How we score vendors

Every Vendor Watch scorecard is an opinion and analysis of a vendor's public documents — an editorial assessment of privacy policies, terms, DPAs, sub-processor lists, and security pages. Findings cite those documents and carry an as-of date. A scorecard is not legal advice and not a safety verdict.

The scale: 0-100, lower = better

Scores run from 0 to 100 where lower is better. A lower score means the public documents we read had fewer concerning clauses. A higher score means they had more.

Eight categories each start at a neutral 50. A good-practice finding moves that category down. A red-flag finding moves it up. Each finding the model proposes includes a quote from a document we fetched. The scorecard shows that quote. Code computes the number.

If a category is not addressed in the documents we fetched, that category scores 80. That is the score for a category the fetched documents do not address. We do not invent a clause to fill the gap.

Four headline scores are published: overall, privacy, security, and compliance. The bands below are on the overall score. The name stored with the analysis is in parentheses. The public page uses the score-band label.

• Low score band (stored as low): overall 0-33
• Elevated score band (stored as medium): overall 34-66
• High score band (stored as high): overall 67-100

Evidence and as-of dating

Every scored finding is tied to a specific quoted passage from a page we fetched. The as-of date is the date that analysis completed: the crawl those scores describe. Findings are dated observations about those pages. When a later crawl is scored, the as-of date moves with it.

We look for six document types: privacy policy, terms, cookie policy, data processing agreement, security page, and sub-processor list. A type we did not fetch is not found. It stays absent. We do not create a document, a quote, or a certification to stand in for it.

Certifications

The scorer can record only three names, and only when a fetched document names them: ISO 27001, SOC 2, and the EU-US Data Privacy Framework. Silence is not a certification. The scorer does not record GDPR, CCPA, HIPAA, or PCI DSS as certifications. An empty framework list means nothing was recorded. It does not mean the vendor holds those frameworks, and it does not mean the vendor lacks them.

Limitations

Scores reflect what a vendor publishes on the date analyzed. Documents change. Scorecards are re-analyzed on a cadence and on detected change, and the as-of date updates when they do. To dispute a finding or request a correction, use the publication policy or email support@vendorwatch.co.