Relevance AI
relevanceai.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- No independent assurance or customer breach-notification commitment evidenced
- No clear commitment that your data will not train their models
- Data retention window not stated
+1 more
See Before you sign, with what to ask for ↓
Scanned Oct 21, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance, governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: Across the privacy notice, Data Security Policy, documentation, changelog and blog, no SOC 2, ISO/IEC 27001, ISO/IEC 42001, independent penetration test or other third-party attestation is referenced. The Data Security Policy's only testing clause prohibits subscribers from penetration testing; its incident language is an internal obligation for employees to report incidents to management, with no customer notification commitment or timeframe. independent_assurance is assessed not_evidenced (not not_applicable) because a hosted SaaS vendor can obtain and publish such evidence and comparable vendors do.
What to ask for: Please provide current SOC 2 Type II or ISO/IEC 27001 reports (and ISO/IEC 42001 if held), the most recent independent penetration test summary, and the contractual security-incident notification window that applies to our subscription.
“4.3 Unless otherwise agreed by Relevance AI in writing, Subscriber are prohibited from performing their own penetration testing on any system of Relevance AI.”
“(b) an obligation to report any known security incidents to the company’s management for investigation and action.”
“4.2 Relevance AI will create a disaster recovery plan designed to provide appropriate technical and operational controls to deliver the recovery time objective (RTO) and recovery point objective (RPO), as outlined in its Service Level Policy.”
“1.2 Defined terms provided under clause 1 of the Relevance AI SaaS Terms and Conditions shall apply to this policy.”
Why it matters: The public sources scanned do not clearly state that customer prompts, files, and outputs are excluded from training or fine-tuning of first- or third-party models.
What to ask for: Get a no-training clause covering first- and third-party models into the DPA/order form.
“To better understand how Relevance AI users access and use the Services, and for other research and analytical purposes, such as to evaluate and improve the Site, our Services and business operations, including to develop our Services and its features, and for internal quality control and training purposes.”
Why it matters: The public sources scanned do not give a retention period for customer data or prompts/outputs.
What to ask for: Get retention windows, in days, in writing.
“We retain personal information for as long as necessary to provide you with our Services or for marketing purposes. In some cases, we retain personal information for longer, if doing so is necessary to comply with our legal obligations, to defend a legal claim or is otherwise required by applicable law, rule or regulation.”
Why it matters: No SOC 2 Type II, ISO/IEC 42001, or registry-verified certification covering the AI product was found in the public sources scanned.
What to ask for: Request a SOC 2 Type II or ISO/IEC 42001 report and confirm its scope covers the AI product.
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
The Privacy Notice permits personal information to be used to evaluate and improve the Services, develop new features, and for 'internal quality control and training purposes'; it does not state whether customer prompts, outputs or Subscriber Data are used to train or fine-tune AI models, in either direction.
Requires written confirmation, see Before you sign ↓
“To better understand how Relevance AI users access and use the Services, and for other research and analytical purposes, such as to evaluate and improve the Site, our Services and business operations, including to develop our Services and its features, and for internal quality control and training purposes.”
!How long do they keep your data?Ask the vendor
Personal information is retained 'for as long as necessary' to provide the Services or for marketing, longer where legally required, under an internal retention policy; no retention window is published.
Requires written confirmation, see Before you sign ↓
“We retain personal information for as long as necessary to provide you with our Services or for marketing purposes. In some cases, we retain personal information for longer, if doing so is necessary to comply with our legal obligations, to defend a legal claim or is otherwise required by applicable law, rule or regulation.”
!Who else can access your data?Ask the vendor
Customers can run Anthropic models through their own AWS Bedrock account (BYO), with AWS Bedrock Guardrails applied before or after LLM calls; this keeps model inference inside the customer's cloud account rather than Relevance AI's provider contracts.
Confirm in writing: Ask the vendor to state this in writing before signing.
“AWS Bedrock Guardrails integration gives customers using their own Bedrock account organization-wide content filtering capabilities for Anthropic models without custom workforces. Apply guardrails before or after LLM calls to filter harmful content, detect prompt injections, and protect sensitive information—all with minimal performance impact.”
