TrustSignal scores are based entirely on publicly verifiable signals — things any buyer, procurement team, or competitor can independently check about your company. We don't require any internal access or self-reported data.
Each scan crawls the target website, checks DNS records, and analyzes page content. Every finding becomes a signal — either a verified positive (something you're doing right) or a gap (something that could be improved).
Signals are weighted by category and severity. Critical security gaps (like no HTTPS) have a larger impact than informational findings (like blog freshness). The final score is a weighted composite of all categories, normalized to 0–100.
Scores are not certifications, audit opinions, or legal determinations. They represent the observable trust posture as seen from the outside.
SSL/TLS configuration, security headers (CSP, HSTS, X-Frame-Options), email authentication (SPF, DMARC), and DNS security.
Privacy policy completeness and readability, terms of service, refund policy, subprocessor disclosure, and policy update dates.
Pricing transparency, claim consistency across pages, blog freshness, and content accuracy.
Public status page, changelog/release notes, security page depth (SOC 2, ISO 27001 references), and operational transparency.
Third-party script inventory, cookie consent mechanisms, tracker categories (analytics vs advertising), and script count.
TrustSignal scores are deterministic — the same inputs always produce the same score. We don't use opaque ML models for scoring. Every signal comes with evidence and a clear explanation.
We welcome feedback on our methodology. If you believe a signal is being incorrectly weighted or detected, please contact us at support@trustsignal.tech.