I risked clicking through to the form and going partway through it.
Unfortunately there is no way that anyone associated with R is going
to fill out this form for you, and most of the questions are
unanswerable (or not in a way that will be satisfactory to your IT
security people) anyway: e.g.
Please provide the URL of the vendor's security center with supporting
documentation for PCI, SOC2 type II or ISO27001 certification reports,
Information Security Policies, Procedures, Data Flow Diagram, most recent
Application Code Review or Penetration Testing Reports, etc , or email
these documents to [email protected]
does this vendor have a security disclosure program, do they have a
cyber-defense program, have they been audited ... etc..
It's possible that you could get a third-party vendor such as Posit
to sell you a security-certified version of R (which would not be any
different but would come with the relevant guarantees, audits, etc.
from the third-party vendor). (Note that R is **not** a Posit
product; they would be selling you security guarantees, not the
software itself.)
Or you could use SAS.
https://www.sas.com/en_ca/trust-center/sas-trust-security.html
cheers
Ben Bolker
On Mon, Jul 13, 2026 at 7:40 PM Jeff Newmiller via R-help
<[email protected]> wrote:
Don't try to fit a round peg into a square hole. Ask your IT team how to
handle open source software. Either they have a solution or they don't ...
but R does not have a vendor and this is a real issue for forms like
this... you can't ask random people on the Internet (us mailing list
subscribers) to pretend we are a vendor and expect any kind of service or
responsibility. We help when we can, and ignore you when we can't.
R is offered without warranty under the GNU General Public License
version 2, for which the preamble asserts "Also, for each author's
protection and ours, we want to make certain that everyone understands that
there is no warranty for this free software.". <
https://www.r-project.org/Licenses/GPL-2>
Agree to the copying terms and use it... or don't agree and don't use it.
Just a warning... if you are also looking into POSIT's RDtudio... it is
also open source but they may offer you 'vendor' terms for that software...
but that is different than R (it depends on R) so don't let yourself get
confused.
On July 10, 2026 1:07:07 PM PDT, "Shoshin, Leonid via R-help" <
[email protected]> wrote:
Hello,
Martin Maechler kindly recommended I direct my employer's inquiry about
R software to this address. I do realize the form says 'vendor', but it's a
standard form that doesn't distinguish between commercial and open-source
teams. I would appreciate your help with this:
https://forms.office.com/Pages/ResponsePage.aspx?id=esFuUS-5i0OFlOEbb2vseSGHPdL5pGFMpevHU2RdP4hURTJYRDJVRVJURFVVM0lHRUg2RTZaUzgyUi4u&r1d4f93493dd34f3ab44a8371cd027827=the%20R%20Foundation&rdd7bb4971fd6412392a1759afcda9ef9=R&r116944486a6e40359eb2ee3bd11d4b69=RITM0679128
Best Regards,
Leonid Shoshin
Sr Chemist
Mobile: 385-272-2527
Teams: 801-732-2466
Westinghouse Electric Co.
-----Original Message-----
From: R-foundation <[email protected]> On Behalf Of
[email protected]
Sent: Friday, July 10, 2026 12:56 PM
To: Shoshin, Leonid <[email protected]>
Subject: Request to mailing list R-foundation rejected
CAUTION EXTERNAL EMAIL: DO NOT CLICK ON LINKS OR OPEN ATTACHMENTS
UNLESS YOU KNOW THE CONTENT IS SAFE.
Your request to the R-foundation mailing list
Posting of your message titled "R questions"
has been rejected by the list moderator. The moderator gave the
following reason for rejecting your request:
"Dear Leonid, R is a free open source software -- produced almost
exclusively by academic volunteers, typically University professors.
We do not have paid staff ... Rather there are mailing lists, where you
can ask questions and where (again) volunteers will help by answering.
Please do try the R-help list, see
https://www.r-project.org/mail.html
Regards, Martin Maechler"
Any questions or comments should be directed to the list administrator
at:
[email protected]
________________________________
This e-mail may contain proprietary information of the sending
organization. Any unauthorized or improper disclosure, copying,
distribution, or use of the contents of this e-mail and attached
document(s) is prohibited. The information contained in this e-mail and
attached document(s) is intended only for the personal and private use of
the recipient(s) named above. If you have received this communication in
error, please notify the sender immediately by email and delete the
original e-mail and attached document(s).
______________________________________________
[email protected] mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide
https://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.
--
Sent from my phone. Please excuse my brevity.
[[alternative HTML version deleted]]
______________________________________________
[email protected] mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide
https://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.
______________________________________________
[email protected] mailing list -- To UNSUBSCRIBE and more, see
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide
https://www.R-project.org/posting-guide.html
and provide commented, minimal, self-contained, reproducible code.
