Formal
Security and trust center evidence
Take control of your data in real-time.
Summary
Formal has 3 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
Formal states on its trust centre, as of 18 Sep 2026, that it displays a HIPAA badge, though this evidence row notes that BAA availability has not yet been captured. Formal states on its trust centre, as of 18 Sep 2026, that it holds SOC 2, with no further detail on report type provided in this evidence. Formal also states on its trust centre, as of 18 Sep 2026, that it holds ISO/IEC 27001. No FedRAMP, PCI DSS or EU-US Data Privacy Framework evidence was found for Formal as of 18 Sep 2026, so no public evidence found for those frameworks. All three claims for Formal are vendor-asserted trust centre statements rather than registry-verified records, as of 18 Sep 2026.
- HIPAA: vendor displays a HIPAA badge on its trust centre (as of 18 Sep 2026); BAA availability not confirmed in this evidence
- SOC 2: vendor states on its trust centre that it holds SOC 2 (as of 18 Sep 2026); report type not specified
- ISO/IEC 27001: vendor states on its trust centre that it holds ISO/IEC 27001 (as of 18 Sep 2026)
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.
Among security vendors
0verified rows
Category median 1, across 172 indexed security vendors. Formal has no registry-verified row yet, like 42 percent of them; its evidence is vendor-stated or reported.
Compare with similar vendors
Pick your own comparisonCompliance grid
HIPAAVendor-statedVendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)
as of 2 Nov 202622 sources
SOC 2Vendor-statedVendor states SOC 2 on its trust centre
as of 2 Nov 202622 sources
ISO/IEC 27001Vendor-statedVendor states ISO/IEC 27001 on its trust centre
as of 2 Nov 202622 sources
Legal artefacts
No DPA, BAA or subprocessor list has been captured from a public page yet. Registry rows above do not depend on this. Check the vendor trust centre.
Subprocessors
No subprocessor list captured yet.
Security profile
- Pen test cadence
- report available
Displayed as a security profile from public statements, not as attestations, as of 2 Nov 2026.
Change history
- 18 Sep 2026First indexed by CertReports3 evidence rows across 3 frameworks entered the index.
Similar vendors with evidence
Related by product tags and the Security category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
RSA Security
Security
Outseer delivers all-cause fraud prevention using predictive AI, real-time behavioral biometrics, and global consortium data—detecting and
SEON Technologies
Security
SEON's fraud prevention platform unifies real-time detection and AML in one
Sardine
Security
The top agentic risk platform used by leading banks and merchants worldwide to stop fraud in real-time, prevent AI-driven attacks, automate
Contrast Security
Security
Secure AI-generated code with
Evidence against regulations
All regulations for FormalHow much of each regulation’s vendor requirements Formal’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read