Salt Security Public-Source Startup Diligence Report
Track for follow-on diligence rather than underwrite from public sources alone: the company occupies an important security category and has strong historical financing validation, but the 2022 valuation and growth claims must be re-underwritten against current ARR quality, renewal data, competitive displacement, and technical efficacy.
Salt Security Public-Source Startup Diligence Report
Salt Security is a credible late-stage API security vendor with verified unicorn financing, recognizable enterprise logos, and a public product narrative aligned to API discovery, posture, and threat protection. The diligence case is nevertheless materially incomplete because audited financials, current ARR, current valuation, customer concentration, product-efficacy evidence, cap table economics, and founder/IP provenance documents are not public.
Salt's $1.4B valuation is verified historically, but current ARR, growth, margin, burn, cash, debt, customer concentration, and valuation marks are not public.
Diligence request: Request audited financials, ARR bridge, retention cohorts, cash/burn/debt, cap table, preference stack, and latest valuation materials.
Public founder/founding narratives and Secful patent records require direct reconciliation through incorporation, founder, invention-assignment, and separation documents.
Diligence request: Obtain formation records, founder agreements, IP assignments, Secful asset-transfer documents, release agreements, and full patent/trademark/open-source schedules.
API security is important but crowded; broader security platforms can bundle API features, potentially pressuring standalone pricing and renewal priority.
Diligence request: Review win/loss, competitive pricing, displacement data, customer budget owner interviews, and product benchmark results.
Salt lists cloud, AI, database, analytics, services, and affiliate subprocessors; API-security data flows can trigger stringent customer, privacy, transfer, and AI governance obligations.
Diligence request: Review DPA/SCCs, SOC 2/ISO, DPIAs, vendor contracts, AI-service terms, data-flow diagrams, retention controls, and incident history.
Public customer logos and case studies support credibility but do not disclose ARR, renewal status, deployment breadth, churn, concentration, or referenceability.
Diligence request: Conduct customer references and reconcile to signed contracts, renewal schedules, deployment telemetry, NRR/GRR, and support records.
Public product pages describe discovery and behavioral protection, but independent efficacy, precision/recall, false positives, deployment friction, and customer outcomes are not public.
Diligence request: Perform technical diligence with live demos, customer telemetry, incident samples, red-team results, model governance, and architecture review.
Public growth percentages do not reveal sales productivity, CAC payback, quota attainment, rep ramp, marketing ROI, or employee retention.
Diligence request: Request pipeline, quota, win/loss, CAC payback, marketing ROI, rep roster, headcount history, attrition, and compensation data.
No major public litigation was found in the reviewed source set, but exhaustive docket, contract, insurance, IP, and regulatory diligence was not performed.
Diligence request: Have counsel perform docket/regulator searches and review litigation schedules, contracts, insurance policies, IP schedules, and privacy/regulatory records.
Public financing evidence is strong through the 2022 Series D, but operating financials are not public. The central diligence issue is whether Salt's current ARR quality, growth durability, and cash profile support or reset the historical $1.4 billion valuation.
not publicly verifiable confidence: medium
No audited financial statements, quarterly P&L, revenue by product, gross margin, deferred revenue, burn, cash, or debt schedule were located in public sources. The most concrete operating datapoints are unaudited growth percentages reported in the 2022 Series D announcement.
| item | public status | diligence implication |
|---|---|---|
| Audited financial statements | Not found publicly | Cannot assess revenue recognition, costs, margins, cash, debt, or contingencies. |
| ARR / MRR schedule | Not found publicly | Historical growth percentages cannot be converted into current run-rate quality. |
| Cash, burn, debt, and runway | Not found publicly | Current financing risk cannot be measured from public evidence. |
| Revenue by product and customer | Not found publicly | Product-market fit and customer concentration remain unverified. |
Absence of public disclosure is expected for a private company but is material for underwriting.
