The data behind the scores
A score tells you how much a vendor publishes. This tells you WHAT. Every entry below is a figure or a name we read off their own page, with the sentence it stands in and the date we read it.
These are quotes, not verdicts. "Named on that page" is not the same as "holds": we found the name, we did not audit the certificate. None of this changes a transparency score, which is computed from the 12 criteria and their published weights alone. How the score works.
Certification named
Which vendors name this certification on a public page?
15 values with enough vendors to have a page. We could measure this on 4768 vendors, under Certifications named.
- ISO/IEC 27001 281
- SOC 2 Type II 224
- SOC 2 197
- HIPAA 100
- PCI DSS 83
- ISO/IEC 27017 39
Hosting location named
Which vendors name this location when they say where the data sits?
15 values with enough vendors to have a page. We could measure this on 4731 vendors, under Data location stated.
- United States 318
- European Union 114
- European Economic Area 102
- Canada 45
- Germany 41
- Australia 38
Uptime figure
Which vendors name this as the highest uptime figure on their SLA page?
3 values with enough vendors to have a page. We could measure this on 4685 vendors, under Uptime SLA with a figure.
Subprocessor named
Whose subprocessor list names this provider?
21 values with enough vendors to have a page. We could measure this on 4717 vendors, under Subprocessor list.
- Amazon Web Services 73
- Salesforce 41
- Slack 38
- Twilio 37
- Google Cloud 31
- HubSpot 29
Subprocessor notice period
Which vendors promise this much notice before a subprocessor changes?
1 value with enough vendors to have a page. We could measure this on 4348 vendors, under Notice before subprocessors change.
- 30 days 11
Privacy contact
Which vendors publish this kind of privacy contact?
2 values with enough vendors to have a page. We could measure this on 4369 vendors, under Named privacy contact.
Third-party host on first load
Whose front page loads this third party before anyone clicks?
224 values with enough vendors to have a page. We could measure this on 4999 vendors, under No third-party tracking before consent.
- googletagmanager.com 1127
- gstatic.com 720
- googleapis.com 662
- google.com 661
- doubleclick.net 539
- google-analytics.com 431
A value gets a page once 8 vendors carry it. Below that the page would be thin, and a thin page tells a search engine not to trust the rest.