[01] STAGE · KNOWVERIFIED
Screen the vendor
125 AI and SaaS vendors scored across 28 public trust criteria, regional residency, and breach history.
WP-HOME-2026 · SMB & MID-MARKET · US · CANADA · EU125 VENDORS (68 AI · 57 SAAS)
GRC Intelligence Platform · Powered by the Vendor Trust Index
Stop trusting marketing badges. Verify the exact plan tier you’re buying.
The GRC intelligence platform for small and mid-market teams. Stop guessing plan-tier caveats—verify SOC 2 Type II, HIPAA BAA, and AI data training policies across US, Canadian, and EU frameworks with frozen, audit-ready workpapers.
[US MARKET]✓
SOC 2 Type II · HIPAA BAA · PHI
78 BAA paths mapped
[Canada MARKET]✓
PIPEDA · Law 25 · PHIPA
34 CA-residency vendors
[EU MARKET]✓
GDPR · EU AI Act · Art. 28 DPA
SCC & training clauses
100% independent · Human-verified sources · Vendors cannot pay for scores · Free SOC 2 kits · Not legal advice
WP-01 · The GRC Intelligence Loop
Enterprise-grade diligence for lean security & procurement teams.
Built for small and mid-market organizations operating in—or selling into—the US, Canada, and the EU. Four connected steps from initial vendor claim to a signed-off audit file.
[02] STAGE · CHECK TIERVERIFIED
Verify your contract tier
Test SOC 2, HIPAA/BAA, PIPEDA/Law 25, GDPR, and AI training rules on the exact tier you plan to buy.
[03] STAGE · PROVEVERIFIED
Freeze the workpaper
Export a timestamped, source-cited workpaper and vendor follow-up tickets ready for your audit file.
[04] STAGE · BUILDVERIFIED
Ship your own controls
Adopt free, ungated SOC 2 policies, RBAC matrices, and CC6 evidence checklists—zero forms or gates.
Total vendors indexed12568 AI & LLM tools + 57 enterprise SaaS
Scored with public evidence11568 in Trust Layer (/ai-check) · 57 core SaaS
HIPAA BAA posture38 +40 tier-cond.38 unconditional BAA · 40 tier-restricted · 34 CA residency
Compliance Kits & incidents11 kits · 156 incidents11 free SOC 2 kits · 9 buyer guides · 10 frameworks
WP-02 · Claimed vs. Evidenced
The Mid-Market Tier Cliff: what badge walls leave out.
Growing teams buy Pro, Team, or Business plans—not six-figure custom Enterprise agreements. Here is how top AI vendors split their compliance promises by tier.
| Vendor | What the badge wall claims | What tier evidence proves | Tier delta & workpaper |
|---|---|---|---|
| Anthropic (Claude) | [CLAIMED · UNSCOPED] SOC 2 Type II certified · HIPAA configurable | [EXTRACTED 1.0 · EVIDENCED] Claude Free, Pro, and Team cannot sign a BAA. Only Enterprise and qualifying API tiers have a BAA path. | |
| OpenAI (ChatGPT) | [CLAIMED · UNSCOPED] SOC 2 Type II · Enterprise-grade privacy | [EXTRACTED 1.0 · EVIDENCED] ChatGPT Free, Plus, Pro, and Team exclude HIPAA BAAs. Only ChatGPT Enterprise and eligible API orgs qualify. | |
| Cursor | [CLAIMED · UNSCOPED] SOC 2 Type II · Privacy Mode available | [EXTRACTED 1.0 · EVIDENCED] Seven of eight tiers (Free through Business) have no BAA path; BAA is Enterprise-only with Privacy Mode locked. |
OpenAI · Dec 2024
€15M GDPR fine — a first for generative AI
Italy's authority found ChatGPT trained on personal data without a legal basis or notice to consumers. A vendor's compliance posture is part of the buying decision.
OpenAI · surfaced Jul 2024
2023 breach disclosed to staff — never to the public
A hacker lifted AI design details from an internal forum in early 2023. Executives told staff and the board, but not customers or law enforcement.