| metric | public claim | missing denominator | primary request |
|---|---|---|---|
| Revenue growth | 500% | Starting ARR, ending ARR, period, currency, and revenue-recognition policy. | ARR bridge, audited revenue, bookings, NRR/GRR, and revenue by customer/product. |
| Customer growth | 300% | Customer-count definition, paid versus pilot, and starting/ending count. | Customer roster by quarter, paid status, contract value, cohort retention, and churn. |
| Employee growth | 250% | Starting headcount, function, geography, and contractor inclusion. | Payroll roster, hiring plan, attrition, and headcount by function/location. |
| Fortune/Global 500 signed customers | 900% | Signed-customer baseline, active deployment, contract value, and renewal status. | Signed enterprise-customer roster, ARR, contract dates, reference status, and deployment scope. |
Percentage claims are directionally useful but cannot be valued without denominators and current metrics.
| milestone | date | disclosed terms | diligence read |
|---|---|---|---|
| Series A | 2020 | $20M Series A led by Tenaya Capital reported publicly. | Supports venture validation but not current valuation, preference terms, or ARR. |
| Series B | 2020 | $30M Series B led by Sequoia Capital reported publicly. | Supports strong investor syndicate; cap table terms remain private. |
| Series C | 2021 | $70M Series C led by Advent International reported publicly. | Indicates pre-Series-D capital availability but not operating quality. |
| Series D / unicorn | 2022-02-10 | $140M Series D led by CapitalG; $271M total funding; $1.4B valuation. | Verifies unicorn status historically; must be re-underwritten against current metrics. |
Public sources do not disclose liquidation preference, option-pool refresh, secondary sales, debt, or current valuation.
Timeline dates after financing are public-source signals, not audited roadmap milestones.
Round amounts and valuation are public disclosures; current valuation is unknown.
not publicly verifiable confidence: low
Public sources did not provide management forecasts, pipeline conversion, budget, or hiring-plan projections. Any underwriting case requires direct access to the plan and variance history.
partially verified confidence: high
Public announcements identify Seed/Series A-D milestones and the 2022 $1.4 billion valuation, but cap table economics, preference stack, option pool, debt, and secondary activity are not public.
not publicly verifiable confidence: low
Tax, debt, off-balance-sheet liabilities, significant contracts, credit facilities, and insurance schedules were not public.
Salt's public product architecture centers on API discovery, posture/governance, runtime threat protection, and security-program integrations. The key diligence question is whether runtime efficacy and deployment coverage are independently validated across live enterprise environments.
partially verified confidence: medium
Public product pages describe a platform for API discovery, inventory/context, posture and compliance, threat detection, testing/remediation, and integrations into development, cloud, and security workflows. Public materials also highlight newer agentic-security positioning.
| module | public evidence | diligence question |
|---|---|---|
| API discovery and inventory | Salt describes discovery and context for APIs across environments. | What percentage of live APIs are discovered and classified versus a customer source of truth? |
| API posture and governance | Product materials reference posture, compliance, and remediation workflows. | How are policy violations prioritized, assigned, remediated, and verified? |
| Runtime threat protection | Salt describes behavioral threat detection and protection against API attacks. | What precision, recall, and response-time evidence exists in production environments? |
| AI / agentic security positioning | Salt markets an Agentic Security Platform and AI-era API protection. | Which features use AI models or AI vendors, and how are customer data and model outputs governed? |
Product descriptions are publicly verifiable; efficacy requires non-public technical evidence.
| integration signal | strategic logic | diligence request |
|---|---|---|
| GitHub Connect | Shifts API-security findings into developer workflow and source context. | Usage metrics, attach rates, remediation time, and customer adoption. |
| Databricks-related connector or partner content | Extends API/data security workflow to data-platform environments. | Production deployments, revenue contribution, and partner terms. |
| Netlify-related connector or partner content | Connects API security to modern application delivery and developer workflows. | Active users, conversion to paid accounts, and co-marketing pipeline. |
| Security operations, cloud, and application workflows | Increases stickiness if findings route to SIEM/SOAR, ticketing, and cloud controls. | Integration telemetry, customer retention impact, and support burden. |
Public integration existence does not establish meaningful revenue or retention impact.
| claim area | public claim status | validation artifact |
|---|---|---|
| API discovery coverage | Described by Salt product pages | Side-by-side inventory reconciliation for sampled customers. |
| Behavioral threat detection | Described by Salt product pages | Precision/recall, incident-response evidence, false-positive logs, and customer outcomes. |
| AI / agentic controls | Marketing and product positioning visible | Model cards, data-flow diagrams, vendor terms, prompt/log retention, and abuse-testing records. |
| Remediation workflow impact | Integration signals visible | Time-to-remediate metrics, ticket closure data, and developer-adoption evidence. |
Technical diligence should include live demo, architecture review, customer telemetry, and red-team results.
