Products assessed
A product is graded only on evidence scoped to that product. Where a dimension rests on company-level evidence the report card marks it as such, so it reads as context rather than established product assurance - which is why a product can score below its parent company.
Certifications
What the vendor claims, and how far each claim has been independently corroborated. A claim is only ever as strong as the rung it reaches.
RSP describes an ISO 27001-ALIGNED programme; the certification itself is registry-verifiable.
- ✓ Vendor claimed
- ✓ Evidence cited
- ✓ Registry corroborated
- ✓ Scope verified
- ✓ Current
Verified on the registry · ISO/IEC 27001:2022 certificate held by TrustyCyber (supplied by Anthropic) · checked Aug 24, 2026
Valid until Jan 6, 2028
- ✓ Vendor claimed
- ✓ Evidence cited
- ✓ Registry corroborated
- ✓ Scope verified
- ✓ Current
Verified on the registry · ISO/IEC 42001:2023 certificate held by TrustyCyber (supplied by Anthropic) · checked Aug 24, 2026
Valid until Jan 5, 2028
SOC 3 Type 2 (the general-use report of the SOC 2 Type 2 examination): Anthropic's AI Services system, trust services criteria security, availability, confidentiality and privacy; period 1 Oct 2024 - 30 Sep 2025; unqualified opinion signed 12 Nov 2025. Cloud-hosting subservice organisations carved out. Vault: Gated/Anthropic/2025-11_anthropic-ai-services-soc3-type2.pdf.
- ✓ Vendor claimed
- ✓ Evidence cited
- ✓ Registry corroborated
- ✓ Scope verified
- — Current
Verified on the registry · SOC 2 Type 2 report held by TrustyCyber (supplied by Anthropic) · checked Aug 24, 2026
- ✓ Vendor claimed
- ✓ Evidence cited
- ✓ Registry corroborated
- ✓ Scope verified
- — Current
Verified on the registry · CSA STAR Registry · checked Aug 28, 2026
Supply chain
Third parties this vendor’s AI depends on, as disclosed in its own public material. Responsibility transfers; accountability doesn’t.
How to read this
This assessment is automated and point-in-time, built only from evidence the vendor publishes publicly plus checks against official certification registries. It is not an audit, not a certification, and not an endorsement. A low score means public evidence was thin or uncorroborated - which is a finding about disclosure, not proof of a weak control environment. This record reflects the evidence available on Aug 28, 2026.