickly. - Compliance mapping: Find the relevant evidence in compliance documents to map it to a set controls in regulatory frameworks and decide whether the controls are met or not

No, Black Kite does not share customer data with AI systems for training.

Black Kite adheres to all applicable laws and regulations governing AI development and deployment. We ensure transparency about our AI capabilities, mitigate biases, and uphold high standards for data governance and privacy. For detailed compliance information, please visit the Resources section in our Trust Center.