Anthropic · Nov 2025
State-run espionage operated through Claude
A Chinese state-sponsored group ran a six-phase espionage operation via Claude Code against ~30 organizations. Platform-abuse risk is diligence, too.
WP-03 · Compliance Kits (/templates)2 kits live · Start of the library · 100% ungated
Pass customer diligence faster with free, ungated SOC 2 kits.
Selling into US, Canadian, or EU enterprise buyers? Don’t trade your email for a shallow two-page PDF. Our first 2 kits are complete operational packages published in the open.
KIT-01 · POLICY + WORKBOOKUNGATED · UPDATED 2026-10-28
Identity & Access Management
Free HIPAA Business Associate Agreement (BAA) Checklist & Template (2026)
Ungated HIPAA BAA checklist & template (45 CFR 164.504(e)): 10 mandatory clauses, breach notification SLAs, subcontractor flow-down, and AI training traps.
Included in this workpaper kit:
- Copy-paste SOC 2 IAM policy clauses
- Role matrix & RBAC vs. PAM decision table
- Joiner-Mover-Leaver (JML) SLA checklist
- User Access Review (UAR) 5-column workbook + 30-day runbook
Frameworks: HIPAA 45 CFR 164.504(E), HIPAA 45 CFR 164.314(A), HITECH ACT, HHS OCR BREACH NOTIFICATION RULE 45 CFR 164.410, SOC 2 CC9.2, ONTARIO PHIPA, CANADA PIPEDA, INDIA DPDP ACT 2023Open full kit (no form) →
KIT-02 · EVIDENCE EXTRACTIONUNGATED · UPDATED 2026-10-28
CC6 Logical Access Evidence
Free SOC 2 Business Continuity & Disaster Recovery Plan Template (No Email)
Ungated SOC 2 business continuity and disaster recovery plan template with RTO/RPO table, backup requirements, test schedule, and A1.2-A1.3 evidence.
Included in this workpaper kit:
- Exact Google Workspace & Slack exports auditors sample
- API endpoints, population queries, and sample-size table
- IPE (Information Produced by Entity) completeness checks
- Google Workspace retention cliff & extraction runbook
Frameworks: SOC 2 A1.1-A1.3, SOC 2 CC9.1, ISO/IEC 27001:2022 A.5.29-A.5.30, HIPAA 45 CFR 164.308(A)(7), NIST SP 800-34, INDIA DPDP ACT 2023Open full kit (no form) →
KIT-03UNGATED · UPDATED 2026-10-28
Change Management Policy
Free SOC 2 Change Management Policy Template (Copy-Paste, No Email)
Ungated SOC 2 change management policy template (CC8.1): CI/CD gates, branch protection, peer review, emergency hotfixes, rollback, and audit evidence.
Frameworks: SOC 2 CC8.1, SOC 2 CC6.1, SOC 2 CC7.1, AICPA TRUST SERVICES CRITERIA, ISO/IEC 27001:2022 A.8.32, A.8.25, NIST SP 800-53 CM-3, NIST SSDF SP 800-218Open full kit (no form) →
KIT-04UNGATED · UPDATED 2026-10-28
Incident Response Plan
Free SOC 2 Incident Response Plan Template (No Email)
Ungated SOC 2 incident response plan template with severity levels, roles, breach notification timelines, tabletop record, and CC7.3-CC7.5 evidence.
Frameworks: SOC 2 CC7.2-CC7.5, SOC 2 CC2.2-CC2.3, ISO/IEC 27001:2022 A.5.24-A.5.28, NIST SP 800-61R2, HIPAA 45 CFR 164.308(A)(6), GDPR ART. 33-34, INDIA CERT-IN & DPDP ACTOpen full kit (no form) →
KIT-05UNGATED · UPDATED 2026-10-28
Information Security Policy
Free SOC 2 Information Security Policy Template (Copy-Paste, No Email)
Ungated SOC 2 information security policy template mapped to CC1-CC9: governance roles, data classification, encryption, exceptions, and audit evidence.