“3.1 Relevance AI engages a cloud infrastructure provider ( IaaS Provider ) to host data in data centre facilities.”
“This data is only used to provide the functionality of the app and is not sold or shared with third parties. Any data that is not essential to app functionality is discarded and not stored.”
“5.1 The Platform may allow third party services interoperating with it to access, use, or otherwise process and transmit Subscriber Data. 5.2 This Data Security Policy does not apply to any processing, storage, or transmission of data outside the Platform.”
!Where is your data processed?Ask the vendor
The Data Security Policy commits only that the IaaS provider will notify Relevance AI of data centre locations, which 'may be located in various global regions'; no customer-selectable region or residency commitment is stated.
Confirm in writing: Ask the vendor to state this in writing before signing.
“(d) Notify Relevance AI of the location of the data centres facilities (which may be located in various global regions);”
“We may disclose your personal information to recipients which are located outside of the jurisdiction in which you reside, including to our operations and sub-processors in the United Kingdom, the European Economic Area, the United States and Australia. Whenever we offshore your personal information, we will take reasonable steps to ensure that the overseas recipient does not breach applicable privacy laws.”
!What happens in a security incident?Ask the vendor
Employees are obliged to report known security incidents to management for investigation; the policy states no customer breach-notification commitment or timeframe.
Confirm in writing: Ask the vendor to state this in writing before signing.
“(b) an obligation to report any known security incidents to the company’s management for investigation and action.”
Email to send the vendor9 items to confirm in writing
Hello Relevance AI team, We are assessing Relevance AI as part of our supplier review. Before we proceed, please confirm the following in writing: 1. Please address the following: No independent assurance or customer breach-notification commitment evidenced. 2. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 3. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 4. Please address the following: No independent assurance evidenced. 5. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 6. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 7. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 8. Which of Evals, Agent Performance Observability and Invent-generated tests are included on our plan, and what evaluation evidence can Relevance AI provide for agents we deploy if they are not? 9. Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓Strong agent lifecycle governance controlsStrong
Relevance AI documents a layered control set for agents in production: nothing goes live until a human publishes it, every publish is a restorable version, failing tests block a change, Invent is bounded by the user's own permissions with per-tool autonomy settings, admins can lock down public cloning/embedding at project level, MCP access runs under the user's own auth, tool calls can require human approval, and AI audit logs can be streamed to a customer-controlled OpenTelemetry destination.
These are the controls a buyer needs to keep autonomous agents inside an approved blast radius and to retain their own evidence trail. Note that audit-log export is limited to Enterprise customers with RBAC enabled.
Question for vendor: Is OpenTelemetry audit-log streaming, and RBAC generally, available on our plan, and what is the default retention of execution traces inside Relevance AI if we do not stream them out?
“Project-Level Public Agent Controls give admins the power to disable public cloning and embeddability across their entire workspace with a single setting. When you disable these features at the project level, they’re automatically turned off for all agents, workforces, and tools—and individual users can’t re-enable them.”
“You can now stream AI audit logs and execution traces in industry-standard OpenTelemetry format to a customer-controlled destination.”
“Permissions. Invent can only do what you’re already allowed to do. Admins turn it on project by project, and set how much autonomy it gets, tool by tool.”
“Requests run with the user’s own auth, so a Member only sees and operates on Agents they already have access to.”
“You can now approve or reject agent tool requests without leaving Slack, streamlining your workflow and keeping your agents running smoothly!”
“Drafts. Nothing goes live until a person publishes it. Versions. Every publish gets a plain-language description of what changed and why. Rolling back takes about thirty seconds.”
✓Testing and production evaluation exist but are Enterprise-onlyStrong
Evals (test suites, generated scenarios, LLM judges) and Agent Performance Observability (continuous LLM-judge monitoring with sampling) are mature testing features, and Invent now writes tests by default. However both features are stated to be available exclusively to select Enterprise customers and not on non-Enterprise plans, and the vendor itself discloses that under 1% of builders adopted testing before Invent.
