rudderstack.com
A
89 of 100
Enterprise AI readiness, from public pages only
Scanned 2026-11-01 from 73 public pages. Methodology 1.0. Category: Data.
| Identity | 16 of 16 | |
| Assurance | 19 of 21 | |
| Data and AI terms | 22 of 26 | |
| Deployment | 6 of 6 | |
| Agent readiness | 10 of 13 |
Identity
SAML or OIDC single sign-on (10 points) Found
SCIM provisioning (6 points) Found
Configure SSO and SCIM provisioning with Okta.
source
Roles and permissions (4 points) Under review
Assurance
SOC 2 Type 2 (10 points) Found
We have obtained SOC 2 Type 2 compliance and regularly audit our policies and procedures
source
ISO 27001 (4 points) Under review
security.txt (2 points) Not found in public pages
Pages searched (1)
https://www.rudderstack.com/.well-known/security.txt
Bug bounty or disclosure program (2 points) Found
Data and AI terms
No training on customer data (8 points) Found
Processor will not use Personal Data to train or fine-tune any machine-learning or large-language model.
source
Retention periods (5 points) Found
Customer data processed by RudderStack is retained for no longer than three (3) hours unless Customer specifically chooses to use RudderStack event storage for up to a maximum of 30 days.
sourceconversation history (Prompts and Outputs) is stored in the Control Plane in the AWS region selected for Customer's Account, encrypted at rest (AES-256) and in transit
source
Subprocessor list (5 points) Found
Amazon Web Services, Inc. ("AWS USA") - United States - Cloud Service Provider (infrastructure hosting; and, where Customer enables AI Features, large-language-model inference via Amazon Bedrock in a US region
sourceLangfuse GmbH, a ClickHouse company (Germany) - United States (Langfuse Cloud US region) - Observability
source
Data processing agreement (4 points) Found
The Platform if purchased from Company via a separately executed agreement that incorporates a data processing agreement between you and the Company.
sourceNote that we may also process Personal Data of our customers' end users or employees in connection with our provision of the Platform to customers, in which cases we are the processor of Personal Data under a separate Data Processing Agreement.
sourceData processing addendum
source
Data residency (4 points) Not found in public pages
Pages searched (1)
https://www.rudderstack.com/competitors/rudderstack-vs-segment/
Deployment
Private deployment (6 points) Found
Customer-managed keys (4 points) Under review
Agent readiness
Public API reference (5 points) Found
Complete Pixel API reference for tracking events via GET requests when POST is not feasible
source
Official MCP server (6 points) Under review
Controls on AI agent actions (4 points) Found
Review required for execution and writes : Review and confirm write and sensitive execution tools before running them. Don't configure agents to auto-approve sensitive execution tools.
sourceThe MCP server accesses only the workspaces and resources your RudderStack account has permission to access
source
Audit log export (2 points) Partly found
Audit logs - Track user activities within your RudderStack workspace
source
AI use policy (2 points) Not found in public pages
Pages searched (7)
https://www.rudderstack.com/security/https://www.rudderstack.com/product/compliance-toolkit/https://www.rudderstack.com/competitors/rudderstack-vs-segment/https://www.rudderstack.com/terms-of-service/https://www.rudderstack.com/vulnerability-disclosure-policy/https://www.rudderstack.com/customers/ai-ready-foundation-with-bolcom/https://www.rudderstack.com/integration/
Rate limits documented (not scored) Under review
Changelog
- 2026-11-01: 96 to 89 (rescan) AI use policy: Could not check to Not found in public pages; Official MCP server: Could not check to under review; Rate limits documented: Could not check to under review; Data residency: Could not check to Not found in public pages; Customer-managed keys: Could not check to under review; ISO 27001: Could not check to under review
- 2026-11-01: First score, 96
Scores older than an hour can be refreshed.