How we score
TrustHawk scores the company behind an AI product, not the model itself. The score is out of 100. The same public rules apply to every company. Companies do not pay for a higher score, and each rating links to its sources.
We publish the scores so the companies can be compared, and so they have a reason to improve. That is why TrustHawk exists.
How the score works
Where the data comes from
Public pages, regulators, independent research, and reports of harm. We separate what the company says from what others found.
How a score is made
Good practice raises a score. Harm, breaches, security flaws and fines lower it. Recent and serious events count more than old or minor ones. The site refreshes the scores once a day. Each part below is out of 100 and worth 25%.
When a company isn't ranked
If a part has real data for less than 70% of the checks a source could answer, the company is not ranked. The checks we have are still shown. When an outside rating does not cover a company, the score uses the average of the companies that rating covers, so the gap neither helps nor hurts the score. That average never counts as evidence or coverage, so confidence is lower. We do not mark the company down to fill the gap.
Low confidence
Low confidence means we found few checked facts about this company, so its score may change as more evidence comes in. A company is Low when confidence is under 20. A covered check that finds no events, and a company statement backed by a verified quote, count at half. An unanswered check or a filled-in average counts as zero.
AI never sets a score
We use it only to pull quotes from a company's public pages, so we can answer a fixed list of questions. Fixed rules turn those answers into the score.
Safety
Does the company test its AI properly and keep people safe from harm?
Assessment criteria
Criteria
- A clear plan for spotting and managing serious risks
- Testing before new models are released, including by outside experts
- How its models perform in independent safety tests
- Real-world incidents where its AI caused harm
- Protections for children
Sources
- Court records
- Independent safety tests and research benchmarks
- Independent sources
- Companies' own published policies and documents
Transparency
Is the company open about how its AI is built and how it behaves?
Assessment criteria
Criteria
- Clear documentation of what each model can and cannot do
- How much it shares about the data its models learn from
- Independent ratings of its openness
- Regular reports on real-world impact
- Public safety commitments it has signed
Sources
- Independent sources
- Companies' own published policies and documents
Security
Does the company protect its products and your information from attack?
Assessment criteria
Criteria
- A way for researchers to report security flaws
- Recognised security certifications
- Security flaws found in its official software
- Data breaches affecting its users
A certificate or audit report only counts if it covers the company's scored AI product or core service.
For SOC 2, an explicit statement on the company's own site that it has a SOC 2 Type II report, or is certified, audited or compliant for SOC 2 Type II, counts as a company claim. Type I, a report still in progress, or a logo with no words does not count.
For every other standard, such as ISO 27001, a statement that a company "complies with" or is "aligned with" it does not count. We need a certificate or an audit, or a listing on the company's trust page.
Sources
- Official government and regulator records
- Public security and breach databases
- Companies' own published policies and documents
Privacy
Does the company respect your personal data and give you control over it?
Assessment criteria
Criteria
- A privacy policy that is clear about what is collected and shared
- Whether your chats train its AI by default, and if you can opt out
- Easy ways to download or delete your data
- Independent privacy ratings
- Fines, regulator actions and court rulings over privacy or fair dealing
Sources
- Official government and regulator records
- Court records
- Companies' own published policies and documents
Current scoring method
Formulas, source weights, and the list of checks
How the score adds up
Overall
25% Safety + 25% Transparency + 25% Security + 25% PrivacyPillar
sum(weight x score) / sum(weight)- Independent source, regulator and allegation checks count at full weight.
- Company claims count at 60%.
- No outside index carries more than 10% of the overall score, counted across every part it appears in.
Checklists
points earned / points possible x 100- The score is the share of available points the company earns.
Events and records
Event records
70 x e^(-k x load), k = ln 2 / 10- The score halves for every 10 points of severity times recency.
- Recency itself halves every 12 months. The look-back is 24, 36 or 60 months depending on the source.
- Reports use half the severity load, so a small fine cannot score above a clean record.
- Regulator actions and open investigations into a company's AI products also use half the severity load.
Records only lower a score
lower or hold, never raise- A record check counts only when a source covers the company: the source lists the company at any date, or holds its official software packages.
- With no covering source, the check is left out of the score and of coverage, so confidence is lower. It is never counted as a clean record.
- When a source covers the company, zero events holds the part at the mean of its other checks. Each recorded event takes its weight share times (70 minus the record score) off that mean. The same scale applies to every company.
- The security score cannot pass the mean of the security programme with the vulnerability and breach checks each at 70. This ceiling is the same for every company.
- A covered check with zero events counts at half toward confidence.
