Scoring
Every category has its own rubric
A case-intake workflow and an AI inventory are not scored with the same questions, so each category carries its own fixed set. A score is only comparable with another score from the same rubric.
3 published rubrics · recalculated 13 November 2026
Rubrics by category
Ethics and compliance tools
How ethics and compliance tools are scored
Twenty-five questions across five areas, answered only from pages the vendor publishes. A score says how much of the rubric the published facts support, not whether the product is good.
- Questions
- 25
- Maximum
- 100 points
- Entries
- 15
- Edition
- 2026.11
AI governance
How AI governance tools are scored
Twenty-five questions across inventory, risk, controls, evidence and lifecycle oversight. Every AI governance entry is scored against the same set, from public vendor pages only.
- Questions
- 25
- Maximum
- 100 points
- Entries
- 8
- Edition
- 2026.11
Supply-chain due diligence
How supply-chain due diligence tools are scored
Twenty-five questions across supplier records, risk assessment, grievances, evidence and oversight. Each entry is scored from the vendor's public product and documentation pages, against the same set.
- Questions
- 25
- Maximum
- 100 points
- Entries
- 9
- Edition
- 2026.11
Rules that apply to every category
- The questions are written down before a platform is scored. They are not added to or reweighted to move a result.
- Every answer points back to a page the vendor publishes. The source list on each profile is the evidence behind the score.
- If a page gives no answer, the criterion earns nothing and is flagged as not found rather than treated as a failure.
- No vendor can pay for a listing, a position or a review. There is no paid placement and no affiliate revenue here.
- A vendor can challenge any score. If the evidence supports the challenge, the score and the review date change; if it does not, the cited evidence stays.
- Each score belongs to a dated version of its rubric. Change the questions and the affected entries are rescored and recorded as a new version.
A score compares published evidence. It is not a compliance certificate and does not replace checking the vendor's contract, security pack and current configuration.