Frameworks: SOC 2 CC1.1-CC9.2, AICPA TRUST SERVICES CRITERIA, ISO/IEC 27001:2022 A.5.1, NIST CSF 2.0, HIPAA 45 CFR 164.316, CANADA PIPEDA, INDIA DPDP ACT 2023Open full kit (no form) →
KIT-06UNGATED · UPDATED 2026-10-28
Password and MFA Policy
Free SOC 2 Password & MFA Policy Template (NIST 800-63B Aligned)
Ungated SOC 2 password and MFA policy template (CC6.1): NIST SP 800-63B rules, FIDO2/WebAuthn MFA, service account secrets, and IdP evidence.
Frameworks: SOC 2 CC6.1, SOC 2 CC6.6, SOC 2 CC6.7, AICPA TRUST SERVICES CRITERIA, NIST SP 800-63B REV. 4, ISO/IEC 27001:2022 A.5.17, A.8.5, HIPAA 45 CFR 164.312(D)Open full kit (no form) →
KIT-07UNGATED · UPDATED 2026-10-28
Readiness Checklist
Free SOC 2 Readiness Checklist (Audit Checklist, No Email)
Ungated 5-phase SOC 2 readiness checklist: scoping, policies, CC1-CC9 controls, PBC evidence table, US/Canada/India audit costs, and PDF/Excel downloads.
Frameworks: SOC 2 CC1-CC9, AICPA TRUST SERVICES CRITERIA, ISO/IEC 27001:2022, HIPAA SECURITY RULE, CANADA PIPEDA, INDIA DPDP ACT 2023Open full kit (no form) →
KIT-08UNGATED · UPDATED 2026-10-28
Risk Assessment
Free SOC 2 Risk Assessment Template (Risk Register, Scoring, No Email)
Ungated SOC 2 risk assessment template (CC3.1-CC3.4): 5x5 scoring matrix, 12-item SaaS & AI risk register, fraud risk analysis, and treatment plan.
Frameworks: SOC 2 CC3.1-CC3.4, AICPA TRUST SERVICES CRITERIA, NIST SP 800-30 REV. 1, ISO/IEC 27005, ISO/IEC 27001:2022 6.1.2, HIPAA 45 CFR 164.308(A)(1), CANADA LAW 25, INDIA DPDP ACTOpen full kit (no form) →
KIT-09UNGATED · UPDATED 2026-10-28
Vendor Management Policy
Free SOC 2 Vendor Management Policy Template (Copy-Paste, No Email)
Ungated SOC 2 vendor management policy template (CC9.2): Tier 1-4 risk matrix, HIPAA BAA & GDPR DPA checklist, annual review, and offboarding.
Frameworks: SOC 2 CC9.2, SOC 2 CC3.2, AICPA TRUST SERVICES CRITERIA, ISO/IEC 27001:2022 A.5.19-A.5.23, NIST CSF 2.0 GV.SC, HIPAA 45 CFR 164.308(B), CANADA PIPEDA, INDIA DPDP ACT 2023Open full kit (no form) →
KIT-01 · POLICY + WORKBOOKUNGATED · UPDATED 2026-10-12
Identity & Access Management
Free SOC 2 Identity & Access Management (IAM) Policy Template
Skip the demo request. Copy-paste our ungated SOC 2 Identity and Access Management (IAM) policy. Includes CC6.1-CC6.8 clauses, Excel UAR, & JML checklist.
Included in this workpaper kit:
- Copy-paste SOC 2 IAM policy clauses
- Role matrix & RBAC vs. PAM decision table
- Joiner-Mover-Leaver (JML) SLA checklist
- User Access Review (UAR) 5-column workbook + 30-day runbook
Frameworks: SOC 2 CC6.1-CC6.8, CIS V8.1 CONTROLS 5-6, NIST SP 800-63B-4, DORA ICT RTS, ISO/IEC 27001:2022 ANNEX AOpen full kit (no form) →
KIT-02 · EVIDENCE EXTRACTIONUNGATED · UPDATED 2026-09-30
CC6 Logical Access Evidence
SOC 2 CC6 Evidence Checklist: What to Export from Google Workspace and Slack
The SOC 2 CC6 evidence auditors actually sample: exact exports, API fields, Google's 6-month log ceiling, IPE rules, Python extraction scripts, and RACI.
