Methodology & disclaimer

GTM Trust Index tracks what AI sales and go-to-market tools publicly say about their security and legal posture. It is built for the people who have to answer “will this pass security review?”: sales, RevOps, procurement, security and legal.

How data is sourced

• Every claim comes from a page the vendor owns: trust center, security page, privacy policy, DPA, subprocessor list, help center or documentation.
• Each field lists the exact URLs fetched and, where available, a verbatim quote. We quote rather than paraphrase where wording matters, especially on AI training.
• Each listing shows a last checked date. Claims are accurate to the source as of that date only.
• Third-party reviews, sales calls and gated documents we can't cite publicly are not used. If a document is gated (e.g. a SOC 2 report behind NDA), we say what the public page says about it.
• Tools marked Not yet reviewed are on our list but carry no claims yet.

What the fields mean

• SOC 2: Independent audit of security controls. Type II covers operating effectiveness over a period.
• ISO/IEC 27001: Certified information security management system.
• HIPAA / BAA: Whether the vendor will sign a Business Associate Agreement for PHI.
• GDPR DPA: Data Processing Agreement/Addendum for personal data.
• Trains AI on customer data: Whether the vendor says it uses customer data to train AI models.
• Data retention: What the vendor publishes about how long customer data is kept.
• Subprocessor list: Where the vendor lists third parties that process customer data.
• Trust center: The vendor's security/trust portal.

Status badges

• ✓Confirmed The vendor clearly states it (e.g. SOC 2 Type II, DPA published, does not train on customer data).
• !Partial / unclear The vendor says something related but stops short, e.g. “HIPAA compliant” with no public BAA, training allowed with opt-out, or wording that doesn't answer the question.
• ✕Yes / No A risk flag, e.g. the vendor says it trains models on customer data, or states it does not hold a certification.
• ?Unknown Unknown means not verified. We could not find it on vendor-owned pages. It does not mean the vendor lacks it. Ask them.

Unclear (AI training) means the vendor published something about AI and data, but it doesn't clearly say whether customer data trains its own models. Examples: a statement that covers only subprocessors, or one that defers to contract terms.

Corrections and vendor claims

Vendors and readers can send evidence links from every listing page. We update a listing only when there is a public, vendor-owned source, and log every change on the What changed page.

Disclaimer