agent · ai agents platform

Dify

Dify is a platform for building agentic workflows and RAG pipelines. Per the vendor's own homepage, agents built on it reason through a task, use approved tools, keep context and stop within clear limits, and finished apps can be published as hosted experiences, API endpoints, embeds or MCP-compatible tools. Model providers, tools, data sources and MCP integrations are installed from a marketplace or defined by the customer. It is offered as hosted SaaS and can also be deployed to a VPC or self-hosted; the vendor describes an open-source community edition that is source-available under an Apache-2.0-derivative licence, self-hostable with Docker, and reports 151K+ GitHub stars. On assurance, the page names SSO/SAML, RBAC and audit logs, and states SOC 2 Type II and ISO 27001 - self-declared, with no certificate, auditor or report date published on the page checked. Plans are described as scaling with team, storage, logs and usage, with a dedicated CSM and 24/7 support on higher tiers. No insurance, indemnity, coverage limit or outcome-linked payment term is published on the page checked.

dify.aievidence retrieved Aug 3, 2026 – Aug 18, 2026view as JSON all ai agents platform entries 93 alternatives

Reviewed12 or more fields evidenced, and scored by a human against the published rubric

20 fields evidenced · 39 with no public information. Every value below links to the document it came from and the date we checked it.

20 of them are quoted but not yet interpreted: we hold the source sentence and the date we read it, but nobody has written the answer to the question yet. Those rows show the quote and say so rather than repeating it back as an answer. Why these exist

5 of the evidenced values quote wording our own later capture of the same page no longer contains. Marked below, awaiting an editor.

Also appears in

AI agents and vendors that state SOC 2 AI agents that support the Model Context Protocol Open-source AI agents Self-hosted and on-premise AI agents AI agents and vendors that state ISO 27001 AI agents and vendors that state SOC 2 Type II AI agents that state scoped or role-based permissions

Trust gap

How this is scored

Runtime governance

1/3

Are scope, spend, and authority enforced while the agent runs?

Partial. "Build agents that can reason through a task, use approved tools, keep context, and stop within clear limits" describes a tool allow-list and stopping conditions available to builders, and "SSO / SAML, RBAC" gives authorisation granularity. It is a capability the platform offers rather than a limit the platform enforces, and no spend or authority ceiling is published, so it does not reach 2.

How this gap gets closed →

Audit trail

1/3

Is there a tamper-evident record of what it actually did?

Minimal. "SSO / SAML, RBAC, audit logs" names audit logs as an enterprise feature and nothing more: the page checked does not say what is recorded, who can review it, how long it is kept, or whether it is tamper-evident.

How this gap gets closed →

Compliance

2/3

Are compliance obligations attached per engagement?

"SOC 2 Type II + ISO 27001" are named as held. Falls short of 3 for the same reason as any security-certification-only posture: no per-engagement compliance schedule and no AI-specific framework (EU AI Act, NIST AI RMF, ISO 42001) is claimed on the page checked.

Outcome settlement

0/3

Does payment depend on a verified result?

No public evidence found. "Scale plans as your team, storage, logs, and usage grow" is seat-and-usage pricing. No payment term on the page checked depends on a verified result.

How this gap gets closed →

Insurance & indemnity

0/3

Can the deployment be insured, and is the customer indemnified?

No public evidence found. No cover, carrier, limit or customer indemnity appears on the page checked.

How this gap gets closed →

Assurance

Insurance available: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Own liability cover: no public information
status.dify.ai · checked Aug 18, 2026 · source did not state this
Insurance carriers: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Coverage limits: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Indemnification: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Liability cap: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Audit trail: not yet interpreted
“SSO / SAML, RBAC, audit logs”
dify.ai · checked Aug 3, 2026
Tamper-evident log: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Explainability: not yet interpreted
“The logic stays visible, so teams can test, debug, deploy, and hand it off with confidence”
dify.ai · checked Aug 3, 2026
Runtime governance: not yet interpreted
“Build agents that can reason through a task, use approved tools, keep context, and stop within clear limits”
Not in our latest capture. This quote was on the page when we filed it. We captured the same page again on Sep 17, 2026 and it was not there. The value above has not been re-checked by an editor yet. How we re-check citations
dify.ai · checked Aug 3, 2026
Permission scopes: not yet interpreted
“SSO / SAML, RBAC”
dify.ai · checked Aug 3, 2026
Compliance certifications: not yet interpreted
“SOC 2 Type II + ISO 27001”
dify.ai · checked Aug 3, 2026
Regulatory alignment: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Outcome-based pricing: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Settlement mechanism: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Asset custody: no public information
status.dify.ai · checked Aug 18, 2026 · source did not state this
Dispute process: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
SLA terms: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Evaluation coverage: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Self-reported performance: no public information
status.dify.ai · checked Aug 18, 2026 · source did not state this

