Skip to content

Commit 175d322

Browse files
j15zj15z
committed
fix(comparisons): verify compliance details and sources
Preserve existing comparison copy where accurate while adding verified certifications, report scope, access conditions, and source dates.
1 parent c2c11b2 commit 175d322

9 files changed

Lines changed: 57 additions & 38 deletions

File tree

‎apps/sim/app/(landing)/comparisons/components/fact-value/fact-value.tsx‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@ export function FactValue({ fact }: FactValueProps) {
3434
const isBoolean = status === 'yes' || status === 'no'
3535
const primarySource = fact.sources[0]
3636

37-
const fullText = [fact.value, fact.detail].filter(Boolean).join('. ')
37+
const detailSeparator = /[.!?]$/.test(fact.value.trimEnd()) ? ' ' : '. '
38+
const fullText = fact.detail ? `${fact.value}${detailSeparator}${fact.detail}` : fact.value
3839

3940
const glance = isBoolean ? (
4041
status === 'yes' ? (

‎apps/sim/lib/compare/data/competitors/langchain.ts‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -822,21 +822,27 @@ export const langchainProfile: CompetitorProfile = {
822822
},
823823
compliance: {
824824
value:
825-
"LangSmith is SOC 2 Type II, HIPAA, and GDPR compliant; LangGraph Platform (now LangSmith Deployment) shares LangSmith's SOC 2 attestation and compliance posture",
825+
"LangSmith is SOC 2 Type II, ISO/IEC 27001:2022, HIPAA, and GDPR compliant; LangGraph Platform (now LangSmith Deployment) shares LangSmith's SOC 2 attestation and compliance posture, and LangChain says its 2026 SOC 2 Type II report spans the entire LangSmith offering",
826826
detail:
827-
"LangChain's own docs and Trust Center state LangSmith is SOC 2 Type II, HIPAA compliant, and GDPR compliant; no ISO 27001, PCI-DSS, or FedRAMP attestation was found on LangChain's own compliance materials. The Trust Center is the canonical source but renders via client-side JavaScript, so it could not be directly verified by an automated fetch; the LangSmith certification is independently confirmed on the static Regions FAQ page.",
828-
shortValue: 'LangSmith/LangGraph SOC 2 Type II; HIPAA and GDPR compliant',
827+
"LangChain's own docs and Trust Center state LangSmith is SOC 2 Type II, ISO/IEC 27001:2022, HIPAA, and GDPR compliant. The 2026 SOC 2 Type II report covers Security, Availability, and Confidentiality for July 1, 2025 through June 30, 2026, with an unqualified opinion and no exceptions noted. Advantage Partners performed that examination and issued the ISO certification, which covers the systems, teams, and information assets supporting LangSmith and its LLM application tooling. The Trust Center is the canonical source, and the static Regions FAQ independently confirms SOC 2 Type II, HIPAA, and GDPR compliance. No PCI-DSS or FedRAMP attestation was found.",
828+
shortValue:
829+
'LangSmith/LangGraph SOC 2 Type II and ISO 27001:2022; HIPAA and GDPR compliant',
829830
confidence: 'verified',
830831
sources: [
832+
{
833+
url: 'https://trust.langchain.com/',
834+
label: 'LangChain Trust Center',
835+
asOf: '2026-09-03',
836+
},
831837
{
832838
url: 'https://docs.langchain.com/langsmith/regions-faq',
833839
label: 'Regions FAQ - Docs by LangChain',
834-
asOf: '2026-07-02',
840+
asOf: '2026-09-03',
835841
},
836842
{
837-
url: 'https://trust.langchain.com/',
838-
label: 'LangChain Trust Center',
839-
asOf: '2026-07-02',
843+
url: 'https://docs.langchain.com/langsmith/deployment',
844+
label: 'LangSmith Deployment - Docs by LangChain',
845+
asOf: '2026-09-03',
840846
},
841847
],
842848
},

