Executive Summary
AI-generated analysis for Coupa
Coupa (coupa.com) is an AI-native spend management SaaS platform assessed at Risk Tier 3 (Moderate Risk) with a 90% confidence score, reflecting a vendor with a substantial compliance posture offset by several transparency and configuration gaps that warrant attention before or during onboarding. Coupa presents a number of positive signals across governance, infrastructure, and compliance domains. The vendor maintains a named CISO (Ken Ricketts, in post since January 2019) and claims an extensive certification portfolio including SOC 2 Type II, SOC 1 Type II (SSAE 18), ISO 27001, ISO 27701, and PCI DSS Level 1. The domain is clean across all threat intelligence checks — no malware, phishing, blacklist listings, or sanctions matches were identified. Coupa operates on TLS 1.3 with AES-256 encryption at rest, enforces HSTS, supports OAuth 2.0/OIDC for API authentication (deprecating legacy API keys), and achieves a solid HTTP Observatory grade of B (75/100). The vendor publishes a subprocessor list (11 entries, zero sanctions flags), offers a GDPR-compliant DPA, and maintains redundant data centers with real-time replication. Independent penetration testing is conducted annually, supplemented by six manual engagements per year through Bugcrowd. Several concerns merit follow-up before this vendor is fully approved for medium data access:
Key Findings
- The TLS certificate for coupa.com expires in 36 days; while this may be managed by automated renewal, confirmation is warranted given the short window.
- SSH (port 22) is exposed on the public-facing IP, which represents a non-trivial attack surface for an enterprise SaaS vendor.
- Independent registry verification of ISO 27001 and PCI DSS Level 1 could not be confirmed through automated registry checks; these certifications are vendor-attested via questionnaire and public documentation and should be verified with current certificates.
- The AI data usage privacy policy does not explicitly state whether customer data is used for AI model training at the policy level, despite questionnaire evidence suggesting Coupa trains on anonymized community data with a stated commitment against training public models on customer data.
- A public trust center was not accessible at standard paths during this assessment, reducing independent verifiability of compliance claims.
- A historical social engineering incident (W-2 fraud, 2017) surfaced in the historical media scan; no current-window adverse media was found. Overall, Coupa is a well-established enterprise vendor with a credible compliance program and clean security posture across external signals. The Tier 3 rating reflects the combination of unverified certification claims, infrastructure exposure, and policy transparency gaps rather than active risk indicators. A conditional approval with targeted remediation requests is appropriate.
Independence Statement
All evidence underpinning this assessment was sourced independently from public registries, external threat intelligence feeds, DNS/TLS analysis, and automated media scanning without vendor participation or input.