Methodology
Trust Signal Directory starts from public, reviewable evidence rather than unverifiable claims. The goal is to explain what can be seen, what changed, and how much interpretation risk should be carried with that observation.
Related methodology
These policy pages define how candidate discovery, official sources, source scope, and public rendering boundaries are handled before evidence appears on public profiles, snapshots, comparisons, or matrices.
Explains which sources may be used to discover candidate companies, which official public sources qualify for evidence classification, and what should not be inferred from third-party listings.
Explains how product-specific, parent-vendor, acquisition or redirect, hub-referenced, and review-required evidence is labeled before public rendering.
A company or product appearing in a public directory is not itself a trust signal. Evidence status and signal role are assigned only after official public sources are reviewed.
Discovery sources and source-scope labels do not support claims about buying intent, compliance posture, procurement pressure, vendor risk, or customer assurance workload.
Section 1
The directory begins with public evidence that another reviewer can inspect directly. That includes trust pages, security pages, privacy documents, legal terms, public careers pages, product pages, changelogs, and public announcements when they are relevant to trust and enterprise-readiness context.
Every observation should point back to a public source page or announcement that can be checked independently.
Signals become stronger when the same evidence surface is observed repeatedly and changes can be compared.
The site documents public evidence surfaces and interpretation, not private assumptions about pipeline status or internal deal motion.
Section 2
Each reviewed evidence item can be described with a consistent object so interpretation stays grounded and auditable.
Section 3
These labels describe the strength and timing basis of public evidence. They are not compliance ratings, buying intent claims, or vendor recommendations.
A public trust, security, privacy, legal, or enterprise-readiness surface is currently observable, but the directory is not making a timing or recent-change claim.
The observed public evidence may indicate trust, compliance, privacy, security, AI governance, or enterprise-readiness activity, but it remains an interpretive signal rather than a confirmed change.
A public source contains dated update language, such as a trust center update, report availability date, framework certification date, or subprocessor update. This does not mean the directory has verified the full historical first-seen / last-absent change window.
Reserved for cases where historical review supports a change window, such as previous public absence and later public presence, dated source history, archive comparison, or another reviewable timing basis.
Section 4
Evidence status describes what is publicly observable. Signal strength describes the density or intensity of a public evidence pattern. Signal role describes how the evidence should be interpreted. None of these labels claim that a company is buying, non-compliant, under procurement pressure, or seeking a vendor.
Evidence status stays close to the record. It describes whether the site is showing a current public baseline, a candidate signal, or a more verified timing claim.
Signal strength describes how concentrated or meaningful a pattern may be after review. Stronger public evidence can still be late, routine, or commercially ambiguous.
Signal role explains how the evidence should be interpreted on the public site without exposing private scoring, buyer mapping, or recommended actions.
These public labels keep interpretation conservative. They help readers understand signal role without exposing internal GTM scoring or action logic.
Section 5
A page existing is not always a signal. The directory looks for evidence changes, evidence gaps, combinations of signals, and timing. A new DPA page, for example, may matter more if it appears alongside a new subprocessor page and enterprise security feature updates than if it appears on its own without supporting context.
New pages, revised dates, or changed statements can be more informative than static presence alone.
Missing trust surfaces in expected areas can also shape interpretation, especially for enterprise-facing vendors.
Multiple related changes often carry more meaning than a single isolated update.
Section 6
The directory is designed to be useful without overstating what a public page means. These examples show why caution matters.
A generic security page may be marketing copy only and not evidence of new enterprise-readiness work.
A privacy policy date change may reflect legal maintenance rather than buying intent or procurement pressure.
A Trust Center may indicate post-purchase maturity or a broader compliance program, not necessarily a new near-term motion.
A SOC 2 page may mean the company is already past the readiness stage rather than newly entering it.
Section 7
The public directory reviews sources that are meant to be public and avoids private, personal, or non-public collection methods.
