SendGrid Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Sendgrid

1. 1

   PRIORITY 1 — Request breach clarification within 30 days: Contact SendGrid/Twilio's security team to obtain a formal written statement on the April 2025 alleged credential breach. Ask specifically: Was a breach confirmed? What customer data was involved? What remediation was applied? Twilio's security disclosure page is at https://www.twilio.com/en-us/security.

2. 2

   PRIORITY 2 — Obtain and review the SOC 2 Type II report: Request the current SOC 2 Type II report and bridge letter from Twilio's compliance team. Submit the request via https://www.twilio.com/en-us/security — many enterprise accounts can access audit reports through a signed NDA. Ensure the report period covers at least the past 12 months.

   SOC 2 Overview (AICPA)
3. 3

   PRIORITY 3 — Execute a HIPAA Business Associate Agreement if applicable: If your use case involves sending or processing any protected health information (PHI), a signed BAA is legally required. Request this directly from your SendGrid/Twilio account representative before any PHI is transmitted through the platform.

   HIPAA Overview (HHS)HIPAA BAA Guidance
4. 4

   PRIORITY 4 — Manually review the subprocessor list: Navigate directly to https://sendgrid.com/subprocessors and document all listed subprocessors. Verify that any subprocessors in non-adequate jurisdictions (for GDPR purposes) are covered by appropriate transfer mechanisms such as Standard Contractual Clauses.

   GDPR Full TextGDPR Subprocessor Rules
5. 5

   PRIORITY 5 — Document vendor-attested certifications in your risk register: Record that SOC 2, PCI DSS, ISO 27018, and HIPAA certifications are claimed by the vendor at https://sendgrid.com/security but have not been independently verified. Mark these for re-verification annually or when the vendor's compliance posture changes.

   SOC 2 Overview (AICPA)PCI DSS StandardsHIPAA Overview (HHS)

• The primary real-time adverse media scan was unavailable during this investigation; the historical media archive search (Google News) was used as a supplementary source, but real-time media coverage within the current news cycle could not be fully assessed.
• Subprocessor data could not be automatically extracted from the vendor's published subprocessor page due to page format constraints; manual review of sendgrid.com is required to obtain a complete supply chain inventory.
• External cyber risk scoring was not available for this assessment; the infrastructure and threat intelligence findings in this report are based on open-source and blacklist data rather than a continuous monitoring score.
• ISO 27001 certification could not be independently verified via the IAF CertSearch public registry; absence from the registry does not definitively confirm absence of certification, as registry coverage is incomplete for some certificate bodies.
• The AI data usage policy scan located the Twilio privacy policy page but found no explicit statements regarding AI/ML training commitments, third-party AI providers, or data retention practices specific to AI features; organizations with AI-related data handling concerns should request a dedicated AI data use addendum from the vendor.