{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"tolmo","name":"Tolmo","domain":"tolmo.com","category":"Security","one_liner":"Tolmo is the AI security platform that secures every layer of cloud…","trust_center_url":"https://trust.tolmo.com/","security_page_url":null,"url":"https://certreports.com/vendors/tolmo/security","last_verified_at":"2026-09-30T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 30 Sep 2026.","kind":null,"status_text":"Vendor states SOC 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-30","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/tolmo/soc-2","evidence":[{"source_type":"trust_center","source_name":"Tolmo trust centre (Vanta)","url":"https://trust.tolmo.com/","fetched_at":"2026-09-29 02:11:16.938102+00","content_hash":"b27f231453ebd102869e38521c8cd5527a90fef9c5b12167ddedd9767b2584c0","wayback_url":null,"quote":"SOC 2","confidence":1},{"source_type":"trust_center","source_name":"Tolmo trust centre (Vanta)","url":"https://trust.tolmo.com/","fetched_at":"2026-09-18 23:15:05.182035+00","content_hash":"b8f8bba9b0ccd7f92f56b35e7bd7c596aa62059fb9033955861651b1591a3685","wayback_url":null,"quote":"SOC 2","confidence":1}]}],"brief":{"summary":"Under SOC 2, Tolmo states on its trust centre that it holds SOC 2, as of 28 Sep 2026. This is a vendor statement rather than a registry listing, and it does not include an issuance date or an expiration date, as of 28 Sep 2026. For the EU-US Data Privacy Framework, no public evidence found for Tolmo, as of 28 Sep 2026. For ISO 27001, no public evidence found for Tolmo, as of 28 Sep 2026. For HIPAA, no public evidence found for Tolmo, as of 28 Sep 2026.","bullets":["SOC 2: vendor states on its trust centre that it holds SOC 2, as of 28 Sep 2026.","SOC 2: no issuance or expiration date published; vendor statement only, not a registry listing.","EU-US Data Privacy Framework / ISO 27001 / HIPAA: no public evidence found, as of 28 Sep 2026."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-28 05:49:33.381228+00"},"legal_docs":[{"kind":"subprocessors","url":"https://trust.tolmo.com/","availability":"public","detail":"5 subprocessors listed on the trust centre","as_of":"2026-09-30"},{"kind":"privacy","url":"https://tolmo.com/privacy-policy","availability":"public","detail":null,"as_of":"2026-09-30"}],"documents":[],"statements":[],"security_profile":null,"regulations_url":"https://certreports.com/api/v1/vendors/tolmo/regulations/{regulation}","subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Cloud provider","location":null,"vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Cloudflare","domain":"cloudflare.com","purpose":"Cloud monitoring","location":null,"vendor_url":"https://certreports.com/vendors/cloudflare/security"},{"name":"Datadog","domain":"datadoghq.com","purpose":"Cloud monitoring","location":null,"vendor_url":"https://certreports.com/vendors/datadog/security"},{"name":"GitHub","domain":"github.com","purpose":"Version control","location":null,"vendor_url":"https://certreports.com/vendors/github/security"},{"name":"Vanta","domain":"vanta.com","purpose":"Security","location":null,"vendor_url":"https://certreports.com/vendors/vanta/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-03T18:40:32.078Z"}