A Pro or Team buyer should not assume the testing story in the Invent announcement applies to them; agents built on those plans may run without any evaluation harness unless the customer builds one.
Question for vendor: Which of Evals, Agent Performance Observability and Invent-generated tests are included on our plan, and what evaluation evidence can Relevance AI provide for agents we deploy if they are not?
“Available exclusively for select Enterprise customers , Evals delivers the advanced testing capabilities needed for mission-critical AI deployments. To access Evals, enterprise users can go to their agent’s dashboard and select the “Monitor” tab, then navigate to the “Test Suites” section. If you’re on an Enterprise plan and don’t yet have access, contact your Relevance AI sales representative to register interest. This feature is not available on non-Enterprise plans.”
“Automatic evaluation – Set up LLM judges to continuously assess your agents on custom criteria like summary quality, hallucination detection, and workflow execution”
“We tried for a long time to get builders to adopt testing on their own. Under 1% did. Invent made it the default.”
✗No independent assurance or customer breach-notification commitment evidencedGap
Across the privacy notice, Data Security Policy, documentation, changelog and blog, no SOC 2, ISO/IEC 27001, ISO/IEC 42001, independent penetration test or other third-party attestation is referenced. The Data Security Policy's only testing clause prohibits subscribers from penetration testing; its incident language is an internal obligation for employees to report incidents to management, with no customer notification commitment or timeframe. independent_assurance is assessed not_evidenced (not not_applicable) because a hosted SaaS vendor can obtain and publish such evidence and comparable vendors do.
Without third-party attestation, every security statement in the Data Security Policy rests on the vendor's own word, and without a notification clause the buyer has no contractual trigger for incident response on its side.
Question for vendor: Please provide current SOC 2 Type II or ISO/IEC 27001 reports (and ISO/IEC 42001 if held), the most recent independent penetration test summary, and the contractual security-incident notification window that applies to our subscription.
“4.3 Unless otherwise agreed by Relevance AI in writing, Subscriber are prohibited from performing their own penetration testing on any system of Relevance AI.”
“(b) an obligation to report any known security incidents to the company’s management for investigation and action.”
“4.2 Relevance AI will create a disaster recovery plan designed to provide appropriate technical and operational controls to deliver the recovery time objective (RTO) and recovery point objective (RPO), as outlined in its Service Level Policy.”
“1.2 Defined terms provided under clause 1 of the Relevance AI SaaS Terms and Conditions shall apply to this policy.”
!Customer data use, retention and location need written confirmationGap
The Privacy Notice permits personal information to be used to improve and develop the Services and for 'training purposes', while also stating Relevance AI acts as a service provider for Customer-directed processing; no document states whether prompts, agent outputs, Knowledge-table content or Subscriber Data are used to train or fine-tune models, in either direction. Retention is criteria-based with no published window. Hosting is with an unnamed IaaS provider whose data centres 'may be located in various global regions', and sub-processors are placed in the UK, EEA, US and Australia with no residency option stated. The Slack app is the one component with an explicit no-sharing, discard-non-essential statement.
Agents built on this platform ingest customer documents (Drive, SharePoint, Notion, Confluence) and CRM data; the buyer cannot currently tell from public material whether that content trains models, how long it persists, or which jurisdiction it sits in.
Question for vendor: Confirm in writing: (1) that Subscriber Data, prompts, outputs and Knowledge content are not used to train or fine-tune any model (Relevance AI's or a provider's); (2) the retention and deletion window for task data and logs; (3) the hosting provider and region(s) for our tenant and whether a region can be selected.
“To better understand how Relevance AI users access and use the Services, and for other research and analytical purposes, such as to evaluate and improve the Site, our Services and business operations, including to develop our Services and its features, and for internal quality control and training purposes.”
“When Customers purchase and use our Services, we may process your personal information at their direction and on their behalf, as a service provider, and your use of the Services is administered by that company, our Customer.”
“We retain personal information for as long as necessary to provide you with our Services or for marketing purposes. In some cases, we retain personal information for longer, if doing so is necessary to comply with our legal obligations, to defend a legal claim or is otherwise required by applicable law, rule or regulation.”
