Requires: Stated retention, training-on-customer-data policy and subprocessor list

Missing evidence: data_retention, customer_data_training, subprocessors

Requires: A current certification, audit or published security contact

Missing evidence: certifications, penetration_test, security_contact

Requires: Documented data origin, permitted uses and deletion route

Missing evidence: training_data_sources, permitted_uses, data_deletion

Requires: Disclosure counts as evidence; each disclosed incident also carries a penalty

Missing evidence: security_incident, incident_disclosure

Requires: A named licence and an explicit permitted-use statement

Missing evidence: licence, permitted_uses

Requires: Published SLA or an operated status page

Missing evidence: uptime_sla, status_page

Requires: Public model card, policy pages or a change log

Missing evidence: model_card, published_policies, changelog_url

Requires: Declared processing and hosting regions

Missing evidence: processing_regions, hosting_regions

Requires: Company age, size or funding stage from a filing

Missing evidence: founded_year, employee_count, funding_stage