Executive Summary
AI-generated analysis for Looker
Looker (looker.com), a business intelligence and data analytics platform owned by Google, presents a moderate risk profile (Tier 3) based on independent assessment across 24 data sources. The platform operates under Google's infrastructure and trust umbrella, which provides meaningful baseline assurance, but several transparency gaps warrant attention before expanding data access. Looker demonstrates a number of meaningful positive signals:
Key Findings
- The domain has been registered since 1997 (~28 years), indicating a long-established and stable online presence managed via enterprise-grade registrar MarkMonitor.
- The domain maintains a clean reputation with no blacklist listings, no malware or phishing flags across Malware detection service, URLhaus, SURBL, or Spamhaus DBL, and a near-zero IP abuse score.
- The HTTP security posture is strong — HTTP security scanner awarded looker.com an A+ grade (115/100), reflecting well-configured security headers on the primary application domain.
- Infrastructure exposure is minimal: only 2 open ports (80 and 443) detected with zero known CVEs — significantly below the SaaS industry average of 8–12 open ports, representing a tightly controlled network footprint.
- No adverse media, sanctions matches, or enforcement actions were identified across all screening sources.
- Looker's privacy page references GDPR and CCPA compliance frameworks, and the trust center references a HIPAA Business Associate Addendum (inherited via Google Cloud Platform), all vendor-attested. Several gaps reduce confidence and drive the Tier 3 classification:
- No SOC 2 Type II report claim was identified on any accessible trust page or third-party platform, which is a notable transparency gap for a vendor with medium data access.
- ISO 27001 certification was not found in the IAF CertSearch registry, and no independent certification evidence was confirmed.
- The vendor's subprocessor list page (https://looker.com/subprocessors) could not be parsed by automated tooling, leaving third-party data sharing obligations unverified.
- No publicly accessible AI data usage policy was found, creating uncertainty about how customer data interacts with any AI or machine learning features Looker may offer.
- The TLS certificate for the primary domain expires in 54 days, warranting confirmation that automated renewal is in place. Overall, Looker is a well-established Google-owned platform with strong infrastructure hygiene and a clean security reputation. The Tier 3 classification reflects transparency gaps — particularly around SOC 2, AI data handling, and subprocessor visibility — rather than active security concerns. A conditional approval is appropriate, contingent on resolution of the items identified below.
Independence Statement
All evidence used in this assessment was independently sourced from external data providers, public registries, and open-source intelligence — Looker had no participation in, knowledge of, or ability to influence this investigation.