postman.com

79 of 100

Enterprise AI readiness, from public pages only

Scanned 2026-11-01 from 98 public pages. Methodology 1.0. Category: Developer tools.

Identity		16 of 16
Assurance		25 of 25
Data and AI terms		4 of 22
Deployment		10 of 10
Agent readiness		16 of 17

Claim this page Compare

Identity

SAML or OIDC single sign-on (10 points) Found

Team's identity provider (IdP) must support the SAML 2.0 standard. source
This feature is available on Postman Enterprise plans and Team plans with the Simple Security add-on. source

Report a problem with this result

SCIM provisioning (6 points) Found

Postman supports SCIM (System for Cross-domain Identity Management), enabling you to automate user provisioning and de-provisioning. source
You can enable SCIM provisioning with the SCIM API , Okta , Microsoft Entra ID , or OneLogin . source

Report a problem with this result

Roles and permissions (4 points) Under review

Report a problem with this result

Assurance

SOC 2 Type 2 (10 points) Found

SOC 2 Type II reports, penetration test summaries, audit reports, and security questionnaire responses are available via the Postman Customer Trust Portal source

Report a problem with this result

ISO 27001 (4 points) Found

ISO 27001 source

Report a problem with this result

Trust center (5 points) Found

Contact: mailto:security@postman.com source

Report a problem with this result

security.txt (2 points) Found

Contact: https://hackerone.com/postman source

Report a problem with this result

Public status page (2 points) Found

Postman Status source

Report a problem with this result

Bug bounty or disclosure program (2 points) Found

Contact: https://hackerone.com/postman source
Bug Bounty Program source
Postman runs a private bug bounty program through HackerOne, inviting security researchers worldwide to identify and responsibly disclose vulnerabilities in the Postman API Platform. source

Report a problem with this result

Data and AI terms

No training on customer data (8 points) Not found in public pages

Pages searched (20)

https://www.postman.com/legal/
https://www.postman.com/ai/ai-ready-apis/
https://www.postman.com/legal/postman-product-terms/
https://www.postman.com/legal/terms/
https://www.postman.com/legal/sub-processors/
https://www.postman.com/legal/postman-website-terms-of-use/
https://www.postman.com/legal/third-party/
https://www.postman.com/legal/postman-acceptable-use-policy/
https://www.postman.com/legal/postman-ai-terms/
https://www.postman.com/legal/reseller-agreement/
https://www.postman.com/legal/enterprise-sla/
https://www.postman.com/ai/ai-ready-apis/leaderboard/
https://www.postman.com/ai/ai-ready-apis/methodology/
https://www.postman.com/legal/professional-services-terms/
https://www.postman.com/legal/government-eulas/
https://www.postman.com/legal/postman-content-policies/
https://www.postman.com/legal/logo-usage/
https://www.postman.com/legal/community-code-of-conduct/
https://www.postman.com/legal/events-code-of-conduct/
https://www.postman.com/legal/astro-ai-terms-of-service/

Report a problem with this result

Retention periods (5 points) Not found in public pages

Pages searched (20)

https://www.postman.com/legal/
https://www.postman.com/ai/ai-ready-apis/
https://www.postman.com/legal/postman-product-terms/
https://www.postman.com/legal/terms/
https://www.postman.com/legal/sub-processors/
https://www.postman.com/legal/postman-website-terms-of-use/
https://www.postman.com/legal/third-party/
https://www.postman.com/legal/postman-acceptable-use-policy/
https://www.postman.com/legal/postman-ai-terms/
https://www.postman.com/legal/reseller-agreement/
https://www.postman.com/legal/enterprise-sla/
https://www.postman.com/ai/ai-ready-apis/leaderboard/
https://www.postman.com/ai/ai-ready-apis/methodology/
https://www.postman.com/legal/professional-services-terms/
https://www.postman.com/legal/government-eulas/
https://www.postman.com/legal/postman-content-policies/
https://www.postman.com/legal/logo-usage/
https://www.postman.com/legal/community-code-of-conduct/
https://www.postman.com/legal/events-code-of-conduct/
https://www.postman.com/legal/astro-ai-terms-of-service/

Report a problem with this result

Subprocessor list (5 points) Not found in public pages

Pages searched (3)

https://www.postman.com/legal/
https://www.postman.com/legal/sub-processors/
https://www.postman.com/legal/archives/

Report a problem with this result

Data processing agreement (4 points) Under review

Report a problem with this result

Data residency (4 points) Found

Data Residency source
hosted on AWS servers in the EU and the U.S. source

Report a problem with this result

Deployment

Private deployment (6 points) Found

Postman Private Cloud (PPC) is a dedicated, single-tenant deployment that Postman manages on your behalf. source

Report a problem with this result

Customer-managed keys (4 points) Found

Enterprise customers can also opt for Postman's Bring Your Own Key (BYOK) encryption feature, which enables them to manage and control their own encryption keys. source

Report a problem with this result

Agent readiness

Public API reference (5 points) Found

The Secret Scanner Postman API endpoints are available with the Postman Enterprise plan with the Advanced Security Administration add-on. source

Report a problem with this result

Official MCP server (6 points) Found

com.postman/postman-mcp-server: A basic MCP server to operate on the Postman API. source

Report a problem with this result

Controls on AI agent actions (4 points) Found

You decide if the Autonomous API Engineer runs. source
Auto-run is off by default source
An agent inherits exactly the access of the person running it, no more. source

Report a problem with this result

Audit log export (2 points) Partly found

Audit Logs source
Admins govern who can use the Postman CLI and connect coding agents with RBAC, SSO, and audit logs source

Report a problem with this result

AI use policy (2 points) Under review

Report a problem with this result

Rate limits documented (not scored) Found

Postman API access rate limits source
Use Postman Simulator to group mocks of the services your app depends on, then test how your service responds when those dependencies fail with latency, errors, and rate limits. source

Report a problem with this result

Changelog

2026-11-01: 99 to 79 (rescan) Data processing agreement: Could not check to under review; No training on customer data: Could not check to Not found in public pages; Retention periods: Could not check to Not found in public pages; Subprocessor list: Could not check to Not found in public pages; Roles and permissions: Found to under review; Public status page: Could not check to Found
2026-11-01: First score, 99

Scores older than an hour can be refreshed.