Perplexity Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Perplexity

1. 1

   Obtain Perplexity's SOC 2 Type II report and bridge letter — submit an access request through their trust portal at trust.perplexity.ai (look for the 'Request Access' button) or email their security team. Specify you need the most recent Type II report covering at least a 6-month audit period.

   SOC 2 Overview (AICPA)
2. 2

   Request a written legal status update on the court order to suspend Perplexity's AI shopping agent — contact their enterprise or legal team and ask for the current status, scope of affected features, and any remediation timeline. This is essential before enabling any agentic features.

3. 3

   Request Perplexity's complete GDPR subprocessor list directly from their privacy team — reference the blank page at trust.perplexity.ai/subprocessors and ask for the full list in writing, including subprocessor name, country of processing, and purpose. This is a contractual requirement under GDPR Article 28.

   GDPR Full TextGDPR Subprocessor Rules
4. 4

   Request the vendor's Data Protection Addendum (DPA) and AI-specific enterprise terms — ask their sales or legal team for documents covering model training commitments, third-party LLM providers, data retention periods, and enterprise opt-out mechanisms. Many enterprise AI vendors make this available on request.

   DPA Template (GDPR Art. 28)
5. 5

   Review the trust portal at trust.perplexity.ai periodically for updates to the subprocessor list and any newly published compliance documents — set a calendar reminder for 30 and 90 days to recheck.

   GDPR Subprocessor Rules
6. 6

   Document the FedRAMP 20x claim status — if your organization has government contractor or FedRAMP compliance requirements, contact Perplexity's federal sales team to clarify the current authorization level and expected timeline for full FedRAMP Low or Moderate authorization.

   FedRAMP Marketplace

• The primary adverse media scan source was unavailable during this investigation; the historical media search and Hacker News community data were used as supplementary sources, but recent adverse media coverage (last 12 months) may be incomplete.
• The adverse media search identified an article referencing a court order against Perplexity's Amazon shopping agent, but the full legal scope, jurisdiction, and current status of this order could not be confirmed from available archived sources alone.
• External cyber risk scoring was not available during this assessment; the infrastructure and domain reputation findings are based on direct scanning and blacklist checks rather than a composite risk score.
• The FedRAMP registry returned no match for Perplexity; the 'FedRAMP 20x' reference on the trust page may refer to a pilot program or pre-authorization phase that is not yet reflected in the public marketplace registry.
• Company firmographic data (headcount, company type, industry classification) was not available from the business intelligence source, limiting organizational context in the assessment.
• The Legal Entity Registry LEI match (PERPLEXITY AB, jurisdiction: SE) has a registration status of LAPSED and an entity disambiguation score of 85/100, suggesting this may be a related but distinct legal entity from the primary US-based operating company — the LEI record should not be treated as definitively representing Perplexity's principal operating entity.