I risked clicking through to the form and going partway through it. Unfortunately there is no way that anyone associated with R is going to fill out this form for you, and most of the questions are unanswerable (or not in a way that will be satisfactory to your IT security people) anyway: e.g.
> Please provide the URL of the vendor's security center with supporting > documentation for PCI, SOC2 type II or ISO27001 certification reports, > Information Security Policies, Procedures, Data Flow Diagram, most recent > Application Code Review or Penetration Testing Reports, etc , or email these > documents to [email protected] does this vendor have a security disclosure program, do they have a cyber-defense program, have they been audited ... etc.. It's possible that you could get a third-party vendor such as Posit to sell you a security-certified version of R (which would not be any different but would come with the relevant guarantees, audits, etc. from the third-party vendor). (Note that R is **not** a Posit product; they would be selling you security guarantees, not the software itself.) Or you could use SAS. https://www.sas.com/en_ca/trust-center/sas-trust-security.html cheers Ben Bolker On Mon, Jul 13, 2026 at 7:40 PM Jeff Newmiller via R-help <[email protected]> wrote: > > Don't try to fit a round peg into a square hole. Ask your IT team how to > handle open source software. Either they have a solution or they don't ... > but R does not have a vendor and this is a real issue for forms like this... > you can't ask random people on the Internet (us mailing list subscribers) to > pretend we are a vendor and expect any kind of service or responsibility. We > help when we can, and ignore you when we can't. > > R is offered without warranty under the GNU General Public License version 2, > for which the preamble asserts "Also, for each author's protection and ours, > we want to make certain that everyone understands that there is no warranty > for this free software.". <https://www.r-project.org/Licenses/GPL-2> > > Agree to the copying terms and use it... or don't agree and don't use it. > > Just a warning... if you are also looking into POSIT's RDtudio... it is also > open source but they may offer you 'vendor' terms for that software... but > that is different than R (it depends on R) so don't let yourself get confused. > > On July 10, 2026 1:07:07 PM PDT, "Shoshin, Leonid via R-help" > <[email protected]> wrote: > >Hello, > > > >Martin Maechler kindly recommended I direct my employer's inquiry about R > >software to this address. I do realize the form says 'vendor', but it's a > >standard form that doesn't distinguish between commercial and open-source > >teams. I would appreciate your help with this: > > > >https://forms.office.com/Pages/ResponsePage.aspx?id=esFuUS-5i0OFlOEbb2vseSGHPdL5pGFMpevHU2RdP4hURTJYRDJVRVJURFVVM0lHRUg2RTZaUzgyUi4u&r1d4f93493dd34f3ab44a8371cd027827=the%20R%20Foundation&rdd7bb4971fd6412392a1759afcda9ef9=R&r116944486a6e40359eb2ee3bd11d4b69=RITM0679128 > > > >Best Regards, > > > > > >Leonid Shoshin > >Sr Chemist > >Mobile: 385-272-2527 > >Teams: 801-732-2466 > >Westinghouse Electric Co. > > > > > > > >-----Original Message----- > >From: R-foundation <[email protected]> On Behalf Of > >[email protected] > >Sent: Friday, July 10, 2026 12:56 PM > >To: Shoshin, Leonid <[email protected]> > >Subject: Request to mailing list R-foundation rejected > > > >CAUTION EXTERNAL EMAIL: DO NOT CLICK ON LINKS OR OPEN ATTACHMENTS UNLESS YOU > >KNOW THE CONTENT IS SAFE. > > > >Your request to the R-foundation mailing list > > > > Posting of your message titled "R questions" > > > >has been rejected by the list moderator. The moderator gave the following > >reason for rejecting your request: > > > >"Dear Leonid, R is a free open source software -- produced almost > >exclusively by academic volunteers, typically University professors. > >We do not have paid staff ... Rather there are mailing lists, where you can > >ask questions and where (again) volunteers will help by answering. Please do > >try the R-help list, see > >https://www.r-project.org/mail.html > > > >Regards, Martin Maechler" > > > >Any questions or comments should be directed to the list administrator > >at: > > > > [email protected] > > > > > > > >________________________________ > > > >This e-mail may contain proprietary information of the sending organization. > >Any unauthorized or improper disclosure, copying, distribution, or use of > >the contents of this e-mail and attached document(s) is prohibited. The > >information contained in this e-mail and attached document(s) is intended > >only for the personal and private use of the recipient(s) named above. If > >you have received this communication in error, please notify the sender > >immediately by email and delete the original e-mail and attached document(s). > > > >______________________________________________ > >[email protected] mailing list -- To UNSUBSCRIBE and more, see > >https://stat.ethz.ch/mailman/listinfo/r-help > >PLEASE do read the posting guide https://www.R-project.org/posting-guide.html > >and provide commented, minimal, self-contained, reproducible code. > > -- > Sent from my phone. Please excuse my brevity. > [[alternative HTML version deleted]] > > ______________________________________________ > [email protected] mailing list -- To UNSUBSCRIBE and more, see > https://stat.ethz.ch/mailman/listinfo/r-help > PLEASE do read the posting guide https://www.R-project.org/posting-guide.html > and provide commented, minimal, self-contained, reproducible code. ______________________________________________ [email protected] mailing list -- To UNSUBSCRIBE and more, see https://stat.ethz.ch/mailman/listinfo/r-help PLEASE do read the posting guide https://www.R-project.org/posting-guide.html and provide commented, minimal, self-contained, reproducible code.
