generated: '2026-07-31'
method: searched
probe: true
source: https://www.anecdotes.ai/trust
summary: >-
  Anecdotes publishes a dedicated security contact and a security posture page, but not a formal
  vulnerability-disclosure policy, bug bounty program or RFC 9116 security.txt. Reporters are directed to
  email security@anecdotes.ai. The contact is also returned machine-readably by the public FedRAMP 20x
  endpoint, which is an unusually strong form of publication even without a written policy.
policy: []
policy_published: false
contact:
- security@anecdotes.ai
contact_pages:
- https://www.anecdotes.ai/trust
bug_bounty:
  program: none found
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
security_txt:
  present: false
  paths_probed:
  - {host: www.anecdotes.ai, path: /.well-known/security.txt, status: 404}
  - {host: api.anecdotes.ai, path: /.well-known/security.txt, status: 404}
  - {host: help.anecdotes.ai, path: /.well-known/security.txt, status: 404}
  - {host: platform.anecdotes.ai, path: /.well-known/security.txt, status: 404}
practices_published:
  penetration_testing: External-vendor penetration tests at least once every 12 months.
  encryption_at_rest: AES-256
  encryption_in_transit: TLS 1.2 and above
  breach_notification: >-
    Anecdotes states it would report data breaches in accordance with its legal obligations and maintains
    an incident response policy.
evidence:
- source: https://www.anecdotes.ai/trust
  kind: security-page
  detail: 'Report Security Issue: mailto:security@anecdotes.ai'
- source: https://api.anecdotes.ai/fedramp20x/v1/public/info?evidence_id=builder_2795822335733
  kind: public-api-response
  http_status: 200
  fetched: '2026-07-31'
  detail: '"Contact Information": "security@anecdotes.ai"'
gaps:
- No published vulnerability disclosure policy or safe-harbour statement.
- No /.well-known/security.txt (RFC 9116).
- No bug bounty or coordinated-disclosure program.