‎apps/sim/lib/compare/data/competitors/make.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -908,7 +908,7 @@ export const makeProfile: CompetitorProfile = {
908908
value:
909909
'SOC 2 Type II, SOC 3, and ISO 27001 certified, plus GDPR adherence; no HIPAA, PCI, or FedRAMP mentioned',
910910
detail:
911-
"Make's Security page states the company operates an ISO 27001-certified information security program and runs infrastructure compliant with SOC 3 and SOC 2 Type II audits, alongside GDPR adherence (Make also has a dedicated GDPR page). HIPAA compliance is not mentioned or offered.",
911+
"Make's Security page states the company operates an ISO 27001-certified information security program and has completed a SOC 2 Type II audit, with its SOC 3 report publicly available, alongside GDPR adherence (Make also has a dedicated GDPR page). HIPAA compliance is not mentioned or offered.",
912912
shortValue: 'SOC 2 Type II, SOC 3, ISO 27001, GDPR; no HIPAA, PCI, or FedRAMP',
913913
confidence: 'verified',
914914
sources: [

‎apps/sim/lib/compare/data/competitors/microsoft-copilot.ts‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,15 @@ export const microsoftCopilotProfile: CompetitorProfile = {
1717
'Microsoft Copilot Studio is a low-code Microsoft tool for building, testing, and publishing conversational and autonomous AI agents with topics or LLM-driven generative orchestration, connectors, agent flows, and Dataverse-grounded knowledge.',
1818
standoutFeatures: [
1919
{
20-
title: 'Broad, independently audited compliance certification list',
20+
title: 'Broad compliance certification and attestation list',
2121
description:
22-
'Copilot Studio is certified under HIPAA (BAA), HITRUST CSF, FedRAMP, SOC, multiple ISO standards (9001, 20000-1, 22301, 27001, 27017, 27018, 27701), PCI DSS, CSA STAR, UK G-Cloud, Singapore MTCS Level 3, Korea K-ISMS, and Spain ENS, each with an audit report on the Microsoft Service Trust Portal.',
22+
'Copilot Studio documentation lists HIPAA under a Business Associate Agreement, HITRUST CSF, FedRAMP for applicable Microsoft government cloud services, SOC, multiple ISO standards (9001, 20000-1, 22301, 27001, 27017, 27018, 27701), PCI DSS, CSA STAR, UK G-Cloud, OSPAR, Singapore MTCS Level 3, Korea K-ISMS, and Spain ENS. SOC audit reports and ISO certificates and assessment reports are available through the Microsoft Service Trust Portal.',
2323
shortDescription:
24-
'HIPAA, FedRAMP, SOC, multiple ISO standards, PCI DSS, and more, each audited.',
24+
'HIPAA, applicable government-cloud FedRAMP, SOC, multiple ISO standards, PCI DSS, OSPAR, and more.',
2525
source: {
2626
url: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-certification',
2727
label: 'Review ISO, SOC, and HIPAA compliance - Microsoft Copilot Studio | Microsoft Learn',
28-
asOf: '2026-07-02',
28+
asOf: '2026-09-03',
2929
},
3030
},
3131
{
@@ -955,23 +955,23 @@ export const microsoftCopilotProfile: CompetitorProfile = {
955955
},
956956
compliance: {
957957
value:
958-
'SOC 2 Type 2 (Copilot Studio is named in scope), HIPAA (Business Associate Agreement), HITRUST CSF, FedRAMP, multiple ISO standards (9001, 20000-1, 22301, 27001, 27017, 27018, 27701), PCI DSS, CSA STAR, UK G-Cloud, Singapore MTCS Level 3, Korea K-ISMS, and Spain ENS, each with an audit report on the Microsoft Service Trust Portal',
958+
'SOC 2 Type 2 (Copilot Studio is named in the Azure attestation report scope), HIPAA (Business Associate Agreement), HITRUST CSF, FedRAMP for applicable Microsoft government cloud services, multiple ISO standards (9001, 20000-1, 22301, 27001, 27017, 27018, 27701), PCI DSS, CSA STAR, UK G-Cloud, OSPAR, Singapore MTCS Level 3, Korea K-ISMS, and Spain ENS, with SOC audit reports and ISO certificates and assessment reports available through the Microsoft Service Trust Portal',
959959
detail:
960-
'This is the full list from Copilot Studio\'s admin-certification documentation. Each certification links to a corresponding audit report or certificate. That page confirms SOC compliance without naming the report type; Microsoft\'s dedicated SOC 2 Type 2 offering page lists the product under its former name, "Copilot Studios," resolving the applicable report type and scope.',
960+
"This is the full list from Copilot Studio's admin-certification documentation. The assurance form varies by program: Microsoft describes HIPAA as BAA coverage, OSPAR as an attestation, SOC and CSA STAR as audited, and UK G-Cloud as supplier self-attestation with verification at the government's discretion. Downloading SOC reports requires an existing Office 365 subscription or free trial. The admin page confirms SOC compliance without naming the report type; Microsoft's dedicated SOC 2 Type 2 page lists the product under its former name, \"Copilot Studios,\" resolving the applicable report type and scope.",
961961
shortValue:
962-
'SOC 2 Type 2, HIPAA, HITRUST, FedRAMP, multiple ISO standards, PCI DSS, and more',
962+
'SOC 2 Type 2, HIPAA, HITRUST, applicable government-cloud FedRAMP, multiple ISO standards, PCI DSS, OSPAR, and more',
963963
confidence: 'verified',
964964
sources: [
965965
{
966966
url: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-certification',
967967
label:
968968
'Review ISO, SOC, and HIPAA compliance - Microsoft Copilot Studio | Microsoft Learn',
969-
asOf: '2026-07-02',
969+
asOf: '2026-09-03',
970970
},
971971
{
972972
url: 'https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-2',
973973
label: 'SOC 2 Type 2 - Microsoft Compliance | Microsoft Learn',
974-
asOf: '2026-07-04',
974+
asOf: '2026-09-03',
975975
},
976976
],
977977
},

