Methodology 1.0
22 checks worth 100 points. A check that is found earns its full weight, partly found earns half, and not found in public pages earns nothing. Checks we could not run (blocked by robots.txt, past the page limit, or the site did not answer) are left out of the total. When more than 20 points could not be checked, the page shows Insufficient evidence instead of a grade.
Grades: A from 85, B from 70, C from 55, D from 40, F below 40.
Every finding that counts carries a quote of at most 300 characters from the page it came from. When a model reads a page, its quote must appear on that page word for word, or the finding is thrown out. Page text is treated as data; instructions written into a page are ignored.
Identity (20 points)
| Check | Points | Found when | How |
|---|---|---|---|
SAML or OIDC single sign-on id.sso | 10 | Docs or pricing state SAML or OIDC SSO Partly: SSO mentioned without naming SAML or OIDC | phrase rules, model reading with a verbatim quote |
SCIM provisioning id.scim | 6 | SCIM provisioning documented Partly: Automated user provisioning mentioned without SCIM | phrase rules, model reading with a verbatim quote |
Roles and permissions id.rbac | 4 | Roles or custom permissions documented | model reading with a verbatim quote |
Assurance (25 points)
| Check | Points | Found when | How |
|---|---|---|---|
SOC 2 Type 2 sec.soc2 | 10 | SOC 2 Type 2 claimed Partly: SOC 2 Type 1, or SOC 2 without a type | phrase rules, model reading with a verbatim quote |
ISO 27001 sec.iso27001 | 4 | ISO 27001 certificate claimed | phrase rules, model reading with a verbatim quote |
Trust center sec.trust_center | 5 | Trust page exists (own, or Vanta, Drata, SafeBase, Whistic, Conveyor) | file or provider check |
security.txt sec.security_txt | 2 | Valid /.well-known/security.txt (RFC 9116) Partly: security.txt present but missing Contact or Expires, or expired | file or provider check |
Public status page sec.status_page | 2 | Public status page | file or provider check |
Bug bounty or disclosure program sec.bug_bounty | 2 | Bug bounty or vulnerability disclosure program | phrase rules |
Data and AI terms (26 points)
| Check | Points | Found when | How |
|---|---|---|---|
No training on customer data data.no_training | 8 | Terms state customer data is not used to train models by default Partly: Training is opt-out, or the promise covers only some data | model reading with a verbatim quote |
Retention periods data.retention | 5 | Retention periods stated, including for AI inputs Partly: Retention periods stated, but not for AI inputs | model reading with a verbatim quote |
Subprocessor list data.subprocessors | 5 | Subprocessor list published, naming AI providers Partly: Subprocessor list published without AI providers | phrase rules, model reading with a verbatim quote |
Data processing agreement data.dpa | 4 | DPA available | phrase rules |
Data residency data.residency | 4 | Region choice (EU or other) offered | model reading with a verbatim quote |
Deployment (10 points)
| Check | Points | Found when | How |
|---|---|---|---|
Private deployment dep.private | 6 | VPC, BYOC, self-hosted or single-tenant option | model reading with a verbatim quote |
Customer-managed keys dep.byok | 4 | Customer-managed encryption keys | phrase rules, model reading with a verbatim quote |
Agent readiness (19 points)
| Check | Points | Found when | How |
|---|---|---|---|
Public API reference agent.api | 5 | Public API reference (OpenAPI spec or API docs) Partly: API mentioned, no public reference found | file or provider check |
Official MCP server agent.mcp | 6 | Official MCP server (docs, registry listing or well-known endpoint) | file or provider check, phrase rules |
Controls on AI agent actions agent.controls | 4 | Documented approvals, scopes or limits on AI agent actions | model reading with a verbatim quote |
Audit log export agent.audit | 2 | Audit log export documented Partly: Audit logs mentioned without export | phrase rules, model reading with a verbatim quote |
AI use policy agent.ai_policy | 2 | Published AI use or responsible AI policy | model reading with a verbatim quote |
Rate limits documented agent.rate_limits | shown, not scored | API rate limits documented (shown, unscored in v1) | phrase rules |
Changes
- 1.0 (2026-10-18): First public version: 22 checks, 100 points, five categories.
A new version is rescored for every company within 7 days. Score pages show both scores while that happens.