Vendor Trust & Compliance Evidence Collector

Turn a list of vendor websites into reviewer-ready security and compliance evidence: claims with source quotes, trust-center links, subprocessors, incident history and a transparent trust score.

What does Vendor Trust & Compliance Evidence Collector do?

It reads each vendor's public trust material the way a security reviewer would: the homepage, linked security, trust, privacy, terms, DPA and subprocessor pages, the vendor's own trust center (SafeBase, Vanta, Drata, Conveyor, Whistic, Secureframe, OneTrust, Wolfia and others), its security.txt, and its public status page. Every certification or control it reports (SOC 2, ISO 27001, HIPAA, SSO, encryption and more) comes with the exact URL and a short quote, so you can verify it in seconds. It then scores the vendor from 0 to 100 with a line-by-line breakdown and lists the gaps you should raise with the vendor. Run it on a schedule with change monitoring to see when claims, subprocessors or incidents change.

Why use it

• Evidence, not keywords. Each claim has sourceUrl and a quote of 240 characters or less. FAQ questions ("Is X ISO 27001 certified?"), negations ("not certified against ISO 27001"), cookie banners, navigation items and marketing for compliance products are filtered out.
• Hosting-provider claims are flagged. "Hosted on AWS, which is SOC 2 certified" is marked possiblyInherited and does not count toward the score.
• Trust centers are detected, not rendered. The Actor identifies the provider and records the URL even when the portal is a JavaScript app or access-gated, and reads whatever the portal exposes in plain HTML.
• Real subprocessor lists. Rows are extracted from subprocessor tables (name, purpose, location). Tables of TOMs, data categories or affiliates are ignored.
• Structured incident history. Atlassian Statuspage, incident.io and Instatus pages are read through their public JSON or RSS feeds: current status, components and incidents from the last 90 days with impact and timestamps.
• Reviewer gaps. A plain-English list of what to request: SOC 2 Type II report, pen-test summary, DPA, subprocessor list, security contact and more.
• Change monitoring with low noise. A claim only counts as added or removed when its source page was read in both runs.
• Fair billing. Unreachable, blocked, parked or invalid vendors are returned with a reason and are not charged.

What data you get

Field	Description
domain, finalUrl, status	Vendor domain, homepage after redirects, result status (ok, unreachable, blocked, parked, invalid_input, error)
trustScore	0-100 score from eight weighted factors
scoreBreakdown	Points, maximum and reason for each factor
procurementStatus	strong_evidence, needs_review, weak_evidence or failed
gaps	Items a reviewer should request from the vendor
trustCenterProvider, trustCenterUrl, trustCenter	safebase, vanta, drata, onetrust, whistic, conveyor, secureframe, wolfia, trustcloud, sprinto, custom or none, plus URL, title and description
certifications	Certifications and regulations claimed by the vendor itself
claims	{ claim, category, sourceUrl, quote, pagesMentioning, possiblyInherited? } for SOC 2 (Type I/II), ISO 27001/27017/27018/27701, HIPAA, PCI DSS, GDPR, CCPA, FedRAMP, CSA STAR, TISAX, Cyber Essentials, SSO/SAML, MFA, encryption at rest and in transit, penetration testing, bug bounty, vulnerability disclosure
legalDocs	URLs of the security page, compliance page, privacy policy, terms, DPA, subprocessor list, GDPR/CCPA page and SLA
subprocessors, subprocessorCount, subprocessorSourceUrl	{ name, purpose?, location? } rows and where they came from
statusPage	Provider, current status, components, incident count and list for the last 90 days
currentStatus, incidentCount90d	Shortcuts for table views
securityTxt	Presence, contact, expires (and whether expired), policy, encryption key, signature
securityHeaders	HSTS, CSP, X-Frame-Options (or CSP frame-ancestors), Referrer-Policy on the homepage
pages, documents	Pages read (with type) and linked PDFs or external documents that were recorded but not downloaded
changes	With monitoring on: baseline, unchanged or changed, plus claims and subprocessors added/removed and new incidents

How to use

1. Open the Actor and paste vendor homepages or bare domains into Vendor websites, one per line.
2. Optionally raise Max pages per vendor (default 12) for very large sites.
3. Turn on Monitor changes between runs if you want a diff against the previous run.
4. Click Start. Each vendor takes about 5-20 seconds.
5. Open the Vendor overview table, or export JSON, CSV or Excel.

{
  "urls": ["https://linear.app", "hubspot.com", "https://www.datadoghq.com"],
  "maxPagesPerVendor": 12,
  "monitorChanges": false,
  "maxConcurrency": 3
}

Output example

Trimmed result for linear.app from a real run:

