# Distill Security?

**URL:** <https://forums.distill.io/t/distill-security/5871>\
**Category:** Help and Support\
**Created:** [January 14, 2026, 4:26pm UTC](https://forums.distill.io/t/distill-security/5871 "2026-01-14T16:26:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jsup](https://forums.distill.io/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@jsup](https://forums.distill.io/u/jsup)\
**Post date:** [January 14, 2026, 4:26pm UTC](https://forums.distill.io/t/distill-security/5871/1 "2026-01-14T16:26:53Z")

</div>

Hello,

How often does Distill do 3rd party/OSS library scanning for license and security vulnerabilities? And are you open source?

Thank you!

---

<div class="post-metadata">

**Author:** ![ajitk](https://forums.distill.io/letter_avatar_proxy/v4/letter/a/ec9cab/32.png) [@ajitk](https://forums.distill.io/u/ajitk)\
**Post date:** [January 16, 2026, 6:23am UTC](https://forums.distill.io/t/distill-security/5871/2 "2026-01-16T06:23:47Z")

</div>

@jsup distill is closed source and not reviewed by a 3rd party. do you have any specific concerns or are you looking for certifications like soc?

---

<div class="post-metadata">

**Author:** ![jsup](https://forums.distill.io/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@jsup](https://forums.distill.io/u/jsup)\
**Post date:** [January 16, 2026, 5:03pm UTC](https://forums.distill.io/t/distill-security/5871/3 "2026-01-16T17:03:29Z")

</div>

@ajitk Thank you for getting back to me.

While I’d absolutely love something like a SOC2 cert report, I was just trying to see if you regularly scan for OSS vulns or have SLAs for remediating findings to get an idea of the security posture of this product. I have some team members interested in Distill so I am doing a light security review.

---

<div class="post-metadata">

**Author:** ![srijith](https://forums.distill.io/letter_avatar_proxy/v4/letter/s/c77e96/32.png) [@srijith](https://forums.distill.io/u/srijith)\
**Post date:** [January 19, 2026, 6:29am UTC](https://forums.distill.io/t/distill-security/5871/4 "2026-01-19T06:29:13Z")

</div>

@jsup Thanks for the clarification — that’s completely reasonable, and we appreciate you doing due diligence before rolling this out more broadly.

While Distill is a **closed-source product** and we don’t currently publish formal certifications like SOC 2, we do take dependency security seriously:

- We **regularly review and monitor third-party / OSS dependencies** as part of our development and release process.

- Dependency updates and security advisories are evaluated as they arise, and **known vulnerabilities are prioritized and remediated** based on severity and impact.

- We don’t publicly define or publish formal **SLAs for vulnerability remediation** , but addressing security issues in dependencies is an ongoing part of our engineering workflow.

That said, we understand that for some organizations, formal compliance reports or externally published security attestations are required. If your team needs more structured information (for example, to answer an internal security questionnaire), you’re welcome to reach out to us directly at **[support@distill.io](mailto:support@distill.io)**, and we can share what’s appropriate on a case-by-case basis.

Thanks again for the thoughtful questions — happy to clarify further if needed.