Risk methodology

1. Why we publish this

A risk score is only useful if a compliance officer, auditor, or insurer can verify how it was reached. Black-box scores get rejected in formal reviews. Everything below is deterministic and reproducible from the inputs we list — re-running the scan on the same tool with the same privacy-policy text yields the same number.

2. What goes in

The scorer takes five inputs per tool, all already in your inventory:

• URL — used to derive the registered domain (e.g. openai.com).
• Vendor name — used to match against the enterprise / high-risk vendor lists below.
• Category — one of writing, coding, image, video, audio, data, search, agents, chat, moderation, embeddings, other.
• Description — the free-text description on the inventory item.
• Privacy policy text — best-effort fetch from the tool's public site (see §4).

That is the complete list. The scan does not see your prompts, your users, your usage volume, your other tools, or anything outside the single inventory row being scanned.

3. What does NOT go in

• No LLM call. The scorer is pure rules. There is no prompt, no model, no third-party AI provider.
• No customer data. The scan does not read content created in your AI tools or stored anywhere outside the inventory row.
• No telemetry from your users. Browser activity, identity-provider logs, and content traffic are not inputs.
• No external risk feeds. We do not subscribe to a third-party risk-intelligence service for this score.

4. The privacy-policy fetch

For each tool we attempt to fetch the public privacy policy from the tool's own domain — only that domain, never an arbitrary URL. We try, in order: /privacy, /privacy-policy, /legal/privacy, /terms. The first response that returns at least 200 characters of readable text is used.

• 3-second timeout per attempt.
• Maximum 200 KB read; the body is truncated past that.
• Maximum 2 redirects followed.
• SSRF guard rejects requests to private/loopback addresses.
• Result is cached for 30 days per domain.

If the policy cannot be fetched (timeout, blocked, missing) the scan still completes — it relies on the rest of the inputs and the report is flagged with privacy_policy_fetched: false.

5. The five dimensions

Every tool is scored on five independent dimensions. Each dimension starts at a fixed base score and is adjusted by signals matched in the inputs above. Scores are clamped to 0–100. Mapping to a level:0–34 = low, 35–64 = medium, 65–100 = high.

5.1 Data retention — weight 20%, base 40

How long the vendor stores user data after submission.

• Lower (less risk) when: vendor is on the enterprise list (−20), domain is on the enterprise list (−15), domain is in the EU (−10), category is code (−10), text mentions data deletion / stateless processing.
• Higher (more risk) when: vendor is high-risk (+30) or consumer (+15 / +25), category is image/video/audio (+15), text contains "indefinitely" or "as long as", free-tier signals are present (+10).

5.2 Third-party sharing — weight 20%, base 30

Likelihood of data being shared with advertisers, partners, or brokers.

• Lower when: enterprise vendor (−15), EU domain (−8), policy mentions "we do not sell" / "never sell" / "not shared".
• Higher when: high-risk vendor (+40), medium-risk vendor (+20), consumer domain (+25), policy mentions "sell your data", "data broker", "advertising partners", "marketing partners", free tier (+12).

5.3 GDPR compliance — weight 25%, base 50

Evidence of GDPR-aligned controls and certifications.

• Lower when: enterprise vendor (−25), enterprise domain (−20), EU domain (−18), policy mentions SOC 2 Type II, ISO 27001, GDPR, DPA, SCCs, EU data centre, EU residents.
• Higher when: high-risk vendor (+25), high-risk domain (+20), free tier (+8), policy contains US-jurisdiction indicators (Delaware, California, "Inc.", "LLC") — each adds a small increment.

5.4 Trains on data — weight 25%, base 25

Whether user inputs may be used to train AI models.

• Lower when: enterprise vendor (−15), EU domain (−8), category is code (−10), policy says "not used to train", "never used to train", "zero data retention", "opt out of training".
• Higher when: high-risk vendor (+25), category is image/video/audio (+15), free tier (+18), policy contains "trains on your", "used to train", "improve our model", "learn from your data".

5.5 Security certifications — weight 10%, base 55

Formal security posture and named certifications.

• Lower when: enterprise vendor (−30), enterprise domain (−20), EU domain (−8), policy mentions SOC 2 Type II, ISO 27001, penetration testing, bug bounty, end-to-end encryption, encryption at rest, MFA / 2FA, SAML / SSO.
• Higher when: high-risk vendor (+20), consumer domain (+10), free tier (+10).

6. The vendor and domain lists

Three named lists are used as priors. Membership is exact-match on the vendor name (lowercased) or substring-match on the domain.

• Enterprise vendors (~50 entries) — vendors with public SOC 2 / ISO 27001 / DPA practice. Examples: Microsoft, Google, AWS, Salesforce, GitHub, Anthropic, OpenAI, Stripe, Okta, Datadog, Snowflake, Vercel, Supabase.
• High-risk vendors (~10 entries) — vendors with documented data-handling concerns or jurisdictional issues. Examples: TikTok, ByteDance, Meta, Baidu, Alibaba, Tencent.
• Medium-risk vendors (~10 entries) — consumer-grade platforms repurposed for work. Examples: X (Twitter), Reddit, Discord, Telegram, WhatsApp.

The full lists are deterministic and live in src/lib/risk/risk-scorer.ts. We update them as new evidence emerges; updates are noted in the "Last updated" date at the top of this page.

7. The overall score

The five dimensions are combined with fixed weights:

• Data retention: 20%
• Third-party sharing: 20%
• GDPR compliance: 25%
• Trains on data: 25%
• Security certifications: 10%

The weighted average is rounded to an integer 0–100 and mapped to low / medium / high using the same thresholds as the per-dimension scores.

8. What the score does and does not tell you

Use the score as a triage signal, not a verdict. It points at tools that warrant a closer look — particularly when a single dimension lands in "high". It does not replace a formal vendor review, a Data Protection Impact Assessment, or a contract review.

• A Low overall score means the inputs we saw match patterns we associate with mature data handling. It does not certify the vendor as safe for your specific use case.
• A Medium score means our inputs are mixed or incomplete. Re-run the scan after editing the description, or fetch the privacy policy manually.
• A High score means at least one dimension hit our risk thresholds. The dimension breakdown points at the specific area to review (e.g. training, sharing, retention).

9. Where the score is stored

Each scan writes a row to the risk_assessments table — the score, level, per-dimension breakdown, generated summary, and the timestamp. Audit-log retention follows your plan. The raw privacy-policy text is not stored; only its derived signals are.

10. Limits we don't hide

• The scorer is rule-based. Edge cases that don't match any signal will land near the base scores and the summary will say so.
• Privacy policies change. The 30-day cache means a freshly updated policy won't move the score until the cache expires or the tool is re-scanned.
• Vendor and domain lists are curated by hand. We add to them as we see new tools; we don't claim to be exhaustive.
• The scorer reads English-language privacy policies well. Non-English policies will hit fewer signals and lean toward the base score.

11. Questions or corrections

If a tool was scored unfairly, or if you spot an error in this methodology, email hello@warnd.app. Corrections to the vendor / domain lists ship in the next deploy and update this page's "Last updated" date.