This is an inferred architecture from public materials, not a verified internal diagram.
Growth percentages are not audited financial metrics in public sources.
Salt publicly names credible enterprise customers and publishes case-study/logos, but revenue concentration, renewal status, deployment breadth, customer satisfaction, and churn are not public.
partially verified confidence: medium
Public Salt materials list enterprise customers across financial services, technology, retail, travel, and infrastructure. Public sources do not rank customers by revenue or deployment size.
| customer or segment | public source type | diligence limit |
|---|---|---|
| Ally Bank | Salt customer/case-study evidence reviewed in-session | Current contract value, deployment scope, renewal, and reference status. |
| Finastra, Equinix, Armis, Carrefour | Salt customer-logo evidence reviewed in-session | Paid status, ARR, product modules used, and deployment breadth. |
| City National Bank, Payoneer, TripActions | Salt customer-logo or case-study evidence reviewed in-session | Current customer status and customer referenceability. |
| Fortune / Global 500 signed customers | Series D growth claim | Baseline, count, contract value, current status, and deployment scope. |
Public logo use is useful but must be tested through direct references and contract data.
| customer metric | public status | risk if missing |
|---|---|---|
| ARR by customer | Not public | Concentration and dependence on a few enterprise contracts cannot be measured. |
| Net revenue retention and gross retention | Not public | Logo growth may hide churn, downsell, or weak expansion. |
| Deployment scope and modules used | Not public | Logos may represent narrow pilots rather than broad production usage. |
| Renewal and churn schedule | Not public | Near-term ARR stability cannot be assessed. |
Customer economics are priority diligence before valuation work.
Map reflects public evidence only, not customer size or revenue.
partially verified confidence: medium
Public materials indicate integrations and ecosystem relationships with developer, data, and deployment platforms, but channel economics and contractual commitments are not public.
| channel signal | likely role | needed metric |
|---|---|---|
| Enterprise customer pages and case studies | Reference selling and category validation. | Closed-won ARR influenced by references and case studies. |
| Product integrations | Developer workflow stickiness and partner-led discovery. | Integration attach rate, partner-sourced pipeline, and renewal lift. |
| API-security threat research and content | Demand generation and buyer education. | Content-sourced pipeline, MQL-to-SQL conversion, and CAC payback. |
| Enterprise direct sales | Closing large security and application-team contracts. | Quota attainment, ramp time, sales cycle, discounting, and win rate. |
Public GTM signals do not establish productivity or efficiency.
Funnel is a diligence logic model, not a measured conversion chart.
not publicly verifiable confidence: low
Revenue by customer is not public. Public logos and growth percentages are insufficient to assess concentration, expansion, churn, or cohort quality.
inconclusive confidence: low
Public sources reviewed did not identify significant severed customer relationships, but absence of public evidence is not conclusive.
verified confidence: high
Salt's public subprocessor disclosure identifies major infrastructure, AI, database, analytics, and affiliated-service providers, including AWS, Microsoft Azure OpenAI, MongoDB Atlas, SingleStore, Sisense, Sec4U, Salt Canada, and Salt Ltd.
| vendor | apparent role | diligence focus |
|---|---|---|
| AWS | Cloud infrastructure | Data residency, uptime, security controls, BCP/DR, cloud spend, and commitments. |
| Microsoft Azure OpenAI | AI service subprocessor | Customer-data use, retention, prompt/log controls, model governance, and regulatory representations. |
| MongoDB Atlas and SingleStore | Database/storage infrastructure | Customer-data segregation, encryption, backups, access controls, and data-location commitments. |
| Sisense, Sec4U, Salt Canada, Salt Ltd. | Analytics, services, and affiliated processing | Data flows, affiliate agreements, support access, and cross-border transfer controls. |
The subprocessor list is a concrete starting point for privacy, vendor, and business-continuity diligence.
