VendorScore

Can this SaaS read my data?

Plain-language data-access scores from public trust docs — so you know before you sign the DPA. Strong SOC 2 ≠ “can’t read your content.”

Join the waitlist

Public documentation review only. Not a pen test. Not legal advice. PDF reports coming soon.

About

VendorScore scores SaaS on whether the vendor can read your data, from public trust docs.

Sample scores

Enterprise options on when they exist (CSE, E2EE, EKM, etc.). Higher = less inherent vendor read access.

Vendor Score Verdict
Google Workspace 82 Yes by default; mostly no for CSE-protected Drive/Docs
Zoom 75 Yes by default; mostly no for E2EE meetings
Dropbox 73 Yes for normal files; mostly no for E2EE folders
Microsoft Teams 70 Yes by default; mostly no for E2EE 1:1 call and E2EE meeting media (never chat)
Microsoft 365 69 Yes (service can decrypt); DKE is the hard exception
ChatGPT Enterprise 66 Yes — EKM = custody/revoke; no training on business data by default
Slack 62 Yes — EKM = custody/revoke, not zero-knowledge
Salesforce 60 Yes — Shield/BYOK ≠ Salesforce can’t read
Notion 51 Yes — staff may access for support; not E2EE
HubSpot 46 Yes — CRM/AI/feature processors see customer data

All 35 vendor pages: Can this SaaS read your data? →

11 side-by-side comparisons: which vendor can read your data? →

Free sample: Slack

Free teaser · Full Slack page

Can Slack read your data?

Yes, by design — even with EKM, Slack uses your keys to serve messages; EKM improves custody and revoke, not zero-knowledge.

62 / 100 overall

Enterprise Grid/Enterprise+ with Slack EKM. Evidence 2026-10-06.

Key custody58 Plaintext access42 Encryption claims68 Subprocessors55 Auditability88

Evidence (public)

Caveats

  • Without EKM, key custody and plaintext scores drop (~35–40).
  • Slack Connect / apps / AI may expand data paths — check current SPARC/NLI.
  • Staff access and exact subprocessors: confirm under NDA / trust portal.

Join the waitlist for full PDFs

Full write-ups and source lists coming soon — join the waitlist to hear when they open.

What we score

Overall = equal-weight average of five dimensions (0–100).

Coming soon

PDF scorecards are not for sale yet. Join the waitlist — delivered by email when ready. No calls.

Coming soon

Single vendor PDF

$99 planned launch

One scorecard: verdict, scores, evidence URLs, caveats. One revision in 7 days if a public source was missed.

Coming soon

Shortlist pack (3)

$249 planned launch

Three PDFs plus a comparison table. For final vendor shortlists.

Coming soon · join waitlist

Category pack (8)

$799

Full set of 8 PDFs plus a comparison summary table. Delivered by email — no calls.

Coming soon

Custom vendor

$299

Any named SaaS not in the catalog (5-day SLA when live). Quarterly refresh sold separately.

Join the waitlist

Click Join the waitlist to open a pre-filled email to vendorscore@proton.me (subject + body ready). Or write that address yourself. Paid PDFs open later; the waitlist hears first.

FAQ

Can Slack read my data?

Yes, by design. Even with Slack EKM, Slack uses your keys to serve messages. EKM improves key custody and revoke, not zero-knowledge. VendorScore rates Slack 62/100 overall on Enterprise Grid/Enterprise+ with EKM, based on public trust docs.

What does VendorScore score?

VendorScore scores SaaS on whether the vendor can read your data, from public trust docs. Five equal-weight dimensions (0–100): key custody, plaintext access, encryption claims, subprocessors, and auditability.

Is this a pen test?

No. VendorScore is a public documentation review only. It is not a pen test and not legal advice. Scores change when vendor trust pages change.

How do I get PDFs?

PDF scorecards are not for sale yet. Join the waitlist by emailing vendorscore@proton.me — reports will be delivered by email when ready. No calls.

Does strong SOC 2 mean a vendor can’t read my content?

No. Strong SOC 2 is about controls and auditability, not whether the vendor can decrypt or view your content. VendorScore separates those questions.