Vendor assessment: published, promised, verified

That a vendor publishes a data-processing agreement, a subprocessor list, a security page or a supported-countries page at a given URL is checkable: you fetch it, hash it, date it. What the page says — that customer data is not used for training, that a region is offered, that logs are retained for thirty days — is a claim about content, and reproducing it as your own fact means adopting a statement you did not verify.

This site keeps the two apart and shows the state plainly: documents retrieved, claim pending review, verified. Copy that into your own assessments. The value you add is knowing which of your statements is which.

A marketing page is not a commitment. A data-processing agreement, the terms in force for the plan the customer is on, and the documents those incorporate are what bind. Plan matters: the same vendor commonly offers materially different terms on a consumer tier and an enterprise agreement, and a deployment scoped against the wrong one is scoped against nothing.

When this site assesses a hosted assistant it does so against a written agreement, documented residency, a written no-training term, a retention and deletion path, and audit logging with single sign-on. Those five are a serviceable checklist for any vendor.

Half of a good assessment is the list of things you could not establish. A row that says “not stated in any published document; asked on 3 March; no answer yet” is more useful than a confident guess, and it is the row that gets the vendor to respond.

Never write zero, “none” or “not applicable” where you mean unknown. This site refuses to print a price it has not read for the same reason: an invented number is indistinguishable from a real one once it is in a document.