How good our own measurement is
We measure vendors on what they publish. This page measures us: how often a finding on this site is right, how often it is not, and which kinds of mistake we know about.
Measured against 461 published findings read by hand on 11 September 2026. Classifier v2-2026-09-11.
Precision and recall
Precision answers the reader's question: when a vendor appears on a value page, how often does it belong there? Recall is the counter-question, and it belongs next to it – a classifier that rejects everything would have perfect precision and no findings at all.
| What we read | Checked by hand | Precision | Recall | Before v1-2026-09-04 |
|---|---|---|---|---|
| Hosting location named | 264 | 97.6 % | 86.0 % | 73.1 % |
| Certification named | 197 | 97.1 % | 90.5 % | 74.6 % |
The last column is the same measurement against the same 461 findings, run against the classifier as it stood before 11 September 2026. Every fourth published finding was wrong.
Which extractors this covers, and which it does not
The hand-read set covers 2 of the 10 kinds of detail we publish: Certification named and Hosting location named. For the others there is no figure here, and we do not print an estimate. An estimated accuracy would be the same offence as an unsourced finding about a vendor.
Error classes that still get through
These are findings we read by hand, judged wrong, and that the classifier still lets past. They are listed because a known gap someone can check beats a clean-looking page.
| Class | Where | In the set | Example |
|---|---|---|---|
| anschrift | Hosting location named | 2 | This is particularly the case for our maintenance and support activities (MEGA Group) and for the hosting of our SaaS services (by Microsoft Ireland O |
| definition | Hosting location named | 1 | this document to the European Union include all current member states to the European Union and the European Economic Area. 1. Cookie Cookies are Trac |
| firmensitz | Hosting location named | 1 | aMember Membership and subscription management platform USA (assumed) AWS Cloud infrastructure and hosting services Global (notably USA, Europe, Asia- |
| navigation | Certification named | 2 | on Case Studies Compliance NIS2 NIST CSF 2.0 CIS Controls GDPR CMMC DORA FERPA PCI DSS v4.0.1 HIPAA HITRUST CJIS Controls In the recent MITRE ATT&CK E |
| dienstleister | Certification named | 1 | ntrols: AWS adheres to multiple security and compliance frameworks and standards , including HIPAA, HITRUST, SOC, ISO, PCI and DSS. |
| infrastruktur | Certification named | 1 | S data centers undergo regular security and compliance audits including SOC1 and SOC2, PCI Level 1, HITRUST, ISO27001 and are GDPR compliant. |
Error classes we now catch
| Class | Caught in the set |
|---|---|
| ausserhalb | 17 |
| ohne-anspruch | 13 |
| anschrift | 11 |
| firmensitz | 9 |
| personen | 9 |
| navigation | 8 |
| ohne-ort | 8 |
| definition | 7 |
| dienstleister | 6 |
| frage | 5 |
| recht | 5 |
| in-arbeit | 4 |
| anlehnung | 3 |
| verneint | 3 |
| infrastruktur | 2 |
| rahmenwerk | 2 |
| unbestimmt | 1 |
What this means for the live data
Every stored finding is re-read against its own quote. If the sentence we kept does not carry the finding – a question, a negation, a definition, the opposite – the row stays on the vendor profile with its source and counts in no list, no figure and no requirement page.
| What we read | Findings held | Not counted |
|---|---|---|
| Third-party host on first load | 95,466 | 0 |
| HSTS max-age | 5,552 | 0 |
| Certification named | 5,531 | 2,758 |
| HSTS option | 4,361 | 0 |
| Privacy contact | 3,848 | 0 |
| Subprocessor named | 3,478 | 0 |
| Hosting location named | 2,994 | 116 |
| security.txt expiry | 682 | 0 |
| Uptime figure | 278 | 0 |
| Subprocessor notice period | 127 | 0 |
122,317 findings in the current snapshot, 2,874 of them not counted.
How old the measurements are
A fresh figure and an old one look the same. We do not remeasure every vendor every night: a run covers part of the catalogue, so some results stand for a while. The oldest column is the one to read before a procurement decision.
| Criterion | Results | Newest (days) | Oldest (days) |
|---|---|---|---|
| Data location stated | 8,633 | 0 | 12 |
| Data processing agreement | 8,633 | 0 | 12 |
| Public pricing | 8,633 | 0 | 12 |
| security.txt (RFC 9116) | 8,633 | 0 | 12 |
| Uptime SLA with a figure | 8,633 | 0 | 12 |
| Status page with history | 8,633 | 0 | 12 |
| Subprocessor list | 8,633 | 0 | 12 |
| No third-party tracking before consent | 8,633 | 0 | 12 |
| HTTPS enforced with HSTS | 8,633 | 0 | 12 |
| Certifications named | 8,633 | 0 | 12 |
| Named privacy contact | 8,631 | 0 | 11 |
| Notice before subprocessors change | 8,631 | 0 | 11 |
Open corrections
0 corrections submitted and not yet worked through. Tell us about a wrong entry. A correction moves that vendor into our next nightly run. That run reads the same fixed addresses we check for every vendor, not the address you send.
What changed, and when
- v2-2026-09-11 – sentence scope, polarity and subject. A finding is dropped from every list when its own quote is a question, a negation, a definition, an announcement, a statement about someone else, a postal address, a company seat, a law, or a transfer framework.
- v1-2026-09-04 – a certification quote gained a subject: the vendor, their data centres, a named provider, or unclear. Only the first is aggregated.
- Transparency score v1 is frozen and unaffected by any of this. A detail has never entered the score.