# Descartes Visual Compliance

Automated compliance screening software

Research: https://www.safecli.org/company/descartes.com
Company: https://descartes.com

## Evidence status

Procurement review needed
Source review: 2026-10-23T13:59:22.727Z
API: Unknown

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Company-published

> SOC 2 Type II reporting

Source: https://www.descartes.com/resources/knowledge-center/seeking-roadnet-alternative
Reviewed: 2026-10-23T13:59:22.727Z

> Descartes operates a security-first SaaS infrastructure governed by SOC 2 Type II and ISO 27001 standards, with 24/7 threat monitoring and fully redundant architecture across six global data centers.

Source: https://www.descartes.com/resources/knowledge-center/seeking-roadnet-alternative
Reviewed: 2026-10-23T13:59:22.727Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Company-published

> Single sign-on (SSO) should be part of the process to minimize the number of login credentials required and streamline business processes.

Source: https://www.descartes.com/resources/knowledge-center/10-cybersecurity-considerations-fleet-routing
Reviewed: 2026-10-23T13:59:22.727Z

- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Not found


- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Mixed claims — review

> Risk Mitigation The automated, centralized Descartes solution helps easily screen potential business partners and provides an automatically generated audit trail to ensure reliable export compliance.

Source: https://www.descartes.com/sites/default/files/media/documents/2022-01/cs_visual_compliance_salesforce.pdf
Reviewed: 2026-10-23T13:59:22.727Z

> ### Q: How do you maintain an audit trail using the Descartes MK Denial solution?

Source: https://www.descartes.com/resources/knowledge-center/descartes-mk-denied-party-screening-descartes-mk-dps
Reviewed: 2026-10-23T13:59:22.727Z

> ### Q: How long does the system keep the audit trail?

Source: https://www.descartes.com/resources/knowledge-center/descartes-mk-denied-party-screening-descartes-mk-dps
Reviewed: 2026-10-23T13:59:22.727Z

- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Mixed claims — review

> Data Processing Agreements | Descartes

Source: https://www.descartes.com/legal/customer-agreements/data-processing-agreement
Reviewed: 2026-10-23T13:59:22.727Z

> # Data Processing Agreements

Source: https://www.descartes.com/legal/customer-agreements/data-processing-agreement
Reviewed: 2026-10-23T13:59:22.727Z

> Descartes will Process Personal Data as necessary for the purposes of the Agreement in accordance with this DPA and will not disclose Personal Data to third parties other than to Descartes’ Affiliates or Third Party Processors for the aforementioned purposes or as required by law.

Source: https://www.descartes.com/legal/customer-agreements/data-processing-agreement
Reviewed: 2026-10-23T13:59:22.727Z

- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Company-published

> For data centre migrations other than for the purposes of disaster recovery, Descartes will provide a minimum of thirty (30) days notice to Customer.

Source: https://www.descartes.com/legal/customer-agreements/gln-services-delivery-policy
Reviewed: 2026-10-23T13:59:22.727Z

> Data Backup and Disaster Recovery

Source: https://www.descartes.com/resources/knowledge-center/10-cybersecurity-considerations-fleet-routing
Reviewed: 2026-10-23T13:59:22.727Z

- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Company-published

> ### 10th Annual Global Transportation Management Benchmark Survey

Source: https://descartes.com/
Reviewed: 2026-10-23T13:59:22.727Z

- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: