02.01 · Standards & attestations
DocumentedSOC 2 Type II report
OpenAI has undergone an independent SOC 2 Type 2 examination of controls relevant to Security, Availability, and Confidentiality.trust.openai.com
The vendor's own record, made reviewable.
Before the questionnaire, see what the vendor has published — and what to ask next.
Every field carries the source it came from, and is marked either Documented or Question surfaced. A dated record of the published evidence, never a judgment.
55fields reviewed
10Evidence domains
2States · no judgment
Two states only — Documented Question surfaced
One finished record
One finished record. Every line accountable.
A finished, dated, source-linked, human-reviewed vendor security evidence record built from vendor-published sources. It records what the reviewed sources establish and turns what they do not establish into questions surfaced for review.
From a real evidence ledgerDocumented
02.01 · Standards & attestations
SOC 2 Type II report
OpenAI has undergone an independent SOC 2 Type 2 examination of controls relevant to Security, Availability, and Confidentiality.trust.openai.com
What the record covers: security, privacy, AI data use, subprocessors, data retention, and incident terms — as published by the vendor, with the source shown for every line.
01.03 · Data protection
DocumentedEncryption in transit & at rest
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).trust.openai.com
09.01 · AI governance
DocumentedAI usage disclosure
OpenAI discloses that it trains models on data from public sources, licensed third-party data, and data that trainers and users provide.trust.openai.com
06.02 · Access control
Question surfacedMulti-factor authentication enforced
Reviewed vendor-published sources did not establish the field for the evidence date. This does not establish absence of the control.Buyer-ready follow-up
05.03 · Infrastructure & hosting
Question surfacedPrivate network connectivity
Reviewed vendor-published sources did not establish the field for the evidence date. This does not establish absence of the control.Buyer-ready follow-up
No preview fields match. The complete edition contains all 55.
See all 55 fields →The two-state model
Two states. No third. No judgment.
Every field lands in exactly one of two states. Color is never the only signal — each is labelled in words.
Documented
The reviewed vendor-published sources establish the field for the evidence date.
The field was found in the vendor's published sources, quoted and cited in the vendor's own words.
Question surfaced
The reviewed vendor-published sources do not establish the field for the evidence date, creating a buyer-ready follow-up question.
Reviewed vendor-published sources did not establish the field for the evidence date. This does not establish absence of the control.
Question surfaced does not prove that a control, practice or capability is absent.
The moment it's built for
Built for the moment before.
Walk into the vendor call with the vendor's own published record already organized, and your follow-up questions already clear.
01
Before the questionnaire
Start with the vendor-published evidence already organised instead of beginning with a blank vendor security questionnaire.
02
Before completing a DDQ
Use the record to map relevant published evidence to questionnaire lines and carry unresolved matters forward as precise questions.
03
Before third-party-risk review
Give the reviewer a dated, source-linked record showing what is documented and what still needs asking.
04
Before procurement approval
Give Security, Privacy, Legal, GRC and Procurement one consistent evidence record to review before the organisation makes its own decision.
What you receive
A fixed 55-field evidence record, four ways in.
- LedgerEvidence ledgerAll 55 fields, each in one of two states, the vendor's own words quoted and cited where Documented.
- RegisterSource registerEvery vendor-published page reviewed, listed with its URL — each line traces back to where it was found.
- IntegrityIntegrity recordEach dossier includes a SHA-256 identifier tied to the reviewed evidence record used for that release.
- QuestionsBuyer-ready follow-upsThe questions to ask the vendor, drafted from every Question surfaced — field-level, ready to send in writing.
Finished PDF dossier
Each Licensed Edition is delivered as one finished PDF dossier: a reviewable evidence ledger, source register, integrity record, and buyer-ready follow-up questions in a single document.
PDFEvidence ledgerSource registerBuyer-ready questions
How it's built
Checked against the source record before release.
Each dossier is built only from vendor-published sources reviewed at the time of preparation. Documented fields quote and cite those sources. Fields not established in them are surfaced as buyer-ready follow-up questions — never as a judgment.
Read the full methodology →Discipline of record
- SourcesVendor-published pages only — nothing inferred, nothing borrowed.
- StatesDocumented / Question surfaced. Nothing else exists.
- IntegrityEach dossier includes a SHA-256 identifier tied to the reviewed evidence record used for that release.
- ReviewReviewed before release, against the source register.