Included in this workpaper kit:
- Exact Google Workspace & Slack exports auditors sample
- API endpoints, population queries, and sample-size table
- IPE (Information Produced by Entity) completeness checks
- Google Workspace retention cliff & extraction runbook
Frameworks: SOC 2 CC6.1-CC6.8, SOC 2 CC7.2, AICPA TRUST SERVICES CRITERIA, NIST SP 800-63B-4, CIS CONTROLS V8.1, ISO/IEC 27001:2022 ANNEX AOpen full kit (no form) →
WP-04 · Interactive GRC Knowledge Graph & Proof of Depth
Traverse 125 vendor dossiers, US/CA/EU frameworks, and SOC 2 kits as one connected graph.
Every edge is tagged [EXTRACTED] from primary vendor artifacts or [TIER-GATED] by plan rules. Click any node or trace a shortest path from a vendor plan tier to a regulatory requirement or compliance kit.
GRAPHIFY // VTI GRC KNOWLEDGE GRAPH11 Hubs · 15 Edges · 4 Leiden Communities
[EXTRACTED 1.0] Solid[INFERRED 0.85–0.95] Dashed
Trace path:
$
✕ BLOCKED ON TEAM TIERgraphify path "Anthropic" "US · SOC 2 & HIPAA" --tier=teamSHORTEST-PATH AUDIT TRACE3 HOPS · DETERMINISTIC GRAPH
3 hops across C1 → C0 → C2: Anthropic scores 88/A overall, but selecting Claude Team hits the Mid-Market Tier Cliff ([EXTRACTED 1.0]: baaEligible=false), blocking US HIPAA PHI.
NODE INSPECTOR · graphify explainDEGREE: 11
C0 · Tier Verdict Engine (/ai-check)★ GOD NODE (CENTRAL HUB)
Trust Layer Engine (/ai-check)
Source:
lib/analyzer/engine.ts · analyzeStack()Central God Node (degree 11). Evaluates 68 AI vendor tier profiles across 5 plan tiers and 5 compliance checks to freeze a timestamped, source-cited audit workpaper.
Connected Edges (6):
- [triggers_tier_cliff_flag]EXTRACTED 1.00
- [clears_with_rider]EXTRACTED 1.00
- [evaluates_baa_phi_cuec]EXTRACTED 1.00
- [checks_ca_residency_law25]INFERRED 0.95
- [verifies_dpa_training_optout]EXTRACTED 1.00
- [remediates_internal_iam]INFERRED 0.85
Cohesion: 0.84 · Zero LLM hallucinationLaunch Trust Layer (/ai-check) →
125 Vendors (68 AI · 57 SaaS)
The Vendor Index
125 total vendors (68 AI tools and 57 enterprise SaaS platforms) scored on 28 public trust criteria with cited evidence trails and side-by-side comparisons.
9 Buyer Guides · 5 Topic Hubs
Buyer & Regulatory Guides
Plain-language field guides written for security, legal, and procurement teams—covering SOC 2 Type II, HIPAA BAAs, Canadian residency (PIPEDA/Law 25), and EU AI Act audits.
Browse all buyer guides →SOC 2: Type 1 vs 2, criteria, cost, timelines, bridge letters, exceptions.HIPAA for builders: BAAs, Security Rule, cloud, AI, and what compliance actually requires.Vendor & third-party risk: Questionnaires, tiering, trust centers, breach response.Canada: PIPEDA, Quebec Law 25, PHIPA, OSFI B-10, CCCS, data residency.AI & security: Using LLMs with PHI, AI vendor due diligence, ISO 42001, NIST AI RMF.
