Russian technology company operating the YandexGPT family of large language models. Russia's largest search engine and internet services provider, offering AI across search, assistant, cloud, and consumer products.
| SOC 2 Type II | No / not disclosed |
| ISO 27001 | Yes |
| ISO 42001 (AI management system) | No / not disclosed |
| FedRAMP authorized | No / not disclosed |
| GDPR compliant | No / not disclosed |
| CCPA compliant | No / not disclosed |
| HIPAA compliant | No / not disclosed |
| NIST AI RMF aligned | No / not disclosed |
| CSA STAR certified | No / not disclosed |
| EU AI Act classification | not_applicable |
| Trains on user data | yes |
| Outputs feed model improvement | yes |
| Data retention period | Per Russian Federation data retention laws |
| Can delete user data on request | Yes (SLA 30 days) |
| Default data residency | RU |
| Encryption at rest | Yes (AES-256) |
| Encryption in transit | Yes |
| DPA available | No / not disclosed |
| Public subprocessor list | No / not disclosed |
| HIPAA BAA available | No / not disclosed |
| User owns outputs | yes_with_caveats |
| Vendor claims output rights | No / not disclosed |
| Input IP protection | limited |
| Indemnification offered | No / not disclosed |
| Copyright shield program | No / not disclosed |
| Commercial use permitted | Yes |
| Training data provenance | not_disclosed |
| Known IP lawsuits | No / not disclosed |
| Incorporation country | Russia |
| Incorporation jurisdiction risk | critical |
| Subject to US jurisdiction | No / not disclosed |
| Subject to EU jurisdiction | No / not disclosed |
| Subject to China jurisdiction | No / not disclosed |
| Subject to Russia jurisdiction | Yes |
| Government data access risk | critical |
| Five Eyes aligned | No / not disclosed |
| Adequate privacy jurisdiction | No / not disclosed |
| Publishes model cards | No / not disclosed |
| Publishes transparency reports | No / not disclosed |
| Has AI ethics board | No / not disclosed |
| Safety testing disclosed | No / not disclosed |
| Red-teaming program | No / not disclosed |
| Government contracts | Yes |
| Terms of service | https://yandex.com/legal/termsofservice/ |
| Privacy policy | https://yandex.com/legal/confidential/ |
| Date | Severity | Incident |
|---|---|---|
| 2024-02-01 | critical | Forced restructuring under Russian government pressure [source] |
TrustAtlas dimensions that materially address each OWASP risk. Use to translate this vendor's compliance posture and data-handling stance into the application-security vocabulary your security team already uses.
| LLM01 |
User-supplied prompts manipulate model behaviour to bypass intended controls.
SecurityTransparencyDependency chain
|
| LLM02 |
Models leak PII, PHI, secrets, or proprietary data through outputs.
Data handlingIP exposureJurisdiction
|
| LLM03 |
Risk propagates from upstream models, datasets, plug-ins, and vendors.
Dependency chainBusiness stabilitySecurity
|
| LLM04 |
Adversarial training data or fine-tuning input degrades model integrity.
Data handlingTransparencySecurity
|
| LLM05 |
Downstream systems blindly trust model output, enabling injection downstream.
IP exposureTransparency
|
| LLM06 |
Agents granted overbroad tool, identity, or permission scopes cause harm.
Dependency chainTransparencyJurisdiction
|
| LLM07 |
System prompts containing secrets or logic are extracted via crafted input.
Data handlingTransparency
|
| LLM08 |
Vector stores and RAG pipelines leak or contaminate retrieved context.
Data handlingSecurity
|
| LLM09 |
Hallucinated, biased, or fabricated outputs treated as authoritative.
TransparencyRegulatory complianceBusiness stability
|
| LLM10 |
Cost, denial-of-service, and resource-exhaustion attacks against LLM endpoints.
SecurityBusiness stability
|
Full framework reference: https://trustatlas.pages.dev/framework/owasp-llm-top-10
How each NIST AI RMF function is supported by the dimensions TrustAtlas scores.
| GOVERN |
Establish AI governance structure: policies, roles, accountability.
Regulatory complianceJurisdictionTransparencyBusiness stability
|
| MAP |
Establish AI context: intended purpose, use cases, capabilities, and risks.
TransparencyDependency chainData handlingIP exposure
|
| MEASURE |
Quantitative + qualitative risk assessment: testing, benchmarks, monitoring.
SecurityData handlingTransparency
|
| MANAGE |
Treat identified risks: mitigation, controls, incident response, lifecycle.
Regulatory complianceSecurityDependency chainBusiness stability
|
Full framework reference: https://trustatlas.pages.dev/framework/nist-ai-rmf
Vendor-agnostic baseline. Send these to the vendor and require written answers before contract.
Composite scores use the default-balanced weight profile (25% data handling, 20% IP exposure, 15% jurisdiction, 15% security, 10% regulatory compliance, 8% transparency, 5% business stability, 2% dependency chain). All facts are sourced from the vendor's own public disclosures, public regulatory filings, or reputable secondary reporting — see the cited sources table above. This pack is decision-support material, not legal advice or audit evidence.