| topic | public evidence | diligence workstream |
|---|---|---|
| Privacy and customer data processing | Privacy policy describes customer-data processing, privacy rights, transfer mechanisms, and related obligations. | DPA, SOC 2, ISO, DPIA, retention, incident, audit, and customer-security review. |
| Subprocessors | Public list includes cloud, AI, database, analytics, services, and affiliate subprocessors. | Vendor contracts, data flows, AI terms, transfer-impact assessments, and BCP/DR. |
| Litigation and regulatory actions | No major public action identified in reviewed public search set. | Counsel-led docket searches, claims schedule, demand letters, and regulator correspondence. |
| IP / founder provenance | Secful patent record and inconsistent founder-source narratives. | IP schedule, assignment chain, founder agreements, and separation releases. |
Legal diligence should be counsel-led and include jurisdictions beyond public web searches.
API security is a meaningful security subcategory, but Salt competes with standalone API-security vendors and broader application-security, cloud-security, gateway, and security-platform vendors. Public differentiation claims require customer win/loss and technical evidence.
partially verified confidence: medium
Salt's public positioning emphasizes dedicated API security, behavioral runtime protection, posture, and discovery. Competitive pressure comes from other API-security specialists and larger security platforms that can bundle API protection into existing customer footprints.
| segment | example competition | implication for salt |
|---|---|---|
| Standalone API security | Specialist vendors focused on API discovery, posture, and runtime protection. | Direct product comparisons and win/loss matter most. |
| Application security platforms | SAST/DAST/IAST, ASPM, and application-risk platforms adding API security. | Buyers may consolidate testing, posture, and remediation budgets. |
| WAF, gateway, and CDN platforms | Traffic-management and edge-security vendors with API controls. | Incumbent traffic position can reduce standalone deployment willingness. |
| CNAPP and cloud security suites | Cloud-security platforms expanding into application and API risk. | Suite consolidation could pressure price and procurement priority. |
Competitive examples are category-level; specific win/loss data must come from management and customers.
| claimed edge | public support | validation test |
|---|---|---|
| Behavioral runtime protection | Salt product pages describe behavioral threat detection. | Review customer incident detections, false positives, false negatives, and response workflows. |
| Broad API discovery | Salt describes API discovery and inventory capabilities. | Compare discovered APIs against customer CMDB, gateway logs, and code repositories. |
| Developer and ecosystem integrations | GitHub Connect and data/deployment connectors are publicly referenced. | Measure attach rate, workflow adoption, ticket close time, and retained ARR lift. |
| Agentic-security positioning | Salt markets an Agentic Security Platform. | Validate product readiness, SKU revenue, customer adoption, model risk, and competitor parity. |
Differentiation must be backed by win/loss, technical benchmarks, and customer ROI.
| risk theme | public evidence | diligence request |
|---|---|---|
| Suite bundling | Market contains many adjacent security categories that can add API capabilities. | Win/loss and pricing pressure by competitor class. |
| Feature parity | Salt's product claims are public, but competitor feature comparison is not independently proven. | Third-party benchmark, buyer survey, and competitive demo results. |
| Buyer consolidation | Public customer logos show enterprise relevance but not procurement priority. | Customer budget ownership, renewal justification, and stack-consolidation plans. |
Competitive diligence should be customer-led, not vendor-marketing-led.
This market map is analytical, not a paid analyst quadrant.
Public materials indicate an enterprise-led go-to-market motion supported by customer logos, case studies, product integrations, and security thought leadership. Sales productivity, pipeline conversion, partner economics, and budget efficiency are not public.
partially verified confidence: medium
Salt appears to sell to enterprise security and application teams through direct enterprise sales, customer references, category education, and product integrations. Public sources do not disclose sales capacity or productivity.
| metric | why it matters | requested cut |
|---|---|---|
| Quota attainment | Tests sales force productivity after headcount growth. | Quarter, region, segment, rep tenure, new logo vs expansion. |
| CAC payback and burn multiple | Links GTM efficiency to valuation and financing risk. | Segment, channel, customer size, and cohort. |
| Pipeline conversion | Tests forecast reliability. | Source, stage, channel, segment, and competitor. |
| Discounting and sales cycle | Reveals price pressure and enterprise procurement friction. | Segment, competitor, product module, and deal size. |
These data are not public; request directly from management.
