Python

United States · www.python.org · 9 vendors

The Python Software Foundation (PSF) is an American nonprofit organization dedicated to promoting, protecting, and advancing the Python programming language. It supports the growth of a diverse and international community of Python programmers by managing intellectual property, providing infrastructure, and organizing events like PyCon US.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 9 sub-vendors.

Insights

Last updated 2026-07-30 · revision 2

9 direct vendors, 175 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

The company exhibits high migration readiness due to its modern and cloud-friendly internal tech stack. The use of AWS and Google Cloud Storage indicates existing cloud adoption. Containerization with Docker, along with technologies like Django, PostgreSQL, Elasticsearch, Redis, and Celery, suggests an architecture that is modular and well-suited for migration to cloud-native environments or microservices architectures. However, critical information regarding the regulatory environment and data residency requirements is missing, which could introduce significant complexities and costs during a migration. Financial stability data (revenue concentration, growth history) is also absent, making it impossible to assess the company's capacity to fund a potentially large-scale migration effort. The vendor relationship data is contradictory ("Total Vendors: 0" vs. "Total Services: 11" with vendor country data). If we assume the company relies on vendors for 11 services, the vendor geographic diversity (3-4 countries) is moderate, and the "Vendor Lock-in Risk" is "Unknown," which could pose challenges if contracts are complex or switching costs are high. Despite these unknowns, the strong technical foundation significantly boosts migration readiness.

Compliance

6 in-scope frameworks identified; showing 3.

CCPA — Partially Compliant

The PSF explicitly acknowledges CCPA applicability in their Privacy Notice, referencing rights for 'citizens of certain states (including California and Virginia).' The PSF collects personal data from California residents via its websites and services. Risk is Medium because: (1) the PSF has acknowledged CCPA rights; (2) however, as a non-profit, CCPA applicability thresholds (annual gross revenue >$25M, buying/selling data of 100,000+ consumers, or deriving 50%+ revenue from selling data) may not be met; (3) no formal CCPA compliance program or privacy rights request mechanism is publicly documented beyond the general privacy contact.

Evidence: https://policies.python.org/PSF-Privacy-Notice/, https://policies.python.org/python.org/Privacy-Notice/

US Export Controls — Assessment Required

Python is open-source software distributed globally, including to countries subject to US export controls. The PSF distributes Python source code and binaries via python.org and PyPI to users worldwide. Open-source software is generally exempt from EAR licensing requirements under the publicly available exemption (15 CFR § 734.7), but the PSF must ensure compliance with this exemption and screen for prohibited end-users. Risk is Medium because: (1) open-source exemptions generally apply; (2) however, cryptographic functionality in Python's standard library (ssl, hashlib, etc.) may trigger EAR notification requirements; (3) no public disclosure of export control compliance program found.

Evidence: https://www.python.org/downloads/, https://www.python.org/psf/about/

ISO 27001 (source) — Assessment Required

The PSF manages critical global digital infrastructure (python.org, PyPI, documentation servers) that underpins the software supply chain for millions of developers and organizations. ISO 27001 certification would provide formal assurance of information security management. The risk is Medium because: (1) no ISO 27001 certification has been publicly disclosed; (2) the PSF has demonstrated some security awareness (SSDF response, security disclosure process, use of reputable cloud providers with their own certifications); (3) as a non-profit, formal ISO 27001 certification is less common but increasingly expected for critical infrastructure providers; (4) a security incident affecting PyPI or python.org could have significant global impact.

Evidence: https://www.python.org/dev/security/, https://policies.python.org/reference/SSDF-Request-Response/, https://policies.python.org/PSF-Privacy-Notice/

Financials

Three-year financials

Financial Resilience Score: 7/10

The Python Software Foundation (PSF) demonstrates solid financial resilience for a small non-profit organization. With approximately $5-6M in annual revenue and $4-5M in net assets, the PSF maintains a conservative financial position underpinned by a diversified corporate sponsor base including major technology firms like Google, Microsoft, Meta, AWS, Bloomberg, and JetBrains. The organization has successfully rebuilt reserves following pandemic-era disruptions and continues to see positive net asset growth year-over-year. The PSF benefits from Python's dominant position as the world's most-used programming language, which creates strong structural incentives for continued corporate sponsorship. Its low fixed-cost structure (fewer than 15 FTE employees) combined with substantial in-kind support (Fastly CDN, AWS infrastructure) provides operational efficiency. Landmark grants such as the ~$2M AWS/Alpha-Omega grant for PyPI security in 2023 demonstrate the organization's ability to attract significant restricted funding. However, the PSF faces meaningful concentration risks. PyCon US represents 40-50% of revenue in non-pandemic years, creating single-event exposure as demonstrated in 2020 when COVID forced the conference online. The organization also lacks access to capital markets as a non-profit and depends on discretionary corporate sponsorship budgets that can shift with economic conditions or changes in open-source funding priorities. The rising operational and security costs of PyPI infrastructure also present ongoing financial pressure.

Key strengths: Diversified corporate sponsor base including Google, Microsoft, Meta, AWS, Bloomberg, JetBrains, Python's #1-2 position in TIOBE and Stack Overflow developer surveys drives sustained sponsorship, Low fixed-cost structure with fewer than 15 FTE employees, Positive net asset trajectory with reserves rebuilt post-pandemic, Substantial in-kind infrastructure support from Fastly, AWS worth millions annually, Growing revenue base (7-15% YoY growth), Landmark ~$2M AWS grant for PyPI security in 2023

Risk factors: Heavy concentration on PyCon US (40-50% of revenue) - single event disruption risk, Sponsorship-dependent model vulnerable to corporate IT budget shifts, Rising PyPI operational and security costs (bandwidth, malware defense, 2FA), No access to capital markets funding as a non-profit, Key-person/volunteer risk with small core developer team, No geographic revenue diversification (70-80% US-sourced)

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report