“3.1 Relevance AI engages a cloud infrastructure provider ( IaaS Provider ) to host data in data centre facilities.”
“(d) Notify Relevance AI of the location of the data centres facilities (which may be located in various global regions);”
“We may disclose your personal information to recipients which are located outside of the jurisdiction in which you reside, including to our operations and sub-processors in the United Kingdom, the European Economic Area, the United States and Australia. Whenever we offshore your personal information, we will take reasonable steps to ensure that the overseas recipient does not breach applicable privacy laws.”
“This data is only used to provide the functionality of the app and is not sold or shared with third parties. Any data that is not essential to app functionality is discarded and not stored.”
“Add knowledge — connect your data so agents respond with accuracy. Upload files, sync from Google Drive, SharePoint, Notion, or pull from websites.”
!Multiple third-party model providers with undisclosed data termsGap
The changelog names Google (Gemini 3.5 Flash), Anthropic (Claude Opus 4.6) and OpenAI (GPT Image 1.5) as selectable models and Exa as the people-search index behind Chat, and offers a bring-your-own Anthropic-via-AWS-Bedrock path that keeps inference in the customer's own account. No document states the default model, which provider contracts carry zero-retention/no-training terms, or publishes a named subprocessor list; the Data Security Policy also carves third-party services that interoperate with the Platform out of its scope.
Each selectable model is a different data recipient with its own retention and training terms; the buyer's agents may route data to any of them depending on configuration, so provider terms are part of the buyer's own supply chain.
Question for vendor: Provide the current subprocessor and model-provider list with the data-use terms (retention, training) under each provider agreement, and confirm which model is the default when a customer does not choose one.
“Google’s Gemini 3.5 Flash is now available in production for all users, selectable anywhere you configure a language model.”
“You can now access Anthropic’s flagship Claude Opus 4.6 model directly in the platform, with an optional 1M context window variant for handling massive documents!”
“The powerful GPT Image 1.5 model is now available in the “Text to image generation” step, giving you access to OpenAI’s latest image generation capabilities.”
“AWS Bedrock Guardrails integration gives customers using their own Bedrock account organization-wide content filtering capabilities for Anthropic models without custom workforces. Apply guardrails before or after LLM calls to filter harmful content, detect prompt injections, and protect sensitive information—all with minimal performance impact.”
“Chat now includes an integrated people search powered by Exa’s index, making recruitment and networking effortless.”
“5.1 The Platform may allow third party services interoperating with it to access, use, or otherwise process and transmit Subscriber Data. 5.2 This Data Security Policy does not apply to any processing, storage, or transmission of data outside the Platform.”
“We use third party tools, such as Google Analytics, which are operated by third party companies. These third-party analytics companies may use cookies, pixels, and other similar tools to collect usage data about our Services in order to provide us with reports and metrics that help us evaluate usage of our Services and improve performance and user experiences.”
“For YouTube scraping: Please note that in order to use the YouTube tool, you'll need to sign up at supadata.ai for a free API key (100 requests/month). The agent will guide you through adding this API key to your agent.”
?Technical dependency observed: MicrosoftObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Google’s Gemini 3.5 Flash is now available in production for all users, selectable anywhere you configure a language model.”
“You can now access Anthropic’s flagship Claude Opus 4.6 model directly in the platform, with an optional 1M context window variant for handling massive documents!”
“The powerful GPT Image 1.5 model is now available in the “Text to image generation” step, giving you access to OpenAI’s latest image generation capabilities.”
“AWS Bedrock Guardrails integration gives customers using their own Bedrock account organization-wide content filtering capabilities for Anthropic models without custom workforces. Apply guardrails before or after LLM calls to filter harmful content, detect prompt injections, and protect sensitive information—all with minimal performance impact.”
“Chat now includes an integrated people search powered by Exa’s index, making recruitment and networking effortless.”
“3.1 Relevance AI engages a cloud infrastructure provider ( IaaS Provider ) to host data in data centre facilities.”