partially verified confidence: medium
Major-customer evidence is primarily logo/case-study based. This supports brand credibility but does not substitute for live references and contract-level diligence.
| reference group | key questions | evidence to match |
|---|---|---|
| Financial services logos | Why Salt, what APIs are protected, what alternatives were evaluated, what outcomes were measured? | Contract ARR, deployment scope, renewal status, security findings, and support tickets. |
| Technology and infrastructure logos | How was Salt integrated into developer, data, and runtime workflows? | Integration usage, remediation workflow telemetry, and expansion history. |
| Recent wins and recent losses | What drove selection or rejection, and what competitive vendors were involved? | Win/loss database, pricing, competitor, and procurement timeline. |
Reference selection should include management-provided references and off-list customer checks.
partially verified confidence: medium
Public signals point to direct enterprise sales, product-led technical education, partner/integration visibility, and thought leadership around API attack risk.
not publicly verifiable confidence: low
Public sources did not disclose sales force size, quota attainment, ramp time, rep productivity, sales cycle, or CAC payback.
| topic | public evidence | requested detail |
|---|---|---|
| Employee growth | 250% employee growth claim in Series D announcement. | Monthly headcount by function, geography, employee/contractor status, and cost. |
| Sales capacity | No public quota-carrying rep details. | Rep roster, quota, ramp cohort, attainment, and turnover. |
| R&D capacity | Product releases and patent evidence show technical activity but not current capacity. | Engineers by team, attrition, roadmap ownership, and technical debt. |
| Compensation and equity | Not public. | Compensation bands, executive pay, commission plans, option ledger, and retention grants. |
Payroll and equity data are necessary to understand execution risk and dilution.
Chart intentionally shows data availability, not actual headcount.
not publicly verifiable confidence: low
Current and projected marketing budgets were not public. Category education, customer references, and partner integrations are visible, but their cost and conversion rates are unknown.
Public evidence shows active product development around API security, integrations, and AI/agentic positioning, while patent evidence links Secful-era IP to Roey Eliyahu and Omer Sadika. Internal roadmap, code quality, R&D headcount, and technical debt remain non-public.
partially verified confidence: low
Public materials indicate Israel-linked founding/R&D context and product development in API security, but no detailed R&D org chart, headcount-by-function, budget, release cadence, backlog, or technical-debt register was public.
| item | evidence | diligence implication |
|---|---|---|
| Secful-linked patent | Patent record for US9853996B2 identifies Secful and inventors Roey Eliyahu and Omer Sadika. | Verify whether and how Secful IP was assigned to Salt. |
| Founder narrative inconsistency | Current and older public sources reviewed in-session vary on date/founder framing. | Request formation, assignment, founder departure, and release documents. |
| Broader IP estate | Only limited public patent evidence was captured for this standard screen. | Verify patents, trademarks, copyrights, open-source use, and trade-secret ownership. |
IP assignment is a priority legal diligence item because public records alone do not prove clean ownership.
| signal | interpretation | diligence gap |
|---|---|---|
| GitHub Connect | Product development reaches earlier into developer workflow and source context. | Adoption, SKU economics, remediation impact, and support burden. |
| Databricks and Netlify connector references | Product strategy may follow modern data and application delivery workflows. | Active customer usage, partner terms, and revenue impact. |
| Agentic Security Platform positioning | Salt is adapting API security for AI/agentic software risk. | Technical maturity, model governance, customer adoption, and differentiated IP. |
| Behavioral runtime protection messaging | Core R&D focus remains API abuse detection and runtime context. | Detection efficacy, customer incident proof, and scalability. |
Public roadmap signals require management roadmap and customer adoption evidence.
Current and older public narratives should be reconciled with legal documents.
partially verified confidence: medium
Public new-product signals include integrations and agentic-security positioning, but commercial adoption, release timing, and roadmap risk are not public.