Reported incidents
High 10, Medium 3, Low 1- Rows in the AI Incident Database and the AIAAIC Repository are reports, not proven findings. An incident in both counts once.
- Any incident where a real person died or self-harmed, or is alleged to have, is rated High.
Software flaws
known exploited only- A disclosed and fixed flaw does not lower the score. Only flaws on the CISA list of known exploited vulnerabilities count.
Keeping the last value
last value for 14 days, then 0- A confirmed answer or scored check that can no longer be confirmed keeps its last value for 14 days, then scores 0 if it is still unconfirmed.
Security
Security cap
capped at 85- The cap is lifted when a third-party bug bounty is in the evidence.
Security markers
- Verified bug bounty: a third-party bounty is in the evidence.
- Company claims plus no adverse record: the security programme scores above 0, and both the vulnerability and breach checks are covered by a source and found nothing.
- Company claims only, no independent security checks: the company states a security programme and no source covers either check.
- No security claims found, no independent checks: the programme score is 0 and no source covers either check.
- Company claims plus one independent security check: a source covers exactly one check and it found nothing.
- When that check found records, the marker shows the count, such as Company claims; 34 advisories.
Confidence and changes
Confidence
100 x (0.7 x evidence share + 0.3 x coverage)- Evidence share is taken over the weight every check would have if it were answered, so an unanswered check or a filled-in average counts as zero.
- Independent sources, an event check that found something, and a verified third-party bug bounty count in full. A covered event check with zero events, and a company statement backed by a verified quote, count at half.
- Coverage is the share of checks with a real score. A filled-in average is not a real score.
- High is 50 or more, Medium is 20 to 49, and Low is under 20.
Change reasons
tag a move of 3 or more; hold a move of 5 or more- A headline move of 3 or more points is Method update, New evidence, or Data fix.
- A move of 5 or more keeps the previous score unless the reason is new evidence or a method update.
Each scored check starts at its source-type multiplier. The multipliers are scaled so they add up inside the part.
One outside index still cannot be more than 10% of the overall score, counted across every part it appears in. A part made only of company claims is unchanged, because every multiplier is the same.
| Source type | Multiplier | What it is |
|---|---|---|
| Independent source | 1.0 | An outside index or research group. |
| Regulator | 1.0 | A regulator or an official public record. |
| Company claim | 0.6 | The company's own documents. |
| Allegation | 1.0 | A report or a claim, not a proven finding. The severity load is halved. |
Each part of a company page shows two bars: what the company says, and what others found. Clean records of 70 stay out of the second bar, and a gap of 20 or more is noted.
| Check | Source type | What the company says, or what others found |
|---|---|---|
| Model documentation | Company claim | What the company says |
| Training-data disclosure (Stanford transparency index and the AI Accountability Lab) | Independent source | What others found |
| Independent transparency index (Stanford) | Independent source | What others found |
| Transparency reports (Partnership on AI) | Company claim | What others found |
| Public safety commitments | Company claim | What the company says |
| Safety framework (SaferAI) | Independent source | What the company says |
| Pre-release testing | Company claim | What the company says |
| Safety test results | Independent source | What others found |
| Incident record (AI Incident Database and AIAAIC Repository) | Allegation | What others found |
| Protecting children | Company claim | What the company says |
| Clear privacy policy | Company claim | What the company says |
| Training-data defaults | Company claim | What the company says |
| Export and delete your data | Company claim | What the company says |
| Privacy fines (European privacy regulators) | Regulator | What others found |
| Independent privacy ratings (Incogni) | Independent source | What others found |
| Risk governance (SaferAI) | Independent source | What the company says |
| Regulator actions (UK competition regulator, the US Department of Justice, and regulator investigations of AI products) | Regulator | What others found |
| Court judgments (CourtListener) | Regulator | What others found |
| Privacy contact and complaints | Company claim | What the company says |
| Security programme and certifications | Company claim | What the company says |
| Software vulnerabilities (known exploited flaws in GitHub security advisories, CISA list) | Independent source | What others found |
| Data breaches (Have I Been Pwned) | Independent source | What others found |
SaferAI safety-framework and risk-governance ratings are independent sources on a written policy, so they count as what the company says.
Scoring method updates
Death and self-harm incidents rated High
Any incident where a real person died or self-harmed, or is alleged to have, is rated High.
Full detail
Xiaomi's headline score fell from 43 to 42, and its Safety score fell from 47.4 to 46.1.
Safety also fell for Character.AI from 33.6 to 32.8, Microsoft from 42.8 to 41.5 and xAI from 51.1 to 50.5, without a change to their headline scores.
