The Public Grid
One row per assessed offering, one column per observation, across the whole population. A buyer looks up a supplier and reads what that supplier has published, in the same columns as everybody else. It is free, and it stays free.
Document Class: Segment Report
- Assessed
- 111 organisations, 147 offerings
- Evidence Cutoff
- 2026-07-29 to 2026-08-15 — per row, never one date for the register
- Method Generations
- v1.6 × 130 · v1.4 × 12 · v1.1 × 5
- Standards Commits
- 38 distinct, one recorded on every row
- Standard
- GLOBAL-Entity-Grid-Standard-v1.1.md
- Built
- 2026-08-15
Segment Scope
In: every offering whose fact record passed validation and carries the row class Observed — 147 rows across 111 organisations.
Out: 51 Variant rows, which are named in their own band below but carry no cells; and every Counterfactual row, which is internal and is never emitted at all.
On what basis: the row-class publication gate. A grid builder that simply iterated the source records would emit rows nobody measured — on the thirteen-entity pilot it produced nineteen rows for thirteen organisations, four of them fabricated, two of which made an organisation look better than its evidence supported. The gate is applied by the builder itself rather than inherited from the validator, because a consumer that trusts an upstream check is a consumer with no check.
What This Grid May Not Be Used For
It Is Not A Rating, A Score, A Grade Or A Ranking
Every cell is a publication state. There is no total, no average and no league position, and none may be computed from it. The rows are alphabetical for that reason, and no other ordering is offered.
It Is Not A Compliance Determination
Nothing here alleges that any organisation has breached any law. An Absent cell records that a document was not found on the public record at a stated date, by a stated method.
It Is Not A Substitute For The Deep Dive
The grid carries no limitations table, no right of reply and no evidence. A decision about a named supplier is taken on that supplier's own assessment. The grid's job is to tell a buyer which assessment to read.
No Cell May Be Quoted Without Its Date And Its Generation
A cell without its evidence cutoff and its method generation is not a fact, it is a claim. Both travel on every row here, and both are carried into the row's full reading.
How To Read A Cell
An Empty-Looking Answer Has Three Meanings, And They Never Render Alike
- Absent — measured; the organisation does not publish it. This is a finding.
- Never Asked — the method generation that produced the row never put the question. The cell names the generation, so a reader knows which rows compare with which. This is a fact about our coverage.
- Not Researched — the reference set does not cover the organisation on that question at all. This is a fact about the reference set.
A fourth answer is not an absence: Does Not Arise means the question was put and does not apply to the offering — there was never anything that could have been published. It bands Neutral and is a completed reading, not a gap.
Subprocessors5
Subprocessor List
List Completeness
| Organisation | Offering | Subprocessor List | List Completeness | Subprocessor Locations | As At | Reading |
|---|---|---|---|---|---|---|
| CISO Adapt | CISO Adapt (Cyberensic Pty Ltd) | Absent | Not Assessable | No List To Assess | 2026-07-29v1.1 | |
| OneTrust | OneTrust LLC | Published | Closed | Partial | 2026-07-29v1.1 | |
| Sakana AI | Sakana AI (Fugu) | Absent | Not Assessable | No List To Assess | 2026-07-29v1.1 | |
| SecurityScorecard | SecurityScorecard (TITAN) | Published | Open-Ended | All Named | 2026-07-30v1.1 | |
| TrustArc | TrustArc Inc | Published | Closed | All Named | 2026-07-29v1.1 |
State Access — A Separate Band
Origin is not destination. An elevated origin yields Cannot Assess, never No Lawful Route. Nationality, ownership or founder origin may never ground an elevated finding.
Classification rests on documented ownership and statutory obligation only — never founder nationality, ethnicity or personal origin.
State-Access (Stakeholder) — Not Researched on all 147 rows
Basis, recorded identically on every row: “not researched under the method — no documented ownership or statutory-obligation finding on the record”.
The band holds one value because the 9,363-row reference set that could have filled it says on 9,336 of its own rows that the value is a mechanical default rather than a verified absence. A lookup against it could not tell “checked and clean” from “never checked”, so it would have published a clean result nobody measured. And the file sits outside the repository, so the same records built on two machines produced two different published wordings — a cell whose basis depends on the build host is not a fact about anyone. The builder no longer opens it. When stakeholder control is genuinely researched it enters through a fact record like every other observation, cited, dated and carrying its claim tier.
Conditional Rows, Named But Not Celled51
Hosting Locality23
Deployment Mode23
Commercial Tier5
Correction, Right Of Reply, And Free-And-First
The finding goes to the organisation free and first. An organisation that disputes a cell gets the same route as one disputing a report: the correction is published with a version note, and where a document is produced the reading is re-run. Every organisation’s own record carries the route.
Nothing on this page is behind a sign-in, a price or an account, and nothing on it ever will be. Comparison at this depth is the free layer; what is sold is the reading that goes deeper, never a better answer on this one.