SAP
- Rank
- Score
- 40/149
- 49 out of 100
SAP is a German multinational software company based in Walldorf, Baden-Württemberg, and the world's largest vendor of enterprise software. Founded in 1972 by five former IBM engineers, it adds AI features to its business applications and has released SAP-RPT-1, a model for predictions on business tables.
Is Joule safe?
Joule scores 49 out of 100 and ranks 40 of 149. Its strongest category is Security, and its weakest category is Transparency.
How is Joule scored?
Joule is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- No
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Did an outside organisation test the model before release?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026
Safety test results
Average used74.1This outside rating doesn't cover this company, so the average of the companies it covers is used.
Incident record
Not enough dataProtecting children
50Points for each confirmed yes.
- No
Does the model card report child-safety tests or safeguards?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim50/50“In general, SAP websites and online services are not directed to users below the age of 16 years, or equivalent minimum age in the relevant…” MoreLess
“In general, SAP websites and online services are not directed to users below the age of 16 years, or equivalent minimum age in the relevant jurisdiction.”
sap.com privacy policy (opens in a new tab) · 20 Oct 2026
Model documentation
50Points for each confirmed yes.
- Yes
Does the model card describe what the model can do?
Company claim25/25“With the aim to combine the best of both these worlds, we introduce sap-rpt-1-oss (formerly known under the name ConTextTab), integrating se…” MoreLess
“With the aim to combine the best of both these worlds, we introduce sap-rpt-1-oss (formerly known under the name ConTextTab), integrating semantic understanding and alignment into a table-native ICL framework.”
huggingface.co (opens in a new tab) · 20 Oct 2026 - Yes
Does the model card report test results?
Company claim25/25“By employing specialized embeddings for different data modalities and by training on large-scale real-world tabular data, our model is compe…” MoreLess
“By employing specialized embeddings for different data modalities and by training on large-scale real-world tabular data, our model is competitive with SOTA across a broad set of benchmarks while setting a new standard on the semantically rich CARTE benchmark.”
huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card state the model's limitations?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card describe safety safeguards?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026
Training-data disclosure
Average used29.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Independent transparency index
Average used40.7This outside rating doesn't cover this company, so the average of the companies it covers is used.
Transparency reports
Average used25This outside rating doesn't cover this company, so the average of the companies it covers is used.
Public safety commitments
0Average of the commitments signed.
- No
Has it signed the EU code of practice for general-purpose AI?
Company claim0/100European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
No problems found in 1 public record. That is not proof.
Security programme and certifications
67Points for each confirmed yes.
- Yes
Is there a way to report security flaws, such as a bug bounty?
Company claim34/34“Contact: https://www.sap.com/report-a-vulnerability”
sap.com security contact (opens in a new tab) · 20 Oct 2026 - No
Does it state it holds a SOC 2 Type II report?
Company claim0/33sap.com security page (opens in a new tab) · 22 Oct 2026 - Yes
Does it state it holds ISO 27001 certification?
Company claim33/33“We’re also certified according to ISO 27001, ISO 22301, and BS 10012.”
sap.com security page (opens in a new tab) · 22 Oct 2026
Software vulnerabilities
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. Known-exploited flaws (CISA list) in the company's official software, last 24 months. A disclosed and fixed flaw does not lower the score.
No events
Independent sourceGitHub Advisory Database (opens in a new tab) · 12 Nov 2026
Data breaches
Not enough dataNo problems found in 2 public records. That is not proof.
Clear privacy policy
80Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“For this purpose, we collect information from all interactions and engagements that you have with SAP's web services, regardless of whether…” MoreLess
“For this purpose, we collect information from all interactions and engagements that you have with SAP's web services, regardless of whether you register with a user profile or not.”
sap.com privacy policy (opens in a new tab) · 20 Oct 2026 - No
Does the privacy policy say whether your data is used to train AI?
Company claim0/20sap.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say how long data is kept?
Company claim20/20“SAP stores your personal data only for as long as it is required: to make products and services requested by you or your employer available…” MoreLess
“SAP stores your personal data only for as long as it is required: to make products and services requested by you or your employer available to you; to develop products or services until this is no longer necessary or SAP is informed that your relationship with the SAP customer has changed; to fulfill SAP’s legitimate business purposes as further described in this privacy statement, unless you object to SAP’s use of your personal data for these purposes; for SAP to comply with statutory obligations to retain personal data, resulting inter alia e.g., from applicable export, finance, tax or commercial laws; until you revoke a consent you previously granted to SAP to process your personal data.”
sap.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“Who are the recipients of your Personal Data? SAP Group: Members of the SAP Group may also receive or gain access to personal data either wh…” MoreLess
“Who are the recipients of your Personal Data? SAP Group: Members of the SAP Group may also receive or gain access to personal data either when rendering group internal services centrally and on behalf of SAP SE, when supporting others in the SAP Group or when personal data is transferred to them on a respective legal basis.”
sap.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“You have the right to request from SAP access to, correction of, and/or the return or the deletion of your personal data.”
sap.com privacy policy (opens in a new tab) · 20 Oct 2026
Training-data defaults
0100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- No
Is your data used for training only if you opt in?
Company claim0/100sap.com privacy policy (opens in a new tab) · 20 Oct 2026 - No
Can you stop your data being used for training?
Company claim0/50sap.com privacy policy (opens in a new tab) · 20 Oct 2026
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“You have the right to request from SAP access to, correction of, and/or the return or the deletion of your personal data.”
sap.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Can you delete your data?
Company claim50/50“You have the right to request from SAP access to, correction of, and/or the return or the deletion of your personal data.”
sap.com privacy policy (opens in a new tab) · 20 Oct 2026
Privacy fines
Not enough dataIndependent privacy ratings
Average used52.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. UK competition regulator cases, US Justice Department settlements, last 5 years, and regulator actions and open investigations into the company's AI products at half severity, last 3 years.
No events
RegulatorUK CMA cases (opens in a new tab) · 12 Nov 2026No events
RegulatorUS Justice Department (opens in a new tab) · 12 Nov 2026
Court judgments
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. Court rulings against the company on privacy, consumer or competition claims, upheld on appeal, last 5 years.
No events
Regulatorcourtlistener.com (opens in a new tab) · 10 Nov 2026
Privacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“Email: privacy@sap.com”
sap.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“When you believe that SAP was processing your personal data not in accordance with this privacy statement or under breach of applicable data…” MoreLess
“When you believe that SAP was processing your personal data not in accordance with this privacy statement or under breach of applicable data protection laws, you have the right to lodge a complaint with a relevant supervisory authority.”
sap.com privacy policy (opens in a new tab) · 20 Oct 2026
Score history
Newest first. Only days when the score changed are listed.
3 Nov 2026
Score 49
Method 3 Nov 2026
-2
2 Nov 2026
Score 51
Method 2 Nov 2026
+1
28 Oct 2026
Score 50
Method 28 Oct 2026, update 2
-5 · combines both 28 Oct updates (28 Oct 2026 - Update 1 and 28 Oct 2026 - Update 2)
23 Oct 2026
Score 55
Method 21 Oct 2026
+2
14 Oct 2026
Score 53
Method Not recorded
-