# Deloitte 10X Analyst

GenAI agentic platform

Research: https://www.safecli.org/company/deloitte.com
Company: https://deloitte.com

## Evidence status

Insufficient enterprise evidence
Source review: 2026-10-24T16:11:56.159Z
API: Unknown

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Needs clarification

> TrueServe now has an enforceable engineering baseline for SOC 2, HIPAA, GDPR, PCI DSS 4.0.1, CCPA/CPRA, CSA STAR, ISO/IEC 27001, and ISO/IEC 42001.

Source: https://developer.vanguard.dev.trueserve.deloitte.com/compliance/implementation-guide/
Reviewed: 2026-10-24T16:11:56.159Z

> | `commercial-regulated-us` | Active in source | Commercial US security, SOC 2, CSA STAR, ISO 27001, and ISO 42001 engineering boundary.

Source: https://developer.vanguard.dev.trueserve.deloitte.com/compliance/implementation-guide/
Reviewed: 2026-10-24T16:11:56.159Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Not found


- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Company-published

> - Tenant isolation.

Source: https://developer.vanguard.dev.trueserve.deloitte.com/compliance/customer-authentication-controls/
Reviewed: 2026-10-24T16:11:56.159Z

- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Not found


- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Company-published

> Verify MFA, vulnerability blocking, registry referrer support, SBOM/provenance/signature acceptance, independent AI approval, and the customer-specific BAA, DPA, or PCI AOC evidence.

Source: https://developer.vanguard.dev.trueserve.deloitte.com/compliance/implementation-guide/
Reviewed: 2026-10-24T16:11:56.159Z

> "DPA": { "evidence_id": "GRC-DPA-18" }

Source: https://developer.vanguard.dev.trueserve.deloitte.com/compliance/implementation-guide/
Reviewed: 2026-10-24T16:11:56.159Z

- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Company-published

> | Security | Encryption/key class, audit class, workload class, vulnerability SLA, backup and recovery class.

Source: https://developer.vanguard.dev.trueserve.deloitte.com/_planning/compliance-implementation-plan/
Reviewed: 2026-10-24T16:11:56.159Z

- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Not found


- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: