{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"metal","name":"Metal","domain":"metal.ai","category":"Finance and accounting","one_liner":"The AI context platform for private capital. Everything your firm…","trust_center_url":"https://security.metal.ai/","security_page_url":null,"url":"https://certreports.com/vendors/metal/security","last_verified_at":"2026-09-30T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 30 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 2 Type II on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/metal/soc-2","evidence":[{"source_type":"trust_center","source_name":"Metal trust centre (Vanta)","url":"https://security.metal.ai/","fetched_at":"2026-09-29 02:06:07.894325+00","content_hash":"e380fc1146f55b978de5af9b133afa8f91ae33d2e7e93e7f5a9954ae0f61314f","wayback_url":null,"quote":"SOC 2 Type II","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 30 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/metal/gdpr","evidence":[{"source_type":"trust_center","source_name":"Metal trust centre (Vanta)","url":"https://security.metal.ai/","fetched_at":"2026-09-29 02:06:07.894325+00","content_hash":"e380fc1146f55b978de5af9b133afa8f91ae33d2e7e93e7f5a9954ae0f61314f","wayback_url":null,"quote":"GDPR","confidence":1}]}],"brief":{"summary":"For SOC 2, Metal states on its trust centre that it holds a SOC 2 Type II report, as of 18 Sep 2026. That SOC 2 statement is vendor-stated, as of 18 Sep 2026, and the evidence includes no auditor name, issue date, or report period. For GDPR, Metal states on its trust centre that it addresses GDPR obligations, as of 18 Sep 2026. That GDPR statement is also vendor-stated rather than confirmed by a third-party registry, as of 18 Sep 2026. No public evidence beyond these two vendor statements was found for Metal, as of 18 Sep 2026.","bullets":["SOC 2: vendor states it holds a SOC 2 Type II report on its trust centre, as of 18 Sep 2026 - vendor-stated, not independently verified.","GDPR: vendor states on its trust centre that it addresses GDPR obligations, as of 18 Sep 2026 - vendor-stated, not independently verified.","No public evidence found for other frameworks for Metal, as of 18 Sep 2026."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-20 10:13:27.538821+00"},"legal_docs":[{"kind":"subprocessors","url":"https://security.metal.ai/","availability":"public","detail":"10 subprocessors listed on the trust centre","as_of":"2026-09-30"},{"kind":"privacy","url":"https://www.metal.ai/legal/privacy-policy","availability":"public","detail":null,"as_of":"2026-09-30"}],"documents":[],"statements":[],"security_profile":{"iso42001":null,"trains_on_customer_data":null,"data_residency_regions":[],"pen_test_cadence":null,"as_of":"2026-09-30"},"regulations_url":"https://certreports.com/api/v1/vendors/metal/regulations/{regulation}","subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Cloud provider","location":"US","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Anthropic","domain":"anthropic.com","purpose":"AI service provider","location":"US","vendor_url":"https://certreports.com/vendors/anthropic/security"},{"name":"Datadog","domain":"datadoghq.com","purpose":"Observability","location":"US","vendor_url":"https://certreports.com/vendors/datadog/security"},{"name":"Fireworks","domain":"fireworks.ai","purpose":"AI service provider","location":"US","vendor_url":"https://certreports.com/vendors/fireworks-ai/security"},{"name":"MongoDB Atlas","domain":"mongodb.com","purpose":"Data storage","location":"US","vendor_url":"https://certreports.com/vendors/mongodb/security"},{"name":"OpenAI","domain":"openai.com","purpose":"AI service provider","location":"US","vendor_url":"https://certreports.com/vendors/openai/security"},{"name":"PostHog","domain":"posthog.com","purpose":"Data analytics","location":"US","vendor_url":"https://certreports.com/vendors/posthog/security"},{"name":"PropelAuth","domain":"propelauth.com","purpose":"Authentication","location":"US","vendor_url":"https://certreports.com/vendors/propelauth/security"},{"name":"Reducto","domain":"reducto.ai","purpose":"AI service provider","location":"US","vendor_url":"https://certreports.com/vendors/reducto/security"},{"name":"Vespa.ai","domain":"vespa.ai","purpose":"Search infrastructure","location":"US","vendor_url":null}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-03T18:40:32.673Z"}