Free tool
Free Vendor Trust Check by Scarlet Risk
Small businesses rely on dozens of vendors that hold their data or connect to their systems. Before a full vendor risk assessment, it helps to know what a vendor already publishes about security. Enter a vendor's website and we'll list the public trust signals we could find. No signup needed.
We read up to eight public pages. A check usually takes 5–20 seconds.
What we check
- HTTPS on the homepage
- Whether the homepage loads over an encrypted connection.
- Privacy policy page
- A privacy policy linked from the site or at a common address.
- Terms of service page
- Published terms that set out the vendor's obligations.
- Security or trust page
- Pages like /security, /trust or /trust-center, or footer and menu links to them.
- Trust center platform link
- Links to hosted trust centers such as SafeBase, Whistic or Conveyor.
- security.txt
- A file at /.well-known/security.txt telling researchers how to report issues.
- Framework mentions
- Whether the pages we read mention SOC 2, ISO 27001, HIPAA or GDPR. Mentioned, not certified.
We fetch pages as ScarletRiskVendorTrustCheck, never store page contents, and keep only the checked domain, the time and which signals were found, for usage counts.
Vendor Trust Check FAQ
- What does the Vendor Trust Check look at?
- It reads up to eight public pages on the vendor's website and reports whether we found HTTPS on the homepage, a privacy policy, terms of service, a security or trust page, a trust center platform link and a security.txt file, plus whether the pages mention SOC 2, ISO 27001, HIPAA or GDPR.
- What doesn't it check?
- It does not scan, test or log in to the vendor's systems, read their security reports, or check private documents. It only looks at pages anyone can open in a browser, and it gives no score or verdict.
- How is this different from a full vendor risk assessment?
- A vendor risk assessment, sometimes called a vendor security assessment or third-party risk assessment, looks at what data the vendor handles, what access it has, its security questionnaire answers and its reports. The trust check is a quick first look at public signals before that deeper review.
- Why isn't a SOC 2 mention proof of certification?
- Anyone can write SOC 2 on a web page. A SOC 2 is an auditor's report, not a certificate, and only the report itself shows its scope, period and any exceptions. Ask the vendor for the current report, or an ISO 27001 certificate, before relying on it.