# Operalytix

AI renewal outreach

Research: https://www.safecli.org/company/operalytix.com
Company: https://operalytix.com

## Evidence status

Procurement review needed
Source review: 2026-10-19T14:16:47.758Z
API: Unknown

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Needs clarification

> We map Operalytix controls onto your existing framework — SOC 2, ISO 27001, HIPAA, GDPR, DORA, NIS2, regional equivalents — so your audit doesn't grow because you added us.

Source: https://operalytix.com/security
Reviewed: 2026-10-19T14:16:47.758Z

> For each one they collected and read a thick evidence pack: the vendor's security questionnaire, its SOC 2 report, penetration-test summaries, business-continuity and disaster-recovery plans, financial statements, and the contract — then mapped all of it against the firm's control requirements, flagged the gaps, and assembled a risk assessment for sign-off.

Source: https://operalytix.com/stories/composite-third-party-vendor-risk
Reviewed: 2026-10-19T14:16:47.758Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Company-published

> - SSO: SAML 2.0 + OIDC.

Source: https://operalytix.com/security
Reviewed: 2026-10-19T14:16:47.758Z

> - Provisioning: SCIM 2.0 with group sync.

Source: https://operalytix.com/security
Reviewed: 2026-10-19T14:16:47.758Z

- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Not found


- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Mixed claims — review

> On-prem, in your VPC, or in a sovereign region — your data, your models, your audit trail.

Source: https://operalytix.com/
Reviewed: 2026-10-19T14:16:47.758Z

> ### Per-decision audit trail

Source: https://operalytix.com/security
Reviewed: 2026-10-19T14:16:47.758Z

> Draft Suspicious Activity Report narratives from your case-management data, with the model running inside the bank — no third-party API, full audit trail per decision.

Source: https://operalytix.com/
Reviewed: 2026-10-19T14:16:47.758Z

- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Company-published

> Input data retention

Source: https://operalytix.com/security
Reviewed: 2026-10-19T14:16:47.758Z

> Employee app Data Processing Agreement · Operalytix

Source: https://operalytix.com/app/dpa
Reviewed: 2026-10-19T14:16:47.758Z

- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Company-published

> Threat model, deployment runbooks, incident-response playbooks, model cards, and the binding SLA are available under NDA.

Source: https://operalytix.com/security
Reviewed: 2026-10-19T14:16:47.758Z

> For multi-department production deployments with a real SLA.

Source: https://operalytix.com/pricing
Reviewed: 2026-10-19T14:16:47.758Z

- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Company-published

> When a real customer authorises a named case study, we replace one of the illustrative entries with the named reference and label it accordingly.

Source: https://operalytix.com/customers
Reviewed: 2026-10-19T14:16:47.758Z

- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: