Methodology
We check 12 things and link the source for every one of them. The weights below are ours and they are a judgement call, which is exactly why they are published. We never sell placement in a ranking. Public transparency score, not a product or security rating.
The 12 criteria and their weights
- Data processing agreementPublished commitments · weight 3 of 3
Without a published DPA you cannot review the contract before you talk to sales.
- Subprocessor listPublished commitments · weight 3 of 3
Naming the actual subprocessors is what turns a privacy promise into something you can check.
- Data location statedPublished commitments · weight 3 of 3
Where the data sits decides who can demand access to it and whether a transfer is one at all. It does not by itself decide which privacy law applies.
- Status page with historyPublished commitments · weight 2 of 3
A status page without past incidents tells you nothing about reliability.
- Public pricingPublished commitments · weight 2 of 3
Hidden pricing moves the first comparison into a sales call.
- Certifications namedPublished commitments · weight 1 of 3
Naming SOC 2 or ISO 27001 publicly is the low bar; not naming them is a signal.
- Uptime SLA with a figurePublished commitments · weight 1 of 3
"High availability" is marketing. "99.9 %" is a commitment.
- HTTPS enforced with HSTSMeasured behaviour · weight 2 of 3
We measure this ourselves on their own site. It is the cheapest security control there is.
- No third-party tracking before consentMeasured behaviour · weight 2 of 3
We load their front page and count third-party requests before anything is clicked.
- security.txt (RFC 9116)Measured behaviour · weight 1 of 3
It tells a researcher where to report a vulnerability instead of guessing.
- Notice before subprocessors changePublished commitments · weight 2 of 3
A list is a snapshot. Art. 28(2) GDPR gives you a right to object, and that needs advance notice.
- Named privacy contactPublished commitments · weight 1 of 3
"Contact us" is not a privacy contact. A named officer or a dedicated address is.
The score is the weighted share of criteria we found, out of 23 possible points. A criterion we could not measure falls out of both sides of that calculation, so it never counts against a vendor.
How to read the score with its weights and coverage in a procurement file is worked through step by step in how to use a SaaS transparency score in procurement.
The band on the label
Each vendor page carries a transparency label that shows the score as a band from A to F, the way an energy label does. The band is the score read coarsely, not a second judgement: the thresholds are fixed, they are the same for every category and every run, and this page reads them out of the code that draws the label.
| Band | Score |
|---|---|
| A | 85 to 100 |
| B | 70 to 84 |
| C | 55 to 69 |
| D | 40 to 54 |
| E | 25 to 39 |
| F | 0 to 24 |
A vendor without a score has no band either. Fewer than 9 measured criteria means no number and no letter, rather than a bad one.
What we quote, and why it does not change the score
Where a criterion is met, we also record what it says: the uptime figure on the SLA page, the certifications named on the trust page, the locations named next to the hosting wording, the notice period promised before a subprocessor changes, and the third-party hosts a front page loads before anyone clicks. Every one of them carries the sentence we read it from, the address we read it at, and the date. They are collected under Data.
None of it enters the score. The score is the 12 criteria and the weights above, and nothing else. That is not modesty, it is the same rule as everywhere on this site: a main parameter of a ranking has to be published together with its weight, and a detail that quietly counted would be a parameter this page does not name. A vendor that names six certifications does not outrank one that names one.
They are quotes, not verdicts. "Named on that page" is not "holds": we found the name, we did not see the certificate or audit anything. A figure we did not find is not a figure a vendor does not have, exactly as with the criteria themselves, and there is no page anywhere on this site listing vendors that lack something.
Two details are our own measurement rather than a quote: the HSTS header we read off their server, and the third-party hosts we watched a browser request. Those describe what we observed, and they say so.
Take the data
Everything on this site is also available as JSON, under /api/v1/. Six endpoints, read-only, no key needed: /api/v1/criteria, /api/v1/categories, /api/v1/categories/<slug>, /api/v1/vendors/<domain>, /api/v1/details and /api/v1/details/<key>. The data is CC BY 4.0; please link back to the vendor page you took a figure from.
There are no true/false fields in it. A result is found, not_found or not_measured, and not_found always carries the addresses we checked and the day we checked them. That is the same sentence as above, in a shape a program can read: a bare false would be a claim about the vendor, and this is a record of our measurement.
Not found is not the same as not measured
Not found means we reached the vendor’s site and did not find the document at any of the addresses we checked. Those addresses are listed on the vendor page, with what each one returned. It does not mean the vendor has no such document: it may sit behind a login, or at an address we did not check. That is why every result lists the addresses we checked and carries a correction link. A correction moves that vendor into our next nightly run. That run reads the same fixed addresses we check for every vendor, not the address you send.
Found, but behind a sign-in is its own result. It counts as not published openly, because that is what the criterion asks, but we say which it is. A vendor who has the document and shows it only to customers is in a different position from one where we found nothing.
Not measured means we could not look: the site did not answer, the vendor’s firewall blocked or rate-limited our crawler, or their robots.txt excludes us. That is a statement about us, not about them. It never counts against a vendor.
A vendor with fewer than 9 measured criteria gets no score and no rank at all, rather than a bad one.
If a vendor excludes our crawler
We honour robots.txt. A vendor who excludes us is not ranked and is not penalised for it: their entry says that we were excluded, and that is the end of it. Penalising someone for using a rule we ourselves respect would be absurd. See our crawler page.
How often we check
A full run visits every vendor in every category. The site only ever shows a run that finished. If a run breaks off halfway, you keep seeing the last complete one, because a half-finished run would put hundreds of vendors on “not found” for a fault on our side.
What we do not do
We do not collect user reviews, we do not aggregate anyone else’s ratings, and we have no opinion about whether a product is any good. We measure what a vendor publishes, and we link it.