07
Trust documentation for Allison
Verified live today. The Vercel and Netlify document libraries sit behind an access request with a click-through NDA, so start those requests in Phase 00.
| Vendor | Where | Attestations |
|---|---|---|
| Vercel | security.vercel.com | SOC 2, SOC 3, ISO/IEC 27001, PCI DSS, HIPAA and HITECH, GDPR, CCPA/CPRA, EU-US DPF, NIS 2, DORA, TISAX. Downloadable: SOC 2 Report, HIPAA Report, Pentest Report, Security Whitepaper, Network and Architecture Diagrams, Subprocessors, DPA. |
| Cloudflare | cloudflare.com/trust-hub | SOC 2 Type 2, ISO 27001, PCI DSS. Cloudflare Business additionally carries a PCI DSS 4.0 compliance posture. |
| Sanity | sanity.io/security | SOC 2 Type 2 — Security criterion only, narrower than Vercel's. GDPR compliant, PCI handled via Stripe, hosted on Google Cloud. No HIPAA attestation. Raise this proactively; it is the item most likely to come back from a reviewer. |
| Netlify | netlify.com/trust-center | Included because both hosts were requested. Vercel is the recommendation — Netlify silently lowercases deployed file paths, which has broken mixed-case assets for us before. |