SOC2C

Is this your company? Buyers are checking Promptfoo here. Claim promptfoo.dev free to control the listing, earn the badge buyers trust, and see who's evaluating you.

Claim free
Promptfoo logo

Promptfoo

promptfoo.dev· Security contact
Security overviewCompliancePenetration test
Trust level
Listed
Unverified

Sourced from public information. Not yet verified by the company.

Promptfoo is SOC 2 Type II compliant. Promptfoo also holds ISO 27001.

Request report accessClaim this profile
Framework
SOC 2 Type II
Auditor
Not publicAdd
Last report
—Add
Renewal
UnknownAdd
View official trust center ↗

About

Promptfoo finds and fixes LLM vulnerabilities through adversarial evaluation and red teaming. We are the most widely adopted tool for LLM security, with over 100,000 users and adoption at major tech companies. Our mission is to democratize AI security for all.

Compliance & infrastructure

ISO 27001SOC 2 Type II
Hosting
GCPAzure

Documents

4
Documents

Subprocessors

8
  • G
    Google Cloud Platform · Cloud provider
    US
  • O
    OpenAI · Application AI functionality
    United States
  • C
    Cloudflare · CDN and DDoS Protection
    US
  • P
    PostHog · Data analytics
    United States
  • F
    FusionAuth · Identity provider
    United States
  • S
    Sentry · Application performance monitoring and error tracking
    United States
  • G
    GitHub · Version control
    United States
  • M
    Microsoft Azure · AI services and inference
    United States

Compliance leadership

The person who leads Promptfoo's SOC 2 isn't listed yet. Claim this profile to add it.

Penetration test

Unknown. Promptfoo's penetration test vendor isn't listed yet.

Claim this profile to add it.

Recent updates

Welcome to Promptfoo's Trust Center!Aug 2025

Welcome to Promptfoo's Trust Center. Please use this portal to access our latest security documents. You can also subscribe to updates regarding sub-processors.

This listing is partial

7/11 details · 64%

SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.

  • Auditorraises trust
    Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
  • Report dateraises trust
    Add your most recent report period so buyers see how current your SOC 2 is.
  • Renewal date
    Add your renewal window so buyers know your coverage is active.
  • Security controls
    Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing

Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.

Frequently asked

Is Promptfoo SOC 2 compliant?
Promptfoo is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Promptfoo ISO 27001 certified?
According to Promptfoo's public trust center, Promptfoo is ISO 27001 certified. On SOC2C this listing is Listed.
Is Promptfoo SOC 2 Type I or Type II?
Promptfoo is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Promptfoo's SOC 2 for a vendor risk assessment?
Yes. Promptfoo's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Promptfoo penetration tested?
Promptfoo hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.