Okta

Missing Vulnerability Disclosure

Publish the disclosure path and safe-harbor terms together.

Missing Security Contact

Expose a clear public security contact or disclosure mailbox.

Missing Incident Response

State how incidents are detected, escalated, and communicated.

Missing Certifications

Only publish certification claims alongside a public attestation artifact.

Missing Incident Communication

Document how customers are notified and where public incident updates live.

Missing Status Page

Link the status page from the trust surface if it is part of the buyer review path.

Missing Privacy Policy

Clarify what personal data you collect, process, retain, and disclose.

Missing Data Breach Notice

Explain how breach notification works and who is notified.

Missing Data Processing Addendum

Make the DPA request path easy to find for customers and partners.

Missing Subprocessors List

Publish a current subprocessor or vendor list with update cadence.

Missing AI Usage Policy

Explain how AI is used, reviewed, and bounded in public-facing products.

Missing Responsible AI Principles

Publish a short principle set that maps to actual product controls.

Missing Model Provider Disclosure

State which model or provider services are used and where customer data may flow.

Missing Model Card or System Card

Publish a model or system card if the site makes substantial AI claims.

Missing AI Evaluation or Safety Report

Provide a public evaluation or safety summary when AI claims are central.

Missing Transparency Report

Publish a public transparency report when the product makes AI capability claims.

Trust center missing privacy policy

Link the privacy policy directly from the trust center and footer.

Missing Footer Cross-links

Add footer links that make trust artifacts easy to reach.

Missing Incident History

If incident history is public, link it clearly from the trust surface.

Missing Postmortems

Document post-incident learning when public postmortems exist.

Missing Attestation Summary

Summarize the attestation in public-safe language and link the source artifact.

Security page missing contact path

Expose a security contact, safe-harbor path, or security.txt reference.

Missing Cookie Policy

Publish cookie and tracking language with a clear consent path.

Missing Data Retention Policy

State how long data is kept and what triggers deletion or archival.