10 Reference Rulebooks
Compliance Frameworks & Crosswalks
What each attestation or statute actually demands, who audits or enforces it, what artifact you should request, and which vendors in the Index hold it.
Recently verified vendor dossiers
LIVE SAMPLE · 6 OF 125 PROFILES
Calendly
scheduling · verified 2026-10-18
—
VTI SCORE—Not Enough Evidence
Evidence coverage25%
Signals reviewed10public evidence items
Methodologyv1.1verified by Vendor Trust Index Research Desk
✓ SOC 2 Type II current○ BAA not confirmed
Evidence trail available on profileOpen full dossier
Canva Enterprise
collaborative design · verified 2026-10-18
—
VTI SCORE—Not Enough Evidence
Evidence coverage25%
Signals reviewed11public evidence items
Methodologyv1.1verified by Vendor Trust Index Research Desk
✓ SOC 2 Type II current○ BAA not confirmed
Evidence trail available on profileOpen full dossier
Character.AI
ai · verified 2026-10-18
—
VTI SCORE—Not Enough Evidence
Evidence coverage0%
Signals reviewed5public evidence items
Methodologyv1.1verified by Vendor Trust Index Research Desk
○ SOC 2 unclear○ BAA not confirmed
Evidence trail available on profileOpen full dossier
ClickUp
collaboration · verified 2026-10-18
—
VTI SCORE—Not Enough Evidence
Evidence coverage21%
Signals reviewed10public evidence items
Methodologyv1.1verified by Vendor Trust Index Research Desk
✓ SOC 2 Type II current~ BAA conditional on tier
Evidence trail available on profileOpen full dossier
Datadog
observability and security · verified 2026-10-18
—
VTI SCORE—Not Enough Evidence
Evidence coverage29%
Signals reviewed10public evidence items
Methodologyv1.1verified by Vendor Trust Index Research Desk
✓ SOC 2 Type II current✓ BAA available
Evidence trail available on profileOpen full dossier
Intercom
customer messaging · verified 2026-10-18
—
VTI SCORE—Not Enough Evidence
Evidence coverage21%
Signals reviewed10public evidence items
Methodologyv1.1verified by Vendor Trust Index Research Desk
✓ SOC 2 Type II current~ BAA conditional on tier
Evidence trail available on profileOpen full dossier
WP-05 · ADVISORY WALKTHROUGH · 30 MINPROVIDER: CALENDLY · ZERO-PIXEL FACADE
Direct GRC & Diligence Briefing
30-Minute GRC & Vendor Diligence Walkthrough
For small and mid-market teams based in—or selling into—the US, Canada, and the EU. Walk through a live vendor tier check, review a frozen audit workpaper for your stack, or scope how our free SOC 2 Compliance Kits fit your upcoming audit window.
- 01Run a live tier-aware check on 1–2 AI or SaaS vendors against US (SOC 2 / HIPAA), Canadian (PIPEDA / Law 25), or EU (GDPR) requirements
- 02Inspect how frozen workpapers and vendor follow-up tickets file into a lean SMB or mid-market audit trail
- 03Map our free SOC 2 IAM & CC6 evidence kits to your current observation period
[PRIVACY] Zero tracking pixels on page load. Clicking 'Load live calendar' connects directly to our scheduling provider (Calendly) in an isolated frame.
SCHEDULER STANDBY (NO THIRD-PARTY SCRIPTS LOADED)30 MIN
Ready when you are
We block third-party calendar scripts on initial load so your visit stays private and fast. Click below to initialize the interactive booking calendar.
ENDPOINT: https://calendly.com/securityvendortrustindex/30minNO COOKIES BEFORE CLICK
A clearer standard for vendor trust
Scores are useful. Cited evidence and tier context make them safe to use.
Vendors cannot pay to alter a score, remove an incident, or gate a template. Read the public methodology behind our grades, evidence multipliers, and workpaper verification rules. Not legal or compliance advice.
