Sayari

Yes. Sayari's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Sayari hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Sayari publishes an ISO certificate on its trust center; you can request access through SOC2C.

Sayari's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Sayari is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, ISO 27701, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Sayari hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@sayari.com or via a /security page (Sayari lists a security contact).

Sayari's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Sayari's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Sayari's trust center is at https://trust.sayari.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

We take the security of our systems and the data entrusted to us seriously. We understand that maintaining a secure environment is a continuous process, and we value the contributions of the security community in identifying vulnerabilities that may otherwise go unnoticed. If you believe you have discovered a vulnerability in our systems, we encourage you to report it as soon as possible. We are committed to working with the security community to verify, address, and mitigate potential vulnerabilities. To report a vulnerability, please email us at security@sayari.com. When reporting a vulnerability, please include the following information: - A detailed description of the vulnerability, including the affected systems or services. - Steps to reproduce the vulnerability. - Any potential impact or risk associated with the vulnerability. - Your contact information for follow-up (optional). We request that you do not publicly disclose the vulnerability until we have had an opportunity to investigate and address it. We will acknowledge receipt of your report within 72 hours and will keep you informed of our progress. If your report is determined to be a legitimate vulnerability, we will: - Provide an estimated timeline for addressing the vulnerability. - Notify you when the vulnerability has been addressed. - Credit you for your discovery if you wish (unless you prefer to remain anonymous).