VendorScore · Vendor index
Plain-language data-access scores from public trust docs. Overall = equal-weight average of five dimensions (0–100). Higher = less inherent vendor read access.
Get full 5-dimension PDFs — join the waitlist35 vendors · Evidence dated 2026-10-06 to 2026-10-07, public docs only, not legal advice.
Scored with enterprise options on where they exist (CSE, E2EE, EKM, Customer Key, Shield). Default setups usually score lower; see each page.
| Vendor | Overall | Verdict | Page |
|---|---|---|---|
| Google WorkspaceProductivity suite | 82 | Yes by default; mostly no for CSE-protected Drive/Docs | Read → |
| ZoomMeetings | 75 | Yes by default; mostly no for E2EE meetings | Read → |
| DropboxFile storage | 73 | Yes for normal files; mostly no for E2EE folders | Read → |
| WebexTeam chat & meetings | 73 | Yes by default; Zero-Trust E2EE covers meetings only, never messaging | Read → |
| Microsoft TeamsTeam chat & meetings | 70 | Yes by default; mostly no for E2EE 1:1 call and E2EE meeting media (never chat) | Read → |
| Microsoft 365Productivity suite | 69 | Yes (service can decrypt); DKE is the hard exception | Read → |
| Gemini for Google WorkspaceAI assistant | 69 | Yes — Google processes prompts; CSE-protected content stays out of Gemini's reach | Read → |
| GongSales call recording | 67 | Yes — BYOK = revoke switch for new files; staff access auditable | Read → |
| DocusignE-signature | 67 | Yes — Security Appliance = your keys; 'staff can't view' is Docusign's claim | Read → |
| ChatGPT EnterpriseAI assistant | 66 | Yes — EKM = custody/revoke; no training on business data by default | Read → |
| Microsoft 365 CopilotAI assistant | 66 | Yes — Customer Key + Lockbox cover Copilot; OpenAI-operated models on by default | Read → |
| BoxFile storage | 64 | Yes — KeySafe = custody/kill switch; Box still decrypts for previews and AI | Read → |
| Claude for WorkAI assistant | 64 | Yes — CMEK = custody/revoke; flagged chats get human review; data stored in US | Read → |
| Atlassian (Jira & Confluence)Project management | 63 | Yes — CMK = custody/revoke; support access needs your consent | Read → |
| SlackTeam chat | 62 | Yes — EKM = custody/revoke, not zero-knowledge | Read → |
| MiroOnline whiteboard | 61 | Yes — EKM = revoke switch; whitepaper's 'end-to-end' wording is server-side | Read → |
| SalesforceCRM | 60 | Yes — Shield/BYOK ≠ Salesforce can’t read | Read → |
| AirtableDatabase / no-code | 59 | Yes — EKM = custody/revoke; metadata and logs stay on Airtable keys | Read → |
| FigmaDesign | 59 | Yes — EKM is partial; AI content training on by default for Starter/Pro | Read → |
| AsanaProject management | 57 | Yes — EKM scope undocumented; LLM providers in the subprocessor list | Read → |
| monday.comProject management | 55 | Yes — BYOK only via Guardian add-on; one shared KMS key by default | Read → |
| ZendeskCustomer support | 55 | Yes — BYOK covers user identity fields only; cross-account ML on Service Data | Read → |
| CalendlyScheduling | 53 | Yes — vendor keys; Notetaker sends recordings to Recall.ai and OpenAI | Read → |
| GitHubDeveloper tools | 52 | Yes — no customer keys; Copilot Business/Enterprise data not used for training | Read → |
| NotionDocs & wiki | 51 | Yes — staff may access for support; not E2EE | Read → |
| LoomVideo messaging | 51 | Yes — Atlassian-managed keys (CMK doesn't cover Loom); AI to OpenAI and Gemini | Read → |
| TrelloProject management | 50 | Yes — no customer keys for Trello; not in Atlassian residency scope (low confidence) | Read → |
| ClickUpProject management | 50 | Yes — AWS-managed keys; long AI vendor list incl. China-based models | Read → |
| CanvaDesign | 50 | Yes — Canva-managed keys; team plans excluded from AI training | Read → |
| LinearIssue tracking | 49 | Yes — Google Cloud-managed keys; contractual no-training | Read → |
| Otter.aiAI meeting notetaker | 48 | Yes — vendor keys; de-identified training by default outside Enterprise | Read → |
| IntercomCustomer support | 47 | Yes — vendor keys; Fin model training on by default (opt-out) | Read → |
| HubSpotCRM | 46 | Yes — CRM/AI/feature processors see customer data | Read → |
| GranolaAI meeting notetaker | 43 | Yes — vendor keys; no bot, audio deleted; training opt-out outside Enterprise | Read → |
| Fireflies.aiAI meeting notetaker | 42 | Yes — vendor keys; LLM vendors process content; its 'end-to-end' label is server-side only | Read → |
A higher score doesn't mean a more secure product. It means more customer control and less inherent vendor plaintext access. A vendor can have an excellent SOC 2 and still be able to read all your data.
Google Workspace 82 · Microsoft 365 69
Zoom 75 · Webex 73 · Microsoft Teams 70 · Slack 62 · Loom 51
Gemini for Google Workspace 69 · ChatGPT Enterprise 66 · Microsoft 365 Copilot 66 · Claude for Work 64
Gong 67 · Otter.ai 48 · Granola 43 · Fireflies.ai 42
Atlassian (Jira & Confluence) 63 · Airtable 59 · Asana 57 · monday.com 55 · Notion 51 · Trello 50 · ClickUp 50
Salesforce 60 · Zendesk 55 · Intercom 47 · HubSpot 46