# Promptfoo

Automated red teaming

Research: https://www.safecli.org/company/promptfoo.dev
Company: https://promptfoo.dev

## Evidence status

Insufficient enterprise evidence
Source review: 2026-11-07T14:58:30.066Z
API: Public API

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Mixed claims — review

> We're proud to announce that Promptfoo is now SOC 2 Type II compliant and ISO 27001 certified — two globally recognized milestones that affirm our commitment to the highest standards in information security, privacy, and risk management.

Source: https://www.promptfoo.dev/blog/SOC2-compliance/
Reviewed: 2026-11-07T14:58:30.066Z

> - SOC 2: Provides detailed access logs and administrative change tracking

Source: https://www.promptfoo.dev/docs/enterprise/audit-logging/
Reviewed: 2026-11-07T14:58:30.066Z

> - ISO 27001: Supports access control monitoring and change management requirements

Source: https://www.promptfoo.dev/docs/enterprise/audit-logging/
Reviewed: 2026-11-07T14:58:30.066Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Not found


- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Company-published

> | RBAC Enforcement | Tests whether the model properly implements Role-Based Access Control (RBAC) | `rbac` |

Source: https://www.promptfoo.dev/docs/red-team/llm-vulnerability-types/
Reviewed: 2026-11-07T14:58:30.066Z

- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Company-published

> ## Accessing Audit Logs​

Source: https://www.promptfoo.dev/docs/enterprise/audit-logging/
Reviewed: 2026-11-07T14:58:30.066Z

> Audit logs are accessible through the promptfoo API.

Source: https://www.promptfoo.dev/docs/enterprise/audit-logging/
Reviewed: 2026-11-07T14:58:30.066Z

- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Not found


- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Not found


- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Not found


- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: