Vendor Risk Memo: example.com

Generated 2026-08-11 · Documentation/Placeholder Domain · Decision support only, not a certification.

INSUFFICIENT DATA Score 20/100 1/20 controls verified

Your call:

Collection was partial - bot protection or thin public docs limited verification. Obtain vendor documentation and upload below.

Download PDF Download XLSX Forward to boss Assess another

Executive summary

Example.com is a placeholder domain intended for documentation purposes and lacks any operational security controls or business infrastructure. The top strength is the presence of basic email authentication records (SPF/DMARC), while the top gap is the complete absence of security headers and organizational security documentation.

Key findings

[HIGH] Placeholder Domain Status

The domain is explicitly designated for documentation examples, indicating it is not a functional business entity or service provider.

[MEDIUM] Missing Security Headers

The site lacks critical browser security headers (HSTS, CSP, X-Frame-Options), increasing susceptibility to XSS and clickjacking if used in a production context.

[HIGH] Lack of Security Documentation

No evidence of SOC 2, ISO 27001, or data protection policies exists, preventing any formal risk validation.

Risk by domain

Compliance

0/100

6 gaps

Data Security

22/100

4 gaps

Operational

0/100

2 gaps

Contract recommendations

Do not enter into a contract; this entity is not a service provider.
If this is a placeholder for a different vendor, request the actual vendor's legal entity name and security documentation.

What to request from example.com

19 unverified controls, prioritized by risk impact:

1. SOC 2 Type II report

Independent verification of security controls over time.

2. Encryption architecture summary

Data-at-rest protection is not publicly documented.

3. Access control / SSO documentation

Access control verification for enterprise onboarding.

4. AI/ML data use policy or DPA with AI clause

AI training on customer data is a top concern in 2026 vendor reviews.

5. ISO 27001 certificate

International security standard verification.

6. MFA policy

Internal access security.

7. Data retention and deletion policy

Data lifecycle compliance.

8. Subprocessor list

Fourth-party risk visibility.

Copy-paste email

Hi,

We are completing a security review of example.com as part of our vendor onboarding process.
To proceed, we need the following documentation:

1. SOC 2 Type II report
   Please provide your most recent SOC 2 Type II report, including the bridge letter if the audit period ended more than 3 months ago.

2. Encryption architecture summary
   Please confirm encryption at rest (algorithm, key management, e.g. AES-256, KMS/HSM).

3. Access control / SSO documentation
   Please describe your RBAC model and confirm SSO/SAML support for enterprise accounts.

4. AI/ML data use policy or DPA with AI clause
   Please confirm in writing whether customer data is used to train AI/ML models, and if so, whether an opt-out mechanism exists.

5. ISO 27001 certificate
   Please provide your current ISO 27001 certificate and the Statement of Applicability.

6. MFA policy
   Please confirm MFA is enforced for all employee access to production systems.

7. Data retention and deletion policy
   Please provide your data retention schedule and confirm deletion timelines after contract termination.

8. Subprocessor list
   Please provide your current list of subprocessors and commit to 30-day advance notice of changes.

You can also respond directly and upload documents here: https://riskmemo.airiskmanagement.ca/claim/04b40177669b4597a666f7ee6350a01b

Thanks,
Security Team

Got their docs?

Upload SOC 2 / security whitepaper / DPA. Report updates in place - same link. Must look like security evidence.

Detailed control assessment

Control	Answer	Citation	Conf
SOC 2 Type II report	UNKNOWN		0.0
Data encrypted at rest	UNKNOWN		0.0
Data encrypted in transit (TLS)	YES	TLS handshake succeeded, cert expires Oct 27 22:17:21 2026 GMT	0.95
Access controls / RBAC / SSO	UNKNOWN		0.0
Trains AI models on customer data	UNKNOWN		0.0
ISO 27001 certification	UNKNOWN		0.0
MFA enforced internally	UNKNOWN		0.0
Data retention/deletion policy	UNKNOWN		0.0
Subprocessors disclosed	UNKNOWN		0.0
Incident response / breach notification	UNKNOWN		0.0
Penetration testing performed	UNKNOWN		0.0
Data Processing Agreement available	UNKNOWN		0.0
GDPR compliance stated	UNKNOWN		0.0
Vulnerability disclosure / bug bounty	UNKNOWN		0.0
Audit logging	UNKNOWN		0.0
Uptime SLA published	UNKNOWN		0.0
Employee background checks	UNKNOWN		0.0
Backups / disaster recovery	UNKNOWN		0.0
Vendor's own third-party risk program	UNKNOWN		0.0
Data residency / region hosting	UNKNOWN		0.0

Are you example.com?

Claim this profile, upload evidence, get a Verified badge.

Open vendor portal Get badge