Every AI vendor a company evaluates gets the same 40-page security questionnaire, and every buyer sends roughly the same questionnaire to every vendor. Neither side learns much from the ritual. The vendor spends a few days filling out a document that mostly restates their marketing site. The buyer spends a few days reading a document written to make the vendor look good. Nobody involved was trying to deceive anyone — the format just isn't built to produce a comparable, verifiable answer.
We built Entropy because that gap — between "what a vendor says about itself" and "what's actually observable and verifiable" — is exactly the kind of problem a scoring system can close.
What we actually score
Entropy computes a grade for each AI vendor from publicly observable signals: whether they publish a disclosure policy, whether their site enforces HTTPS and HSTS, whether their security headers are configured correctly, and — as we add more signals — deeper practices like model card transparency and training data disclosure. None of this depends on a vendor filling out a form or returning our email. A grade exists whether or not a vendor has ever heard of us.
Vendors can claim their profile, verify domain ownership, and upload supporting evidence — a SOC 2 report, an ISO 27001 certificate, a model card. A verification bonus lets that engagement strengthen a score directly: a few points for the DNS check, a few more for putting at least one document on file. It's not a way to buy a better grade — the points are bonus-only and capped, an uploaded document is a vendor attestation rather than something we've audited, and the baseline grade still stands on the automated signals alone, with or without a vendor's cooperation.
Chaos into a legible signal
The product's whole premise is converting unverified, scattered claims about AI vendors into something a buyer can actually compare in seconds instead of a week. That's not a metaphor we picked for the logo — it's the actual job the scoring engine does, and it's the same standard we hold ourselves to. If you want the full breakdown of what's measured and how grades are calculated, read our methodology or the deeper walkthrough in Our methodology, explained.
This post will get a real founding story soon — who built this, why, and what specifically triggered it. For now, this is the honest, generic version: we thought buyers deserved better than a questionnaire, and vendors deserved a way to prove their security posture that didn't depend on writing the most convincing paragraph.