{
  "domain": "linear.app",
  "status": "ok",
  "trustScore": 95,
  "procurementStatus": "strong_evidence",
  "trustCenterProvider": "vanta",
  "trustCenterUrl": "https://trust.linear.app/",
  "certifications": ["SOC 2 Type II", "ISO 27001", "HIPAA", "GDPR", "CCPA"],
  "claimCount": 9,
  "subprocessorCount": 34,
  "currentStatus": "operational",
  "incidentCount90d": 6,
  "gaps": [
    "Trust center (vanta) is a JavaScript app or access-gated: request access to its documents at https://trust.linear.app/",
    "No penetration testing claim: request the latest third-party penetration test summary."
  ],
  "scoreBreakdown": [
    { "factor": "trust_center", "points": 10, "maxPoints": 10, "detail": "vanta trust center: https://trust.linear.app/" },
    { "factor": "certifications", "points": 25, "maxPoints": 25, "detail": "SOC 2 Type II +15; ISO 27001 +8; HIPAA +2" },
    { "factor": "security_controls", "points": 12, "maxPoints": 15, "detail": "SSO/SAML, MFA, Encryption at rest, Encryption in transit (+3 each)" }
  ],
  "claims": [
    {
      "claim": "SOC 2 Type II",
      "category": "certification",
      "sourceUrl": "https://linear.app/security",
      "quote": "Linear undergoes regular Service Organization Controls audits (SOC 2 Type II). Request SOC 2 →",
      "pagesMentioning": 2
    },
    {
      "claim": "ISO 27001",
      "category": "certification",
      "sourceUrl": "https://linear.app/security",
      "quote": "Linear has achieved ISO/IEC 27001:2022 certification for its information security management system. Request ISO →",
      "pagesMentioning": 1
    }
  ],
  "subprocessors": [
    { "name": "Google LLC", "purpose": "Cloud provider, artificial intelligence, collaboration / productivity", "location": "United States, European Union" },
    { "name": "Cloudflare, Inc.", "purpose": "Cloud provider", "location": "Global" }
  ],
  "subprocessorSourceUrl": "https://linear.app/dpa",
  "statusPage": {
    "url": "https://linearstatus.com/",
    "provider": "incident_io",
    "source": "api",
    "currentStatus": "operational",
    "componentCount": 6,
    "incidentCount90d": 6,
    "incidents90d": [
      { "title": "EU sync failure", "impact": "critical", "status": "resolved", "createdAt": "2026-09-27T10:56:30Z", "resolvedAt": "2026-09-27T12:02:30Z" }
    ]
  },
  "securityTxt": {
    "present": true,
    "url": "https://linear.app/.well-known/security.txt",
    "contact": ["mailto:security@linear.app"],
    "expires": "2027-12-31T23:59:00.000Z",
    "expired": false,
    "policy": ["https://linear.app/security/vulnerability"]
  },
  "securityHeaders": { "https": true, "hsts": true, "csp": true, "xFrameOptions": false, "frameAncestors": true, "referrerPolicy": true },
  "changes": { "status": "unchanged", "previousCheckedAt": "2026-10-16T08:42:13.233Z", "claimsAdded": [], "claimsRemoved": [], "subprocessorsAdded": [], "subprocessorsRemoved": [], "newIncidents": [] }
}

How the trust score works

Factor	Max	Points for
Trust center	10	Third-party or own trust center 10, security page only 6
Certifications	25	SOC 2 Type II 15 (other SOC 2 10), ISO 27001 8, each other attestation 2
Security controls	15	SSO/SAML, MFA, encryption at rest, encryption in transit, pen testing (3 each)
Privacy and legal	20	Privacy policy 6, terms 3, DPA 6, GDPR/CCPA statement 5
Subprocessors	10	Extracted list 10, list found but not extractable 6
Vulnerability disclosure	5	Valid security.txt 3, bug bounty or disclosure program 2
Status transparency	10	Status page with machine-readable history 10, status page only 6
Security headers	5	HSTS 2, CSP 1, framing protection 1, Referrer-Policy 1

strong_evidence needs a score of 70 or more and a SOC 2 or ISO 27001 claim. needs_review is 40 or more. Everything below is weak_evidence.

Pricing

This Actor uses pay-per-event pricing: $0.01 per vendor with usable evidence (event vendor-trust-result).

Vendors checked	Cost
50 (a typical new-vendor intake list)	$0.50
1,000	$10.00
5,000 (weekly monitoring of a large portfolio)	$50.00

Not charged: vendors that are unreachable (DNS or connection failure), blocked by bot protection, parked or for sale, invalid inputs, and duplicate domains in the same run. The number of pages read per vendor does not change the price.

Integrations and scheduling

• Schedules: run weekly or monthly with Monitor changes between runs on to track your vendor portfolio. Snapshots are kept in the named key-value store vendor-trust-snapshots.
• Webhooks: trigger a Slack message, ticket or GRC update when a run finishes, then filter items where changes.status is changed.
• API and integrations: start runs and fetch results via the Apify API, Make, Zapier, n8n or Google Sheets exports.
• MCP and AI agents: expose the Actor through the Apify MCP server so an AI assistant can pre-fill security questionnaires or summarize vendor risk from the evidence and quotes.

FAQ and limitations

Does it log in to trust centers or download gated reports? No. It only reads public pages. Gated or JavaScript-only trust centers are detected and linked, and the gap list tells you to request access.

Why is a claim marked possiblyInherited? The sentence attributes the certification to a hosting or cloud provider (for example "hosted on AWS, which is ISO 27001 certified"). It is shown for transparency but does not raise the score.

Is a claim proof of certification? No. It is public evidence that the vendor states something. Always confirm with the report or certificate (SOC 2 report, ISO certificate) before relying on it.

Why is the subprocessor list empty when the vendor has one? Some lists are PDFs, Google Docs, Notion pages or JavaScript apps. The Actor records the link in legalDocs.subprocessorListUrl or documents and adds a gap so you can review it.

What about bot protection? The Actor sends a handful of polite requests per vendor and does not try to bypass challenges. If a site answers with a challenge, the vendor is returned as blocked and is not charged. Try again later or use Apify Proxy.

Which status pages are supported? Atlassian Statuspage and Statuspage-compatible pages (for example incident.io) via /api/v2/summary.json and /api/v2/incidents.json, and Instatus via summary.json and its RSS history. Other status pages get a keyword-based current status. Incident lists come from the public feed and cover at most the latest 50 incidents. This Actor replaces our Status Page Incident Extractor.

Responsible use. The Actor collects only public company information that vendors publish for customers and auditors (security pages, policies, status pages, security.txt). It does not collect personal data. Respect each website's terms, use the results for due diligence, and verify important findings with the vendor. The trust score is a screening aid, not a legal or audit opinion.