‎apps/sim/lib/compare/data/competitors/openai-agentkit.ts‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -893,18 +893,23 @@ export const openaiAgentkitProfile: CompetitorProfile = {
893893
},
894894
compliance: {
895895
value:
896-
'FedRAMP Moderate Authorization (ChatGPT Enterprise and API Platform), PCI DSS v4.0.1, SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 27701:2019; supports customer HIPAA compliance via BAA and GDPR/CCPA via DPA; FERPA covered via a separate Student Data Privacy Agreement for ChatGPT Edu',
896+
'FedRAMP Moderate Authorization (ChatGPT Enterprise and API Platform), PCI DSS v4.0.1, SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 27701:2019, and ISO/IEC 42001:2023; supports customer HIPAA compliance via BAA and GDPR/CCPA via DPA; FERPA covered via a separate Student Data Privacy Agreement for ChatGPT Edu',
897897
detail:
898-
"OpenAI's ChatGPT Enterprise and API Platform hold FedRAMP Moderate (Class C) authorization per the FedRAMP Marketplace listing. OpenAI's most recent SOC 2 report covers January 1, 2025 through June 30, 2025 for the Security, Availability, Confidentiality, and Privacy Trust Services Criteria across the API Platform, ChatGPT Enterprise, ChatGPT Edu, and ChatGPT Team. OpenAI's trust portal also lists PCI DSS v4.0.1 for payment-processing components, plus ISO/IEC 27001:2022, 27017:2015, 27018:2019, and 27701:2019 certifications, and lists GDPR and CCPA. OpenAI offers a Data Processing Addendum for GDPR/CCPA and a Business Associate Agreement for HIPAA-regulated customers on ChatGPT Enterprise/Edu and the API (not standard ChatGPT Business); this is enablement rather than OpenAI itself being HIPAA-certified, since HIPAA has no formal certification body. FERPA compliance for ChatGPT Edu/for Teachers runs through a separate Student Data Privacy Agreement rather than the general DPA.",
899-
shortValue: 'FedRAMP Moderate, PCI DSS, SOC 2, ISO 27001/27701, HIPAA BAA',
898+
"OpenAI's ChatGPT Enterprise and API Platform hold FedRAMP Moderate (Class C) authorization per the FedRAMP Marketplace listing. OpenAI's most recent SOC 2 report covers July 1, 2025 through June 30, 2026 for the Security, Availability, Confidentiality, and Privacy Trust Services Criteria across ChatGPT Business, ChatGPT Enterprise, ChatGPT for Education, ChatGPT for Healthcare, ChatGPT for Teachers, the API Platform, Codex, and OpenAI Presence, as listed in OpenAI's current Product Compliance Status matrix. OpenAI's trust portal also lists PCI DSS v4.0.1 for payment-processing components, plus ISO/IEC 27001:2022, 27017:2015, 27018:2019, and 27701:2019 certifications, and lists GDPR and CCPA. OpenAI also maintains an ISO/IEC 42001:2023 AI Management System covering its consumer and business AI products and models. OpenAI offers a Data Processing Addendum for GDPR/CCPA and a Business Associate Agreement for HIPAA-regulated customers on ChatGPT Enterprise/Edu and the API (not standard ChatGPT Business); this is enablement rather than OpenAI itself being HIPAA-certified, since HIPAA has no formal certification body. FERPA compliance for ChatGPT Edu/for Teachers runs through a separate Student Data Privacy Agreement rather than the general DPA.",
899+
shortValue: 'FedRAMP Moderate, PCI DSS, SOC 2, ISO 27001/27701/42001, HIPAA BAA',
900900
confidence: 'verified',
901901
sources: [
902+
{ url: 'https://trust.openai.com/', label: 'OpenAI Trust Portal', asOf: '2026-09-04' },
903+
{
904+
url: 'https://openai.com/product-compliance-status/',
905+
label: 'Product compliance status | OpenAI',
906+
asOf: '2026-09-04',
907+
},
902908
{
903909
url: 'https://www.fedramp.gov/marketplace/products/FR2533155773/',
904910
label: 'ChatGPT Enterprise and API Platform | FedRAMP Marketplace',
905-
asOf: '2026-07-08',
911+
asOf: '2026-09-04',
906912
},
907-
{ url: 'https://trust.openai.com/', label: 'OpenAI Trust Portal', asOf: '2026-07-08' },
908913
{
909914
url: 'https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai',
910915
label:
@@ -914,7 +919,7 @@ export const openaiAgentkitProfile: CompetitorProfile = {
914919
{
915920
url: 'https://openai.com/security-and-privacy/',
916921
label: 'Security and privacy at OpenAI',
917-
asOf: '2026-07-02',
922+
asOf: '2026-09-04',
918923
},
919924
],
920925
},