Clearer evidence rules and new evidence
Every answer was checked again against clearer rules for what a quote must show, and new evidence was added for companies we had little on.
Full detail
A privacy contact counts only when the page gives an email, a form or a working link. A minimum age counts only when the policy sets one or says the service is not for children.
A security reporting route, the personal data collected, a SOC 2 Type II report and use for AI training each count only when the page says so. A policy that does not train on your data unless you agree counts as opt in.
Results shown only in an image or a table of numbers are quoted by their heading, with a note after the quote.
Headline scores changed by 0.2 points on average. 12 companies rose and 20 fell. The biggest rise was 10 points (xAI) and the biggest fall 8 points (Speechify). Scores before this date stay as published.
Top 10 after this update: Anthropic 71, OpenAI 67, IBM 60, Black Forest Labs 60, Microsoft 58, xAI 56, Harrison.ai 56, AI21 Labs 56, Google DeepMind 55, ServiceNow 54.
Of the 149 ranked companies, 49 are Low confidence, 89 are Medium and 11 are High.
Records can only lower a score, and missing evidence lowers confidence
A record check now counts only when a source covers the company, and it can only lower or hold a score. Checks with no data count as zero evidence, so confidence is lower where we know less.
Full detail
Before this, a clean record check scored 70 and could lift a part above the company's other checks. A company with an old breach on file, or official software packages, got that lift and others did not. Now a record check counts only when a source covers the company. Zero events holds the part where it is, and each recorded event takes points off. A record never raises a score.
Incidents now come from the AI Incident Database and the AIAAIC Repository. An incident in both counts once.
A disclosed and fixed software flaw no longer lowers the score. Only flaws on the CISA list of known exploited vulnerabilities count.
Regulator actions and open investigations into a company's AI products now count at half severity. This includes the investigations into Grok sexualised imagery by Ofcom, the European Commission and the California Attorney General.
When an outside rating does not cover a company, the score still uses the average of the companies it covers, so the gap neither helps nor hurts. That average, and any unanswered check, now counts as zero evidence and zero coverage. No outside index carries more than 10% of the overall score, counted across every part it appears in.
Trust centre pages that only load in a browser are now read, and answers that needed a human review were checked against the company's own page and recorded with the link. Salesforce now gets credit for its SOC 2 report and ISO 27001 certificate.
Headline scores changed by 0.2 points on average. 95 companies rose and 44 fell. The biggest rise was 16 points (Salesforce) and the biggest fall 11 points (Moonshot AI). Low confidence companies were 29 before this update. Scores before this date stay as published.
Top 10 after this update: Anthropic 71, OpenAI 67, IBM 61, Microsoft 60, Black Forest Labs 60, Mistral AI 57, AI21 Labs 56, Amazon 55, Google DeepMind 55, ServiceNow 54.
Clean records and verified statements count toward confidence
A covered check with no events, and a company statement backed by a verified quote, now count at half toward confidence.
Full detail
A clean public record was treated like a gap, so most companies sat in one band. Half credit and a Low cut-off of 20 separate companies by how many facts were checked.
Before this, 131 companies were Low, 21 were Medium, and 8 were High. After it, 29 are Low, 120 are Medium, and 11 are High. Scores and ranks are unchanged.
Source weights and clean records of 70
Independent checks now count at full weight, and company claims count at 60%. A covered check that finds nothing scores 70.
Full detail
Independent checks count at full weight and company claims at 60%, so a stack of company statements does not outweigh an outside source. A covered check that finds nothing scores 70 and stays in the pillar.
A move of 5 or more points keeps the previous published score unless the cause is new evidence or a method change.
Headline scores fell about 1.7 points on average, by up to 8 points (OpenAI and xAI). The biggest rise was 2 points.
Top 10 after this update: IBM 63, OpenAI 63, Anthropic 61, Black Forest Labs 58, Amazon 56, Microsoft 56, Mistral 55, xAI 55, Apple 55, AI21 Labs 55.
Reported incidents, security cap, carry-forward, and change reasons
Incident reports are graded by how serious they are. Security stays at 85 or below unless a third-party bug bounty is verified. A check that can no longer be confirmed keeps its last value for 14 days.
Full detail
A report is not a proven finding, so High counts 10, Medium counts 3, and Low counts 1.
With the stricter incident levels, Black Forest Labs fell about 2 points and xAI rose about 0.5.
A headline move of 3 or more points is tagged as a method change, new evidence, or a data fix.
Spotted a mistake?
Companies, journalists and readers can ask for a correction at any time. Contact us and we'll check it against our method.