Every vendor grade on Entropy is computed against a versioned rubric, not a gut feeling. Here's what actually goes into it.
Four categories, one grade
A company's score is a weighted combination of four categories that sum to 100, plus a small capped verification bonus applied on top. The point values below are pulled straight from the live rubric (currently v2.0.0); the methodology page has the authoritative, signal-by-signal breakdown.
- Security hygiene & transparency (75 pts) — observable practices on a vendor's public domain: a valid
security.txtfile, HTTPS enforced with HSTS, correctly configured security headers, a public disclosure policy, and a public trust/security page existing at all (existence only — what the page actually claims is never scored). These are proven proxies for organizational security culture, not a substitute for a code audit. This is the largest category and it's fully automated. - Governance (14 pts) — independently verified compliance certifications, weighted by importance and by how openly the vendor publishes them. A certification only scores once an Entropy admin has confirmed it against a registry or reviewed the underlying report; a certification merely named on a trust page earns nothing. Certifications that don't apply to a vendor's market (FedRAMP for a company with no government customers, HIPAA for one that never touches health data) drop out of both the numerator and the denominator, so their absence never counts against the score.
- AI safety practices (8 pts) — whether the vendor holds an AI-management-system certification (ISO/IEC 42001) and publishes a genuine model card documenting limitations and intended use. Training-data disclosure and published red-team results are defined in the rubric but not yet scored — no reliable signal exists for them yet.
- Incident history (3 pts) — full marks by default; a recorded security incident is a temporary drag whose size depends on severity and how well it was disclosed and remediated, decaying back to zero over 24 months. Never a permanent mark, never an automatic zero-out.
On top of these, a verification bonus (up to +5 pts — 3 for confirming domain ownership by claiming a profile, 2 for getting an uploaded evidence document admin-verified) is added after the four categories sum. It's capped and additive: it lifts the final score but not the grade denominator, so a vendor who hasn't claimed is never penalised, and the total can't exceed 100.
We grade against a fixed 100, and hold unbuilt weight out rather than zeroing it
Grades are computed against a fixed 100-point scale — earned points, straight, no shifting denominator. But not every signal is live yet: the AI-safety training-data and red-team sub-signals are still being designed, so their weight (3 points) sits unclaimed — held out of everyone's reachable ceiling rather than counted as a universal zero that would drag every grade down together. The reachable ceiling today is 97 of 100; a vendor with flawless hygiene, every applicable certification verified and published, a model card, and a clean incident record reaches an A+ on merit alone. As those last signals ship, the ceiling rises to a full 100 — existing grades don't move, the headroom just grows.
Current grade vs. potential score
Every profile shows a current grade, computed purely from automated signals with no vendor involvement required, and — where a concrete, currently-scored fix would change the grade — a potential grade showing what closing that gap would reach. The verification bonus (up to +5 points — for confirming domain ownership via DNS and for getting an uploaded document admin-verified) gives vendors a direct, actionable lever on their own standing rather than an opaque score they can't influence. It's a capped modifier — it lifts a score without moving the grade denominator, so it never penalises a vendor who hasn't claimed — and the claim portion applies within minutes, not just on the weekly rescan.
Versioned, so history stays comparable
Every score is tied to the rubric version it was computed against. That means as the methodology evolves — new signals, adjusted weights, refined grade thresholds — historical scores remain comparable, and you can always tell whether a given score reflects the current rubric or an earlier one. Grade threshold changes are announced with the rubric version and only apply going forward, never retroactively.
Want the full live breakdown, signal by signal? See the methodology page.