Public leadership and growth claims support a scaled late-stage organization, but founder history contains public inconsistencies and detailed personnel data is not public.
partially verified confidence: medium
Current public pages identify executive leadership at a high level, but no complete organization chart, reporting lines, board composition, or functional ownership map was public.
| source cluster | observed narrative | reconciliation needed |
|---|---|---|
| Current Salt about / leadership pages | Current materials reviewed in-session cite Roey Eliyahu and Michael Nicosia with a 2018 founding narrative. | Incorporation records, board consents, role history, and company-approved founder list. |
| Older financing and market-database sources | Older materials and snippets reference 2016 origin and/or Omer Sadika. | Founder agreements, separation agreements, equity treatment, and public correction history. |
| Patent records | Secful patent records name Roey Eliyahu and Omer Sadika as inventors. | Invention assignment and asset-transfer chain from Secful-era work to Salt. |
Inconsistency is not proof of wrongdoing; it is a document request trigger.
This figure is a diligence ownership map, not Salt's official org chart.
partially verified confidence: medium
The Series D release reported 250% employee growth, but public sources do not disclose baseline headcount, current headcount, functional mix, location mix, attrition, or hiring plan.
partially verified confidence: medium
Public sources identify key executives, but diligence should verify employment history, founder roles, equity ownership, departures, and any unresolved claims from early company formation.
not publicly verifiable confidence: low
Compensation arrangements were not public.
not publicly verifiable confidence: low
Option plans, equity grants, and option-pool capacity were not public.
inconclusive confidence: low
Public sources reviewed did not identify significant employee-relations problems, but no exhaustive employment docket or internal HR review was performed.
not publicly verifiable confidence: low
Personnel turnover was not public.
Public legal evidence includes privacy/subprocessor disclosures and patent records. Major litigation was not identified in public searches, but this is not a substitute for counsel-led docket, contract, IP, insurance, and regulatory diligence.
inconclusive confidence: low
No major pending lawsuit against Salt Security was identified in the public web searches summarized for this report, but this is low-confidence because docket systems were not exhaustively queried.
| document group | why needed | priority |
|---|---|---|
| Top customer contracts and DPAs | Verify ARR, renewal, indemnity, service levels, security obligations, and privacy terms. | high |
| Vendor and subprocessor contracts | Test data-processing, AI, continuity, audit, termination, and cost risks. | high |
| IP, founder, and employee assignment documents | Resolve Secful/founder provenance and ownership of product IP. | high |
| Insurance policies and claims history | Assess coverage for cyber, E&O, D&O, EPLI, customer claims, and privacy incidents. | medium |
These requests should be tied to a diligence materiality threshold and counsel review.
Ratings reflect public-source uncertainty, not an investment recommendation.
inconclusive confidence: low
Public sources reviewed did not identify material litigation initiated by Salt, but exhaustive docket searches were not completed.
inconclusive confidence: low
As a software company, public environmental exposure appears limited; employee safety and workplace issues were not publicly verifiable.
partially verified confidence: medium
Patent records identify Secful-linked patent US9853996B2 with Roey Eliyahu and Omer Sadika as inventors. The broader IP estate, trademark ownership, open-source usage, invention assignments, and any founder separation terms were not public.
not publicly verifiable confidence: low
Insurance coverage and claims history were not public.
partially verified confidence: medium
Material customer, vendor, subprocessor, cloud, AI, database, partner, lease, and financing contracts are not public. Privacy and subprocessor disclosures provide the main public leads.
partially verified confidence: medium
Public privacy materials indicate GDPR/CCPA and cross-border-transfer commitments. No regulator enforcement action was identified in the reviewed public source set, but privacy and AI-related data processing warrant counsel review.