“5.1 The Platform may allow third party services interoperating with it to access, use, or otherwise process and transmit Subscriber Data. 5.2 This Data Security Policy does not apply to any processing, storage, or transmission of data outside the Platform.”
“We use third party tools, such as Google Analytics, which are operated by third party companies. These third-party analytics companies may use cookies, pixels, and other similar tools to collect usage data about our Services in order to provide us with reports and metrics that help us evaluate usage of our Services and improve performance and user experiences.”
“For YouTube scraping: Please note that in order to use the YouTube tool, you'll need to sign up at supadata.ai for a free API key (100 requests/month). The agent will guide you through adding this API key to your agent.”
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the score60
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“Project-Level Public Agent Controls give admins the power to disable public cloning and embeddability across their entire workspace with a single setting. When you disable these features at the project level, they’re automatically turned off for all agents, workforces, and tools—and individual users can’t re-enable them.”
“You can now stream AI audit logs and execution traces in industry-standard OpenTelemetry format to a customer-controlled destination.”
“Permissions. Invent can only do what you’re already allowed to do. Admins turn it on project by project, and set how much autonomy it gets, tool by tool.”
“Requests run with the user’s own auth, so a Member only sees and operates on Agents they already have access to.”
“You can now approve or reject agent tool requests without leaving Slack, streamlining your workflow and keeping your agents running smoothly!”
Governance & accountability: vendor-evidenced, not yet independently corroborated.
AI system10% of the score60
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Relevance AI is a low/no-code platform where you can build AI agents and multi-agent teams that autonomously complete tasks, much like human employees.”
“Add knowledge — connect your data so agents respond with accuracy. Upload files, sync from Google Drive, SharePoint, Notion, or pull from websites.”
“Relevance AI today announced Invent 2.0, the latest version of our powerful, collaborative agent for designing, building, and managing AI agent workforces. Invent works like a solutions engineer, interviewing you, analyzing your documentation to map out processes and understand how to track value.”
“Yes! We dogfood our own AI Agent platform across all teams, including support. We’re AI-first and use AI Agents throughout our support process for answering customer questions, researching our platform, and drafting documentation.”
How AI features are evaluated before and after release, evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“Available exclusively for select Enterprise customers , Evals delivers the advanced testing capabilities needed for mission-critical AI deployments. To access Evals, enterprise users can go to their agent’s dashboard and select the “Monitor” tab, then navigate to the “Test Suites” section. If you’re on an Enterprise plan and don’t yet have access, contact your Relevance AI sales representative to register interest. This feature is not available on non-Enterprise plans.”
“Automatic evaluation – Set up LLM judges to continuously assess your agents on custom criteria like summary quality, hallucination detection, and workflow execution”
“We tried for a long time to get builders to adopt testing on their own. Under 1% did. Invent made it the default.”
How changes to models and AI features are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“Drafts. Nothing goes live until a person publishes it. Versions. Every publish gets a plain-language description of what changed and why. Rolling back takes about thirty seconds.”
“This policy may be updated from time to time, however, terms effective at the time of signing a Proposal will apply throughout the duration of the applicable Term.”
“If we make material changes to how we collect, use, or disclose the personal information we have previously collected about you, we will endeavor to provide you prior notice, such as by emailing you or posting prominent notice on our Site or within the Services.”
“All the latest updates and changes to the Relevance AI platform. September 3, 2026 Meet the new Invent”
AI system description: vendor-evidenced, not yet independently corroborated.
Testing & evaluation: vendor-evidenced, not yet independently corroborated.
Change management: vendor-evidenced, not yet independently corroborated.
Model10% of the score40
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“Google’s Gemini 3.5 Flash is now available in production for all users, selectable anywhere you configure a language model.”
“You can now access Anthropic’s flagship Claude Opus 4.6 model directly in the platform, with an optional 1M context window variant for handling massive documents!”
“The powerful GPT Image 1.5 model is now available in the “Text to image generation” step, giving you access to OpenAI’s latest image generation capabilities.”
“AWS Bedrock Guardrails integration gives customers using their own Bedrock account organization-wide content filtering capabilities for Anthropic models without custom workforces. Apply guardrails before or after LLM calls to filter harmful content, detect prompt injections, and protect sensitive information—all with minimal performance impact.”