‎apps/sim/lib/compare/data/competitors/openclaw.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -866,7 +866,7 @@ export const openClawProfile: CompetitorProfile = {
866866
},
867867
compliance: {
868868
value:
869-
'No compliance certifications (no SOC 2, HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP). As open-source, self-hosted software from a non-profit Foundation, OpenClaw is not the kind of vendor entity that typically pursues these certifications; compliance posture depends entirely on how and where the operator self-hosts it.',
869+
'OpenClaw publishes no compliance certifications (no SOC 2, HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP). As open-source, self-hosted software from a non-profit Foundation, OpenClaw is not the kind of vendor entity that typically pursues these certifications; compliance posture depends entirely on how and where the operator self-hosts it.',
870870
detail:
871871
"OpenClaw publishes no SOC 2 attestation, trust center, or audit report; responsibility for infrastructure security and compliance rests entirely with the self-hosting operator. China restricted state enterprises and government agencies from deploying OpenClaw in March 2026 over security concerns, per Wikipedia's history summary, a data point on the compliance/trust landscape rather than a certification.",
872872
shortValue: 'No SOC 2 or other certifications; compliance depends on self-hosting operator',

‎apps/sim/lib/compare/data/competitors/vellum.ts‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,14 @@ export const vellumProfile: CompetitorProfile = {
1818
'Vellum is an enterprise AI development platform for building, evaluating, and deploying LLM prompts, workflows, and agents.',
1919
standoutFeatures: [
2020
{
21-
title: 'HIPAA compliance with a signable BAA',
21+
title: 'HIPAA compliance',
2222
description:
23-
'Vellum is HIPAA compliant and enterprise customers can sign a Business Associate Agreement for handling protected health information, corroborated by a third-party Drata case study. Sim does not currently offer HIPAA compliance (both platforms hold SOC 2 Type 2).',
24-
shortDescription: 'HIPAA compliant with a signable BAA; Sim does not offer HIPAA.',
23+
'Vellum is HIPAA compliant, as documented by Vellum and corroborated by a third-party Drata case study. Sim does not currently offer HIPAA compliance (both platforms hold SOC 2 Type 2).',
24+
shortDescription: 'HIPAA compliant; Sim does not offer HIPAA.',
2525
source: {
26-
url: 'https://drata.com/customers/vellum',
27-
label: 'Vellum Case Study: Drata',
28-
asOf: '2026-07-02',
26+
url: 'https://docs.vellum.ai/product/security/data-privacy-and-storage',
27+
label: 'Vellum Docs: Data Privacy and Storage',
28+
asOf: '2026-09-03',
2929
},
3030
},
3131
{
@@ -804,21 +804,21 @@ export const vellumProfile: CompetitorProfile = {
804804
},
805805
compliance: {
806806
value:
807-
'SOC 2 Type 2 and HIPAA compliant, with a BAA available for enterprise customers; no other certifications (ISO 27001, GDPR-specific attestation, PCI, FedRAMP) confirmed',
807+
'SOC 2 Type 2 and HIPAA compliant; a Drata case study also notes SOC 2 Type 1; no other certifications (ISO 27001, GDPR-specific attestation, PCI, FedRAMP) confirmed',
808808
detail:
809-
"Vellum's docs state it is HIPAA compliant and that enterprise customers can sign a Business Associate Agreement (BAA). A third-party Drata case study also notes its SOC 2 Type 1 and Type 2 attestations. No mention of ISO 27001, PCI, or FedRAMP certification was found.",