A single vendor review cycle can take hours or days across procurement, GRC, legal, and security. SaaSDossier compresses the vendor-published evidence into a source-linked record your team can review before the call.
REAL DOSSIER PAGES
Three real pages from the OpenAI Public Edition: the cover, one evidence-ledger page, and the SHA-256 integrity record.
The released dossiers
Four records. Released and reviewed.
True counts, taken straight from each released dossier. See what each vendor publishes — and the questions to ask next.
StripeLicensed Edition · No. 00146 Documented · 9 Question surfaced
HubSpotLicensed Edition · No. 00249 Documented · 6 Question surfaced
OpenAIPublic Edition · No. 003 · Free47 Documented · 8 Question surfaced
AnthropicLicensed Edition · No. 00447 Documented · 8 Question surfaced
Licensed Edition · No. 004
Anthropic
47Documented
8Question surfaced
55fields reviewed
Request a vendor
Reviewing a vendor we haven't released?
Reviewing a vendor we haven't released yet? Tell us what you are reviewing — request it by email. We use request volume to decide future dossiers.
Pricing and licence
Licensed Editions.
Choose the vendor record your team needs. Each Licensed Edition continues to its dedicated Whop checkout.
Get the Stripe Licensed Edition — US$1,500
Get the HubSpot Licensed Edition — US$1,500
Get the Anthropic Licensed Edition — US$1,500
Need an invoice before purchase? Email contact@saasdossier.com. We can issue a Whop invoice for a Licensed Edition. Include any purchase-order reference in your email.
Licensed Edition use is for one purchasing organization. Excerpts may be shared with external auditors, vCISOs, counsel, procurement reviewers, or GRC advisors under confidentiality.
Start where it costs nothing
Read the complete free edition — the whole format, nothing held back.
The OpenAI Public Edition is free and complete: the same 55-field framework, evidence ledger, source register and integrity record as every Licensed Edition. Read a complete dossier end to end. See the format first, then decide.
Read the free OpenAI dossierNo account or password required.
Questions
Frequently asked.
What is a SaaSDossier?+
A finished PDF record of what a software vendor publishes about its security, privacy, and compliance — the vendor's own record, made reviewable. Every field is either Documented, with the vendor's words quoted and cited, or a Question surfaced for you to raise. One structured, source-linked document, not a folder of raw links.
What do “Documented” and “Question surfaced” mean?+
The only two states. Documented means the field was found in the vendor's published sources, quoted and cited. Question surfaced means: “Reviewed vendor-published sources did not establish the field for the evidence date. This does not establish absence of the control.” A prompt for your own follow-up, never a judgment.
Does a dossier decide whether a vendor is good or bad?+
No. A dossier records what the vendor publishes — nothing more. There is no third state and no number that says good or bad. It gives you the vendor's own record so you can reach your own conclusion.
Does a SaaSDossier replace a SOC 2 report or security questionnaire?+
No. SaaSDossier is the buyer-side evidence layer before or alongside those steps. It organizes what the vendor has already published across 55 fields, links each Documented field to its source, and turns fields not established in the reviewed sources into questions for the vendor. When you prepare a vendor security questionnaire or DDQ (due diligence questionnaire), you can map that reviewed vendor-published evidence to your own questionnaire or review lines and carry the remaining fields forward as follow-up questions. It does not complete your questionnaire, make the third-party-risk decision, or approve the vendor, and it does not certify or determine whether a vendor is suitable for your organization.
Why pay when vendor trust-center pages may be free?+
You are not paying for access to a public webpage. You are paying for the finished, dated evidence record: the relevant sources gathered, the evidence organized across a fixed framework, each Documented line linked to its source, unresolved fields turned into buyer-ready questions, and the record reviewed before release.
What questions should I ask a SaaS vendor before a security review?+
Every dossier gathers buyer-ready follow-up questions from its Question surfaced fields — field-level questions your team can send to the vendor in writing, before a call, security review, procurement approval, or renewal.
Can I request a vendor you haven't released?+
Yes. Use the vendor search above — if the record isn't released yet, tell us what you are reviewing. We use request volume to decide future dossiers.
How should my team use a Licensed Edition?+
Use it as an internal evidence record before vendor calls, procurement review, GRC/security review, renewal decisions, or consultant client work.
Can I see the format before licensing?+
Yes — in full. The OpenAI Public Edition is free and complete: the same framework, ledger, source register and integrity record as every Licensed Edition. The clearest way to inspect the format before licensing a vendor dossier.