Your Entropy grade is a letter from A+ to F, computed from a versioned rubric: four categories — security hygiene, governance, AI safety, and incident history — that sum to 100, plus a capped verification bonus on top. The full category weights and every individual signal are on the methodology page — this guide is about reading what you already have and deciding what to act on first. The point values below are pulled from the live rubric.
Your grade is computed against a fixed 100-point scale
Your grade is earned points out of a fixed 100 — no shifting denominator. Not every signal is live yet, though: the AI-safety training-data and red-team sub-signals are still being designed, so their weight sits unclaimed — held out of everyone's reachable ceiling rather than counted as a universal zero that would drag every grade down together. That's the implemented max score: the reachable ceiling today is 97 of 100, and a vendor with flawless hygiene, every applicable certification verified, a model card, and a clean record can reach an A+ on merit. Two things worth knowing before you read too much into a specific number:
- Your grade today is dominated by security hygiene — 75 of the 100 points — which is fully automated and needs no certifications at all.
- As the last sub-signals ship, the reachable ceiling rises toward a full 100; existing grades don't move, the headroom just grows. Grade thresholds themselves only change with a new rubric version, never retroactively.
What's actually scored right now, and what isn't
Security hygiene (75 of 75 points, all live) is fully automated — Entropy checks your domain directly, no action required beyond fixing what's missing: security.txt (Contact, Expires, and Encryption fields are each scored), HTTPS + HSTS, security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy — each scored individually), a public disclosure policy page, and a public trust/security page existing at all (existence only, never what it says: see the governance paragraph below for why). These are the cheapest points to close if your grade is lower than you'd expect: they're standard web security hygiene, not something that requires a vendor relationship with Entropy at all.
Governance (14 of 14 points, all live) is a real scored category, earned only through independent verification and never from your public trust page's own prose. It's a single formula over a catalog of certifications — SOC 2 Type II and ISO 27001 carry the most weight, then ISO 27701, CSA STAR, GDPR, EU-US DPF, and CCPA; vertical certifications (FedRAMP, GovRAMP, IRAP, HIPAA, PCI DSS, TISAX, DORA) only count when they apply to your market, and otherwise drop out of both the numerator and the denominator so their absence never hurts you. Each verified certification is also multiplied by how openly you publish it: fully published earns more than available-on-request, which earns more than a badge with nothing behind it. A certification named on your trust page but not independently confirmed earns nothing — a plain-text scan can't tell "we hold this" from "we don't". Credit comes two ways, and both now earn the same: an Entropy admin confirms a certification against a real registry or with the issuing firm, or you upload the actual report through your claimed profile and an Entropy admin reviews it — that one lands within a few minutes of the review. Anyone signed in can flag a certification that looks wrong from the profile, and an admin pulls the credit if it doesn't hold up.
AI safety (5 of 8 points live) scores an AI-management-system certification (ISO/IEC 42001, verified the same way governance certifications are) and whether you publish a genuine model card documenting limitations and intended use — not a marketing page. Training-data disclosure and published red-team results are defined in the rubric but not yet scored; that weight is unclaimed, not a zero against you.
Incident history (3 of 3 points, all live) is full marks by default. A recorded security incident is a temporary drag whose size depends on severity and how well it was disclosed and remediated, decaying back to zero over 24 months — never a permanent mark. Incidents are recorded by Entropy administrators from public reporting.
Claiming your profile
The verification bonus (up to +5 points — 3 for confirming domain ownership via a DNS TXT check, 2 for having an uploaded document admin-verified) is a capped modifier as of rubric v2.0.0: it's added after the four categories sum, lifts your final score but not the grade denominator (a fixed 100), and can only raise your grade — an unclaimed vendor is never marked down for not having done it.
The claim portion lands within a few minutes, not just on the next weekly rescan. An uploaded SOC 2 or ISO 27001 report earns nothing while it's an unreviewed self-attestation, but once an Entropy admin verifies it you get both: the 2-point evidence bonus here and that certification's governance credit (a separate category) moving to verified. Other document types have no governance signal to upgrade.
Claiming also unlocks the non-scoring things — disputing a finding you think is wrong, editing your profile details, posting a public response to a review, and the embeddable Verified badge.
A suggested order, if you're starting from zero
- Fix any failing security hygiene checks — these are automated, binary, currently scored, and typically the fastest to close: security.txt fields, HSTS, the four security headers, a disclosure policy page. This is 75 of the 100 points and needs no certifications.
- Check your category benchmark — each profile shows how your score in a category compares to other vendors in the same category, which is a useful signal for where you're already ahead versus where you're behind peers, not just behind a theoretical maximum.
- Claim your profile, then upload what you have — DNS-verifying your domain is 3 bonus points, applied within minutes; it can lift your grade but its absence never counts against you. Uploading a SOC 2 or ISO 27001 report earns nothing until an admin reviews it — but once verified it's worth the 2-point evidence bonus and moves that certification's governance credit to verified. Claiming also lets you dispute findings and edit your profile.
For the full point-by-point rubric, including everything still pending, see the methodology page.