810-
shortValue: 'SOC 2 Type 2, HIPAA + BAA; no other certs confirmed',
809+
"Vellum's docs state it is SOC 2 Type 2 and HIPAA compliant. A third-party Drata case study also notes its SOC 2 Type 1 and Type 2 attestations. Neither cited source states that Vellum offers a Business Associate Agreement. No mention of ISO 27001, a GDPR-specific attestation, PCI, or FedRAMP certification was found.",
810+
shortValue: 'SOC 2 Type 2, HIPAA; no other certs confirmed',
811811
confidence: 'verified',
812812
sources: [
813813
{
814814
url: 'https://docs.vellum.ai/product/security/data-privacy-and-storage',
815815
label: 'Vellum Docs: Data Privacy and Storage',
816-
asOf: '2026-07-02',
816+
asOf: '2026-09-03',
817817
},
818818
{
819819
url: 'https://drata.com/customers/vellum',
820820
label: 'Vellum Case Study: Drata',
821-
asOf: '2026-07-02',
821+
asOf: '2026-09-03',
822822
},
823823
],
824824
},

‎apps/sim/lib/compare/data/competitors/workato.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -947,14 +947,14 @@ export const workatoProfile: CompetitorProfile = {
947947
value:
948948
'SOC1 Type II, SOC2 Type II, SOC3, ISO 27001, ISO 27701, ISO 42001, HIPAA (BAA), PCI-DSS v4.0.1 Level 1, IRAP (PROTECTED, Australia), NIST 800-171A r2',
949949
detail:
950-
"Workato's certifications go well beyond SOC 2: SOC 1 Type II covers financial reporting controls, while its SOC 2 Type II report is aligned to the AICPA Trust Services Criteria and is available to customers under NDA. ISO 27001 covers infosec management, ISO 27701 covers privacy (PIMS extending 27001, aligning with GDPR handling of PII), ISO 42001 covers AI governance, HIPAA compliance runs through signable BAAs with annual third-party attestation, PCI-DSS v4.0.1 Level 1 covers cardholder data, IRAP is assessed at the Australian government PROTECTED level, and NIST 800-171A r2 supports federal contractors handling Controlled Unclassified Information. There is no FedRAMP authorization or a standalone GDPR certification; GDPR compliance is represented through the ISO 27701 PIMS alignment.",
950+
"Workato's certifications go well beyond SOC 2: SOC 1 Type II covers financial reporting controls, while its SOC 2 Type II report is aligned to the AICPA Trust Services Criteria and is available to customers under NDA. Its SOC 3 report is publicly available without an NDA and available upon request. ISO 27001 covers infosec management, ISO 27701 covers privacy (PIMS extending 27001, aligning with GDPR handling of PII), ISO 42001 covers AI governance, HIPAA compliance runs through signable BAAs with annual third-party attestation, PCI-DSS v4.0.1 Level 1 covers cardholder data, IRAP is assessed at the Australian government PROTECTED level, and NIST 800-171A r2 supports federal contractors handling Controlled Unclassified Information. There is no FedRAMP authorization or a standalone GDPR certification; GDPR compliance is represented through the ISO 27701 PIMS alignment.",
951951
shortValue: 'SOC 1/2/3, ISO 27001/27701/42001, HIPAA, PCI-DSS, IRAP, NIST',
952952
confidence: 'verified',
953953
sources: [
954954
{
955955
url: 'https://docs.workato.com/security/security-compliance.html',
956956
label: 'Security compliance | Workato docs',
957-
asOf: '2026-07-02',
957+
asOf: '2026-09-03',
958958
},
959959
{
960960
url: 'https://www.workato.com/platform/security',

0 commit comments

Comments
 (0)