Komodo Health Trust Center

generated: '2026-07-19'
method: searched
probe: true
source: https://trust.komodohealth.com/
description: >-
  Komodo Health's public trust center, verified 2026-07-19. Certifications below
  are the badges actually rendered for Komodo plus claims asserted in the trust
  center's own Q&A. An initial keyword probe of the page also matched ISO 27001,
  ISO 27017, ISO 27018, HIPAA, FedRAMP and HITRUST — those strings appear only
  inside the trust-center vendor's global badge catalog embedded in the page
  payload, NOT as Komodo attestations, and have been removed.
url: https://trust.komodohealth.com/
verified: '2026-07-19'

certifications:
- name: SOC 2 Type II
  badge: soc2-type-2
  rendered: true
- name: SOC 2 Type I
  badge: soc2-type-1
  rendered: true
- name: GDPR
  badge: gdpr
  rendered: true
- name: CCPA
  badge: ccpa
  rendered: true
- name: CISA Secure by Design Pledge
  badge: sbdp
  rendered: true
- name: EcoVadis
  rendered: false
  asserted_in: trust center Q&A
  detail: >-
    "Komodo Health submits to EcoVadis annually and has earned a Bronze Medal, a
    recognition awarded to the Top 35% of companies assessed by EcoVadis in the
    12 months prior to the medal issue date."
  url: https://recognition.ecovadis.com/ipUyeLnBaUaKFrzwCsvhdw
- name: CMS Qualified Entity (QE) Program
  rendered: false
  asserted_in: trust center Q&A
  since: '2017'
  detail: >-
    "Komodo Health has been certified under the CMS Qualified Entity (QE)
    Program since 2017. As a QE, Komodo Health is entrusted with claims data
    under Medicare Parts A, B, and D for use in evaluating the performance of
    healthcare providers in the U.S. health system."
  reports: https://www.komodohealth.com/qe-reports/
  provider_appeals: https://www.komodohealth.com/provider-correction-and-appeal-request/

not_claimed:
  note: >-
    Checked and NOT asserted by Komodo as of 2026-07-19 — present in the page
    only as vendor catalog boilerplate.
  frameworks: [ISO 27001, ISO 27017, ISO 27018, HIPAA, HITRUST, FedRAMP, PCI DSS]

security_practices:
- One or more annual third-party audit(s)
- Annual third-party penetration testing
- Has a formal mobile device management (MDM) program
- Has a disaster recovery plan
- Has cyber insurance
- Uses a centralized IAM solution (SSO) to manage employee access
- Has a status page

resources:
  documents_available: 38
  knowledge_base_faqs: 13
  privacy_policy: https://www.komodohealth.com/privacy-notice/
  subprocessors:
    count: 26
    url: https://www.komodohealth.com/sub-processor-notice/
  status_page: https://statuspage.komodohealth.com/
  help_center: https://komodohealthsupport.zendesk.com/hc/en-us

vulnerability_disclosure:
  published: false
  reverified: '2026-08-15'
  note: >-
    No security.txt, bug bounty program, or responsible-disclosure page is
    published by Komodo Health. Re-verified 2026-08-15 with direct evidence from
    Komodo's own trust center rather than absence alone: the Conveyor trust
    profile carries `"report_vulnerability_url": ""` (empty), and its
    `bug_bounty_resp_disclosure` trust indicator — "Do they have a bug bounty or
    responsible disclosure program?" — scores `unknown` with "We haven't
    collected data about this indicator yet." No security/, /responsible-
    disclosure or /vulnerability-disclosure page exists on www (all 404), no
    HackerOne/Bugcrowd/Intigriti program was found, and no security.txt is
    served by any Komodo-operated host.
  vendor_boilerplate_warning: >-
    status.komodohealth.com DOES serve a valid PGP-signed RFC 9116 security.txt
    at HTTP 200 — it is Atlassian's, shipped with the Statuspage product, and
    self-canonicalizes to https://www.atlassian.com/.well-known/security.txt.
    It must not be credited to Komodo. No VulnerabilityDisclosure or Security
    pointer is emitted for this provider.
  evidence:
    - {url: 'https://www.komodohealth.com/.well-known/security.txt', status: 404}
    - {url: 'https://www.komodohealth.com/security/', status: 404}
    - {url: 'https://www.komodohealth.com/responsible-disclosure/', status: 404}
    - {url: 'https://www.komodohealth.com/vulnerability-disclosure/', status: 404}
    - {url: 'https://auth.komodohealth.com/.well-known/security.txt', status: 404}
    - {url: 'https://api.komodohealth.com/.well-known/security.txt', status: 404}
    - {url: 'https://trust.komodohealth.com/', status: 200, finding: 'report_vulnerability_url is empty; bug_bounty_resp_disclosure indicator = unknown'}
  see_also: well-known/komodo-health-well-known.yml

evidence:
- source: https://trust.komodohealth.com/
  method: rendered protocol_badges extraction + Q&A answer text
  badges_found: [soc2-type-2, gdpr, sbdp, soc2-type-1, ccpa]