This appears to be the usual oblivious security team overreach and the person forwarding the questions does not know what they imply. Pen test and code review reports are sensitive information. Details of system structure in public enable attacks. Security teams ask regularly for data that they themselves would not share.
Audit, disclosure procedures, sure, detail of certifications, yes, but non-commercial OSS projects do not in general do that. Microsoft’s distribution of R might help with these issues and if it is current might have enough security procedures around it to deal with some of the security team requirements. I think Oracle has a distribution of their own and that may help with that too but I don’t know how live they both are. Support for either of those of it is available is likely to cost money. On Tue, 14 Jul 2026 at 9:51 am, Ben Bolker <[email protected]> wrote: > I risked clicking through to the form and going partway through it. > > Unfortunately there is no way that anyone associated with R is going > to fill out this form for you, and most of the questions are > unanswerable (or not in a way that will be satisfactory to your IT > security people) anyway: e.g. > > > Please provide the URL of the vendor's security center with supporting > documentation for PCI, SOC2 type II or ISO27001 certification reports, > Information Security Policies, Procedures, Data Flow Diagram, most recent > Application Code Review or Penetration Testing Reports, etc , or email > these documents to [email protected] > > does this vendor have a security disclosure program, do they have a > cyber-defense program, have they been audited ... etc.. > > It's possible that you could get a third-party vendor such as Posit > to sell you a security-certified version of R (which would not be any > different but would come with the relevant guarantees, audits, etc. > from the third-party vendor). (Note that R is **not** a Posit > product; they would be selling you security guarantees, not the > software itself.) > > Or you could use SAS. > https://www.sas.com/en_ca/trust-center/sas-trust-security.html > > cheers > Ben Bolker > > On Mon, Jul 13, 2026 at 7:40 PM Jeff Newmiller via R-help > <[email protected]> wrote: > > > > Don't try to fit a round peg into a square hole. Ask your IT team how to > handle open source software. Either they have a solution or they don't ... > but R does not have a vendor and this is a real issue for forms like > this... you can't ask random people on the Internet (us mailing list > subscribers) to pretend we are a vendor and expect any kind of service or > responsibility. We help when we can, and ignore you when we can't. > > > > R is offered without warranty under the GNU General Public License > version 2, for which the preamble asserts "Also, for each author's > protection and ours, we want to make certain that everyone understands that > there is no warranty for this free software.". < > https://www.r-project.org/Licenses/GPL-2> > > > > Agree to the copying terms and use it... or don't agree and don't use it. > > > > Just a warning... if you are also looking into POSIT's RDtudio... it is > also open source but they may offer you 'vendor' terms for that software... > but that is different than R (it depends on R) so don't let yourself get > confused. > > > > On July 10, 2026 1:07:07 PM PDT, "Shoshin, Leonid via R-help" < > [email protected]> wrote: > > >Hello, > > > > > >Martin Maechler kindly recommended I direct my employer's inquiry about > R software to this address. I do realize the form says 'vendor', but it's a > standard form that doesn't distinguish between commercial and open-source > teams. I would appreciate your help with this: > > > > > > > https://forms.office.com/Pages/ResponsePage.aspx?id=esFuUS-5i0OFlOEbb2vseSGHPdL5pGFMpevHU2RdP4hURTJYRDJVRVJURFVVM0lHRUg2RTZaUzgyUi4u&r1d4f93493dd34f3ab44a8371cd027827=the%20R%20Foundation&rdd7bb4971fd6412392a1759afcda9ef9=R&r116944486a6e40359eb2ee3bd11d4b69=RITM0679128 > > > > > >Best Regards, > > > > > > > > >Leonid Shoshin > > >Sr Chemist > > >Mobile: 385-272-2527 > > >Teams: 801-732-2466 > > >Westinghouse Electric Co. > > > > > > > > > > > >-----Original Message----- > > >From: R-foundation <[email protected]> On Behalf Of > [email protected] > > >Sent: Friday, July 10, 2026 12:56 PM > > >To: Shoshin, Leonid <[email protected]> > > >Subject: Request to mailing list R-foundation rejected > > > > > >CAUTION EXTERNAL EMAIL: DO NOT CLICK ON LINKS OR OPEN ATTACHMENTS > UNLESS YOU KNOW THE CONTENT IS SAFE. > > > > > >Your request to the R-foundation mailing list > > > > > > Posting of your message titled "R questions" > > > > > >has been rejected by the list moderator. The moderator gave the > following reason for rejecting your request: > > > > > >"Dear Leonid, R is a free open source software -- produced almost > exclusively by academic volunteers, typically University professors. > > >We do not have paid staff ... Rather there are mailing lists, where you > can ask questions and where (again) volunteers will help by answering. > Please do try the R-help list, see > > >https://www.r-project.org/mail.html > > > > > >Regards, Martin Maechler" > > > > > >Any questions or comments should be directed to the list administrator > > >at: > > > > > > [email protected] > > > > > > > > > > > >________________________________ > > > > > >This e-mail may contain proprietary information of the sending > organization. Any unauthorized or improper disclosure, copying, > distribution, or use of the contents of this e-mail and attached > document(s) is prohibited. The information contained in this e-mail and > attached document(s) is intended only for the personal and private use of > the recipient(s) named above. If you have received this communication in > error, please notify the sender immediately by email and delete the > original e-mail and attached document(s). > > > > > >______________________________________________ > > >[email protected] mailing list -- To UNSUBSCRIBE and more, see > > >https://stat.ethz.ch/mailman/listinfo/r-help > > >PLEASE do read the posting guide > https://www.R-project.org/posting-guide.html > > >and provide commented, minimal, self-contained, reproducible code. > > > > -- > > Sent from my phone. Please excuse my brevity. > > [[alternative HTML version deleted]] > > > > ______________________________________________ > > [email protected] mailing list -- To UNSUBSCRIBE and more, see > > https://stat.ethz.ch/mailman/listinfo/r-help > > PLEASE do read the posting guide > https://www.R-project.org/posting-guide.html > > and provide commented, minimal, self-contained, reproducible code. > > ______________________________________________ > [email protected] mailing list -- To UNSUBSCRIBE and more, see > https://stat.ethz.ch/mailman/listinfo/r-help > PLEASE do read the posting guide > https://www.R-project.org/posting-guide.html > and provide commented, minimal, self-contained, reproducible code. > [[alternative HTML version deleted]] ______________________________________________ [email protected] mailing list -- To UNSUBSCRIBE and more, see https://stat.ethz.ch/mailman/listinfo/r-help PLEASE do read the posting guide https://www.R-project.org/posting-guide.html and provide commented, minimal, self-contained, reproducible code.
