What we check, and who passes
12 things a buyer needs before signing. Each one has its own page with every vendor we measured and the source for each result.
Latest measurement: 2026-10-30.
- Data processing agreement Without a published DPA you cannot review the contract before you talk to sales. 11% 885 of 8297 publish it
- Subprocessor list Naming the actual subprocessors is what turns a privacy promise into something you can check. 7% 569 of 8286 publish it
- Data location stated Where the data sits decides who can demand access to it and whether a transfer is one at all. It does not by itself decide which privacy law applies. 29% 2449 of 8309 publish it
- Status page with history A status page without past incidents tells you nothing about reliability. 16% 1368 of 8388 publish it
- Public pricing Hidden pricing moves the first comparison into a sales call. 39% 3197 of 8298 publish it
- Certifications named Naming SOC 2 or ISO 27001 publicly is the low bar; not naming them is a signal. 24% 2028 of 8358 publish it
- Uptime SLA with a figure "High availability" is marketing. "99.9 %" is a commitment. 3% 277 of 8226 publish it
- HTTPS enforced with HSTS We measure this ourselves on their own site. It is the cheapest security control there is. 62% 5438 of 8771 publish it
- No third-party tracking before consent We load their front page and count third-party requests before anything is clicked. 6% 547 of 8729 publish it
- security.txt (RFC 9116) It tells a researcher where to report a vulnerability instead of guessing. 11% 930 of 8088 publish it
- Notice before subprocessors change A list is a snapshot. Art. 28(2) GDPR gives you a right to object, and that needs advance notice. 10% 799 of 8230 publish it
- Named privacy contact "Contact us" is not a privacy contact. A named officer or a dedicated address is. 36% 2964 of 8261 publish it