Agent10% of the score0
No independently corroborated agent-specific assurance (AIUC-class or equivalent).
Customer data15% of the score40
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“(d) Notify Relevance AI of the location of the data centres facilities (which may be located in various global regions);”
“We may disclose your personal information to recipients which are located outside of the jurisdiction in which you reside, including to our operations and sub-processors in the United Kingdom, the European Economic Area, the United States and Australia. Whenever we offshore your personal information, we will take reasonable steps to ensure that the overseas recipient does not breach applicable privacy laws.”
“To better understand how Relevance AI users access and use the Services, and for other research and analytical purposes, such as to evaluate and improve the Site, our Services and business operations, including to develop our Services and its features, and for internal quality control and training purposes.”
“When Customers purchase and use our Services, we may process your personal information at their direction and on their behalf, as a service provider, and your use of the Services is administered by that company, our Customer.”
“We retain personal information for as long as necessary to provide you with our Services or for marketing purposes. In some cases, we retain personal information for longer, if doing so is necessary to comply with our legal obligations, to defend a legal claim or is otherwise required by applicable law, rule or regulation.”
“This data is only used to provide the functionality of the app and is not sold or shared with third parties. Any data that is not essential to app functionality is discarded and not stored.”
“2.2 Relevance AI employees do not have direct access to Subscriber Data, except where necessary on a need-to-know basis to undertake: (a) Technical support; (b) system management, maintenance, backups; and (c) other actions authorised by the Subscriber in writing.”
AI supply chain10% of the score40
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“Chat now includes an integrated people search powered by Exa’s index, making recruitment and networking effortless.”
“3.1 Relevance AI engages a cloud infrastructure provider ( IaaS Provider ) to host data in data centre facilities.”
“5.1 The Platform may allow third party services interoperating with it to access, use, or otherwise process and transmit Subscriber Data. 5.2 This Data Security Policy does not apply to any processing, storage, or transmission of data outside the Platform.”
“We use third party tools, such as Google Analytics, which are operated by third party companies. These third-party analytics companies may use cookies, pixels, and other similar tools to collect usage data about our Services in order to provide us with reports and metrics that help us evaluate usage of our Services and improve performance and user experiences.”
“For YouTube scraping: Please note that in order to use the YouTube tool, you'll need to sign up at supadata.ai for a free API key (100 requests/month). The agent will guide you through adding this API key to your agent.”
Security foundation10% of the score40
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“(b) an obligation to report any known security incidents to the company’s management for investigation and action.”
“4.2 Relevance AI will create a disaster recovery plan designed to provide appropriate technical and operational controls to deliver the recovery time objective (RTO) and recovery point objective (RPO), as outlined in its Service Level Policy.”
“Our engineering team is on-call 24/7, and we will respond to any outages that occur outside of our supported hours. You may not receive a response outside of our supported hours, but our engineering team will come online to address any alerts / outages and swiftly resolve them.”
Independent assurance evidence10% of the score0
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“4.3 Unless otherwise agreed by Relevance AI in writing, Subscriber are prohibited from performing their own penetration testing on any system of Relevance AI.”
Independent assurance: not publicly evidenced.
Legal & contractual10% of the score40
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“Legal Entity: OnSearch Pty Ltd T/A Relevance AI Website: https://relevanceai.com”
“1.2 Defined terms provided under clause 1 of the Relevance AI SaaS Terms and Conditions shall apply to this policy.”
“We offer the following first response times (FRT) SLAs, based on your subscription: Subscription SLA Enterprise 1 business day Team 2 business days Pro 3 business days”
“This Agreement shall be governed by and construed in accordance with the laws of New South Wales, Australia, without regard to its conflict of law provisions.”
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 46 → up to 67 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 1, registry checks and verification ladders, click to view
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
Sources 12, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
Want to go further?
This scan assesses Relevance AI at an organisational level. Assurance can vary significantly between products, models and agents, enter the product you’re evaluating to run a deeper AI System Assurance Scan.
Scan a specific product →This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.