Assess vendors
Which vendor should we trust with our data?
Several vendors scored on ten criteria weighted for your profile, with two knock-outs no weighting can rescue.
- ≈ 5 min
- Free calculation · AI commentary on request
- You leave with: A ranking of vendors, knock-outs included
The candidates and the grid
0 absent · 1 verbal promise · 2 documented but partial · 3 contractual · 4 contractual and verified. Two criteria are knock-outs: without a DPA and a no-training guarantee, price does not matter.
| Vendor | GDPR-compliant DPA * | No-training guarantee * | EU data residency | SOC 2 / ISO 27001 | SSO and admin controls | Exportable audit logs | Model and sub-processor transparency | Reversibility and data export | Price | Support and SLAs | |
|---|---|---|---|---|---|---|---|---|---|---|---|
The verdict
The figures above are computed and free. If you also want them read back to you — what they mean, what is specific to your sector, where to start — that is produced on request.
Ranking
- 1. Fournisseur A — suite bureautique83 %
To negotiate: Price
- 2. Fournisseur B — assistant spécialisé68 %
To negotiate: SOC 2 / ISO 27001, SSO and admin controls, Reversibility and data export
- 3. Fournisseur C — start-up39 %
Knocked out: GDPR-compliant DPA
The detail
| Line | Estimate |
|---|---|
| Set-up | |
#1 Fournisseur A — suite bureautique — 83 % Weak points to negotiate: Price (2/4). | €66 |
#2 Fournisseur B — assistant spécialisé — 68 % Weak points to negotiate: SOC 2 / ISO 27001 (2/4), SSO and admin controls (2/4), Reversibility and data export (2/4). | €54 |
| Risk | |
#3 Fournisseur C — start-up — 39 % Knocked out: GDPR-compliant DPA. No weighting compensates for a contract that does not permit sending the data. | €31 |
The assumptions
Every figure above rests on these. The ones marked “assumption” have no external source: they are modelling choices, labelled so they can be argued with rather than mistaken for measurements.
- Weighting profile standardObserved
- Standard: price weighs as much as compliance. Regulated and public: residency, certifications and logs weigh more, price less.
- Knock-out criteria GDPR-compliant DPA, No-training guaranteePublished
- A score ≤ 1 on either ranks the vendor last regardless. Without a DPA, personal data cannot lawfully be sent; without a no-training guarantee, your confidential data becomes the vendor's.
- Scale 0–4Observed
- 0 absent · 1 verbal promise · 2 documented but partial · 3 contractual · 4 contractual and verified.
What the calculation does, what the AI does
Every figure on this page comes from a deterministic algorithm running in your browser: the same input always gives the same result, and nothing is sent to produce it. AI runs only afterwards, to write the commentary from those figures. It produces none of them — the format it fills has no numeric fields — and any sentence quoting a value the calculation did not produce is removed before display.
Where to go next
See all 19 tools →- Pitfall radar
What is going to go wrong in our programme, and what will it cost?
≈ 2 min · Detected pitfalls, their weighted cost and the fix for each - GDPR exposure
What is ungoverned AI use already costing us?
≈ 2 min · The annual risk in euros, against the cost of compliance - EU AI Act
Is our system high-risk, and what does that oblige us to do?
≈ 4 min · The classification and the applicable obligations, article by article - Cost calculator
What does our AI transformation actually cost, and when does it break even?
≈ 3 min · A line-by-line budget, the return and the break-even month - AI usage policy
Our teams already use AI: what rules do we give them, in writing, this week?
≈ 4 min · A complete AI usage policy, ready to sign - Roadmap
In what order, and over how long?
≈ 3 min · Quarterly phases and what each one delivers