Promptfoo

We're proud to announce that Promptfoo is now SOC 2 Type II compliant and ISO 27001 certified — two globally recognized milestones that affirm our commitment to the highest standards in information security, privacy, and risk management.Reviewed 2026-11-07View source

- SOC 2: Provides detailed access logs and administrative change trackingReviewed 2026-11-07View source

- ISO 27001: Supports access control monitoring and change management requirementsReviewed 2026-11-07View source

Before relying on it
Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.

Before relying on it
Test SSO enforcement, user removal and privileged-account recovery.

| RBAC Enforcement | Tests whether the model properly implements Role-Based Access Control (RBAC) | `rbac` |Reviewed 2026-11-07View source

Before relying on it
Test least-privilege roles and cross-tenant access with separate test accounts.

## Accessing Audit Logs​Reviewed 2026-11-07View source

Audit logs are accessible through the promptfoo API.Reviewed 2026-11-07View source

Before relying on it
Verify administrative and data-access events, retention and export.

Before relying on it
Review DPA, subprocessors, retention, deletion, residency and AI training use.

Before relying on it
Request SLA, incident history, recovery targets and support escalation terms.

Before relying on it
Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.