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | CB Insights lists Salt Security as a unicorn with a $1.4 billion valuation and a 2022-02-10 unicorn date. | verified high | SRC-001 |
| EC-002 | Salt Security announced a $140 million Series D led by CapitalG, $271 million total funding, and a $1.4 billion valuation. | verified high | SRC-002 |
| EC-003 | Salt Security publicly announced or was reported to have raised a $70 million Series C led by Advent International. | verified medium | SRC-003 |
| EC-004 | Salt Security publicly announced or was reported to have raised a $30 million Series B led by Sequoia. | verified medium | SRC-004 |
| EC-005 | Salt Security publicly announced or was reported to have raised a $20 million Series A led by Tenaya Capital. | verified medium | SRC-005 |
| EC-006 | Salt's Series D announcement reported 500% revenue growth, 300% customer growth, 250% employee growth, and 900% Fortune/Global 500 signed-customer growth. | partially verified medium | SRC-002 |
| EC-007 | Public sources did not disclose Salt's audited financial statements, current ARR, gross margin, cash, debt, burn, or detailed forecasts. | not publicly verifiable medium | SRC-002SRC-012 |
| EC-008 | Salt publicly describes API discovery, inventory/context, posture/governance, and remediation capabilities. | verified high | SRC-007SRC-008SRC-009 |
| EC-009 | Salt publicly describes behavioral threat protection and AI/agentic-security positioning. | partially verified medium | SRC-010SRC-011 |
| EC-010 | Salt publicly references product integrations or connectors such as GitHub Connect, Databricks, and Netlify-related workflows. | partially verified medium | SRC-020SRC-021SRC-022 |
| EC-011 | Salt publicly names enterprise customers including Ally Bank, Finastra, Equinix, Armis, Carrefour, City National Bank, Payoneer, and TripActions. | partially verified medium | SRC-012SRC-013SRC-014 |
| EC-012 | Salt's public customer materials do not disclose customer revenue concentration, churn, NRR/GRR, renewal status, or deployment breadth. | not publicly verifiable high | SRC-012SRC-013 |
| EC-013 | Salt's public subprocessor list includes AWS, Microsoft Azure OpenAI, MongoDB Atlas, SingleStore, Sisense, Sec4U, Salt Canada, and Salt Ltd. | verified high | SRC-016 |
| EC-014 | Salt's privacy policy describes customer-data processing, privacy rights, GDPR/CCPA context, SCCs/cross-border transfers, and retention/processing concepts. | verified high | SRC-015 |
| EC-015 | Public patent records for US9853996B2 identify Secful and inventors Roey Eliyahu and Omer Sadika. | verified high | SRC-017SRC-018 |
| EC-016 | Public founder/founding narratives reviewed in-session are inconsistent across current company materials, older financing materials, market-database snippets, and patent records. | partially verified medium | SRC-006SRC-002SRC-017SRC-018SRC-025 |
| EC-017 | Salt publishes leadership/about materials that identify current leadership and company positioning at a high level. | partially verified medium | SRC-006SRC-019 |
| EC-018 | Public searches reviewed for this standard screen did not identify major pending litigation, acquisition, IPO, shutdown, or regulatory-enforcement events for Salt Security. | inconclusive low | SRC-026 |
| EC-019 | Salt competes in a crowded API-security market with standalone vendors and broader application-security, WAF/gateway, CNAPP, and platform-suite competitors. | partially verified medium | SRC-023SRC-024 |
| EC-020 | Salt's public go-to-market signals include enterprise customer references, category education, integrations, and direct enterprise-security positioning. | partially verified medium | SRC-012SRC-020SRC-021SRC-022SRC-023 |
| EC-021 | No public IPO, acquisition, or shutdown event for Salt Security was identified in the reviewed source set. | inconclusive medium | SRC-006SRC-007SRC-026 |
| EC-022 | Salt publicly positions itself around an Agentic Security Platform and AI-era API risks. | partially verified medium | SRC-011 |
| EC-023 | Salt's broader patent, trademark, copyright, open-source, and invention-assignment estate is not fully verifiable from the limited public patent records reviewed. | not publicly verifiable medium | SRC-017SRC-018 |
| EC-024 | Salt's public employee-growth claim is 250%, but exact current headcount, function mix, location mix, attrition, and productivity are not public. | partially verified medium | SRC-002SRC-027 |
| EC-025 | Public subprocessor disclosures indicate Salt depends on third-party cloud, AI, database, analytics, services, and affiliated processors. | verified high | SRC-016 |
| EC-026 | Salt's privacy and subprocessor materials create specific AI, data-transfer, customer-data, and retention diligence issues. | verified high | SRC-015SRC-016 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.