Agency

Autonomy level: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Human oversight: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Goal complexity: not yet interpreted
“Build Agentic workflows, RAG pipelines”
dify.ai · checked Aug 3, 2026
Action space: not yet interpreted
“use approved tools”
Not in our latest capture. This quote was on the page when we filed it. We captured the same page again on Sep 17, 2026 and it was not there. The value above has not been re-checked by an editor yet. How we re-check citations
dify.ai · checked Aug 3, 2026
Operating environment: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Initiative: no public information
dify.ai · checked Aug 3, 2026 · source did not state this

Safety

Safety evaluations: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Red teaming: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Safety policy: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Usage restrictions: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Model or system card: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Incident reporting: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Third-party evaluations: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Data handling: no public information
dify.ai · checked Aug 3, 2026 · source did not state this

Practicality

Pricing model: not yet interpreted
“Scale plans as your team, storage, logs, and usage grow”
dify.ai · checked Aug 3, 2026
Price point: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Availability: not yet interpreted
“Dify Cloud Hosted SaaS — prototype to production”
dify.ai · checked Aug 3, 2026
Deployment options: not yet interpreted
“Deploy on cloud, VPC, or self-hosted”
dify.ai · checked Aug 3, 2026
Integrations: not yet interpreted
“Install model providers, tools, data sources, and MCP integrations from the Marketplace”
dify.ai · checked Aug 3, 2026
Supported regions: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Support model: not yet interpreted
“Dedicated CSM & 24/7 support”
dify.ai · checked Aug 3, 2026

Foundation models

Base models: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Model provider: not yet interpreted
“Install model providers”
dify.ai · checked Aug 3, 2026
Model swappable: not yet interpreted
“Install model providers, tools, data sources, and MCP integrations from the Marketplace or define your own”
dify.ai · checked Aug 3, 2026
Open weights: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Fine-tuning: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Context window: no public information
dify.ai · checked Aug 3, 2026 · source did not state this

Ecosystem

Protocols supported: not yet interpreted
“MCP integrations”
dify.ai · checked Aug 3, 2026
Tool use: not yet interpreted
“use approved tools”
Not in our latest capture. This quote was on the page when we filed it. We captured the same page again on Sep 17, 2026 and it was not there. The value above has not been re-checked by an editor yet. How we re-check citations
dify.ai · checked Aug 3, 2026
Multi-agent: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
API access: not yet interpreted
“Publish Dify apps as hosted experiences, API endpoints, embeds, or MCP-compatible tools”
dify.ai · checked Aug 3, 2026
Open source: not yet interpreted
“Open-Source Community Edition Source-available. Self-host with Docker. 151K+ stars on GitHub. Apache-2.0-derivative license”
Not in our latest capture. This quote was on the page when we filed it. We captured the same page again on Sep 17, 2026 and it was not there. The value above has not been re-checked by an editor yet. How we re-check citations
dify.ai · checked Aug 3, 2026
Marketplace presence: no public information
dify.ai · checked Aug 3, 2026 · source did not state this

Impact

User base: not yet interpreted
“151K+ stars on GitHub”
Not in our latest capture. This quote was on the page when we filed it. We captured the same page again on Sep 17, 2026 and it was not there. The value above has not been re-checked by an editor yet. How we re-check citations
dify.ai · checked Aug 3, 2026
Deployment scale: not yet interpreted
“Trusted by Builders & Enterprises Worldwide”
dify.ai · checked Aug 3, 2026
Target sectors: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
High-risk domains: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Documented incidents: no public information
dify.ai · checked Aug 3, 2026 · source did not state this
Market recognition: no public information
status.dify.ai · checked Aug 18, 2026 · source did not state this