Score each data handling answer from 0 to 3 based on how specific it is and what evidence backs it: 0 for no answer, 1 for a general claim, 2 for a specific claim, 3 for a specific claim with a document you can check. Use the same questions for every vendor, then discuss the gaps, not just totals.
Why a rubric helps
Without one, the vendor with the best presenter wins. A rubric forces the same questions and the same standard for everyone, and leaves a record of why you chose as you did. It also shows where one vendor is strong and another weak, which is more useful than a single number.
The scale
| Score | Meaning | Example answer to "how long do you keep scan results?" |
|---|---|---|
| 0 | No answer, or refused | "We will cover that later." |
| 1 | General claim, nothing checkable | "We keep data only as long as needed." |
| 2 | Specific claim | "Detailed findings for N days after a project is removed." |
| 3 | Specific claim plus evidence | The same, with a clause number in the contract or a published policy |
Anything that contradicts another answer scores 0 until resolved.
Criteria to score
Pick criteria that match your risk. A starting set:
- Data inventory: does the vendor list the classes of data it holds?
- Code handling: where is code read, and is any copy kept?
- Retention: periods per class, and how deletion works.
- Exit: export window, formats and written deletion confirmation.
- Sub-processors: list with purposes, regions and change notice.
- Support access: roles, approval, time limits and logs.
- Encryption and keys: what is encrypted and who holds the keys.
- Breach notice: fixed time, contact and content.
- Data use: any use beyond delivering the service, with opt out.
- Audit and evidence: what you can see and request.
Weight them if you like, with double weight on the two or three that matter most. Keep it simple, because false precision hurts. A weighted score of 71.4 is no more meaningful than a rating of "good" with notes.
Rules for fair scoring
- Same questions, same wording. Ask each vendor in writing.
- Two scorers. Have two people score independently, then compare. Differences point to unclear answers.
- Separate today from planned. Roadmap items score as 0 for current capability, noted separately.
- Do not score marketing pages. Score what is written in the response or contract.
- Keep notes. Record the exact answer and the document reference.
From scores to a decision
Treat any 0 on a must have criterion as a blocker to resolve, not something an average can hide. For 1s, ask a follow up. For a close choice, use the notes to decide which gaps you can accept or fix through contract terms. See security vendor data handling red flags for follow ups, and build a weighted scorecard before you read any analyst report for the wider approach.
How Safeguard fits
You can score us the same way. Safeguard supports SaaS, private VPC, on-prem and air-gapped deployment, and the free scan lets you test the product before sending real questions.
Quick check
Should price be in the same score?
Keep data handling separate. Combine scores later with cost and fit, so a low price cannot hide a weak answer on data.
How many criteria is too many?
More than about ten and people stop reading the answers. Start with the criteria that map to your biggest risks.
Last reviewed: 19 October 2026.
