fix(comparisons): preserve competitor compliance details

Author: j15z

apps/sim/lib/compare/data/competitors/claude-cowork.ts

@@ -809,16 +809,21 @@ export const claudeCoworkProfile: CompetitorProfile = {
       },
       additionalCompliance: {
         value:
-          'ISO 27001:2022, ISO/IEC 42001:2023, HIPAA-ready (BAA via sales-assisted Enterprise)',
+          'SOC 2 Type I and Type II (company-wide, not Cowork-specific), ISO 27001:2022, ISO/IEC 42001:2023, HIPAA-ready (BAA via sales-assisted Enterprise)',
         detail: 'Company-wide Anthropic certifications, not Cowork-scoped.',
-        shortValue: 'ISO 27001, ISO 42001, HIPAA-ready',
+        shortValue: 'SOC 2 Type I/II, ISO 27001, ISO 42001, HIPAA-ready',
         confidence: 'estimated',
         sources: [
           {
             url: 'https://support.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained',
             label: 'What Certifications has Anthropic obtained?',
             asOf: '2026-07-08',
           },
+          {
+            url: 'https://trust.anthropic.com/',
+            label: 'Anthropic Trust Center',
+            asOf: '2026-07-02',
+          },
         ],
       },
       modelAndToolGovernance: {

apps/sim/lib/compare/data/competitors/crewai.ts

@@ -848,10 +848,10 @@ export const crewaiProfile: CompetitorProfile = {
       },
       additionalCompliance: {
         value:
-          'HIPAA (Enterprise edition, audit report dated February 2026); no ISO 27001, PCI, or FedRAMP certification confirmed',
+          'SOC 2 Type 1 for CrewAI AMP (audit report dated November 2025) and HIPAA for the Enterprise edition (audit report dated February 2026); no ISO 27001, PCI, or FedRAMP certification confirmed',
         detail:
           "CrewAI's Trust Center lists a HIPAA Audit Report dated February 2026 for the Enterprise edition, alongside the SOC 2 Type 1 report. CrewAI's pricing page separately references 'FedRamp High compliance' language for its Enterprise tier, but no independent FedRAMP authorization listing corroborates that claim, so it is not treated as confirmed here.",
-        shortValue: 'HIPAA audit (Feb 2026); FedRAMP claim unconfirmed',
+        shortValue: 'SOC 2 Type 1 (AMP), HIPAA audit (Feb 2026); FedRAMP claim unconfirmed',
         confidence: 'estimated',
         sources: [
           {

apps/sim/lib/compare/data/competitors/flowise.ts

@@ -722,7 +722,7 @@ export const flowiseProfile: CompetitorProfile = {
       additionalCompliance: {
         value:
           'Unknown: beyond the unconfirmed third-party SOC 2 claim, Flowise has published no HIPAA, ISO 27001, PCI, or FedRAMP certification.',
-        shortValue: 'Unknown, no official certifications published',
+        shortValue: 'SOC 2 claim unconfirmed; no official certifications published',
         confidence: 'unknown',
         sources: [],
       },

apps/sim/lib/compare/data/competitors/langflow.ts

@@ -739,8 +739,8 @@ export const langflowProfile: CompetitorProfile = {
       },
       additionalCompliance: {
         value:
-          'Unknown: no public documentation or official page confirms HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP certification for Langflow.',
-        shortValue: 'Unknown, no compliance certifications documented',
+          'Unknown: no public documentation or official page confirms SOC 2, HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP certification for Langflow.',
+        shortValue: 'Unknown, no SOC 2 or other compliance certifications documented',
         confidence: 'unknown',
         sources: [],
       },

apps/sim/lib/compare/data/competitors/make.ts

@@ -923,7 +923,7 @@ export const makeProfile: CompetitorProfile = {
           'SOC 2 Type II, SOC 3, and ISO 27001 certified, plus GDPR adherence; no HIPAA, PCI, or FedRAMP mentioned',
         detail:
           "Make's Security page states the company operates an ISO 27001-certified information security program and runs infrastructure compliant with SOC 3 and SOC 2 Type II audits, alongside GDPR adherence (Make also has a dedicated GDPR page). HIPAA compliance is not mentioned or offered.",
-        shortValue: 'No HIPAA, PCI, or FedRAMP',
+        shortValue: 'SOC 2 Type II, SOC 3, ISO 27001, GDPR; no HIPAA, PCI, or FedRAMP',
         confidence: 'verified',
         sources: [
           {

apps/sim/lib/compare/data/competitors/microsoft-copilot.ts

@@ -976,10 +976,11 @@ export const microsoftCopilotProfile: CompetitorProfile = {
       },
       additionalCompliance: {
         value:
-          'HIPAA (Business Associate Agreement), HITRUST CSF, FedRAMP, multiple ISO standards (9001, 20000-1, 22301, 27001, 27017, 27018, 27701), PCI DSS, CSA STAR, UK G-Cloud, Singapore MTCS Level 3, Korea K-ISMS, and Spain ENS, each with an audit report on the Microsoft Service Trust Portal',
+          'SOC 2 Type 2 (Copilot Studio is named in scope), HIPAA (Business Associate Agreement), HITRUST CSF, FedRAMP, multiple ISO standards (9001, 20000-1, 22301, 27001, 27017, 27018, 27701), PCI DSS, CSA STAR, UK G-Cloud, Singapore MTCS Level 3, Korea K-ISMS, and Spain ENS, each with an audit report on the Microsoft Service Trust Portal',
         detail:
           "This is the full list from Copilot Studio's admin-certification documentation. Each certification links to a corresponding audit report or certificate.",
-        shortValue: 'HIPAA, HITRUST, FedRAMP, multiple ISO standards, PCI DSS, CSA STAR, and more',
+        shortValue:
+          'SOC 2 Type 2, HIPAA, HITRUST, FedRAMP, multiple ISO standards, PCI DSS, and more',
         confidence: 'verified',
         sources: [
           {
@@ -988,6 +989,11 @@ export const microsoftCopilotProfile: CompetitorProfile = {
               'Review ISO, SOC, and HIPAA compliance - Microsoft Copilot Studio | Microsoft Learn',
             asOf: '2026-07-02',
           },
+          {
+            url: 'https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-2',
+            label: 'SOC 2 Type 2 - Microsoft Compliance | Microsoft Learn',
+            asOf: '2026-07-04',
+          },
         ],
       },
       modelAndToolGovernance: {

apps/sim/lib/compare/data/competitors/openclaw.ts

@@ -881,10 +881,10 @@ export const openClawProfile: CompetitorProfile = {
       },
       additionalCompliance: {
         value:
-          'No compliance certifications (no HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP). As open-source, self-hosted software from a non-profit Foundation, OpenClaw is not the kind of vendor entity that typically pursues these certifications; compliance posture depends entirely on how and where the operator self-hosts it.',
+          'No compliance certifications (no SOC 2, HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP). As open-source, self-hosted software from a non-profit Foundation, OpenClaw is not the kind of vendor entity that typically pursues these certifications; compliance posture depends entirely on how and where the operator self-hosts it.',
         detail:
           "China restricted state enterprises and government agencies from deploying OpenClaw in March 2026 over security concerns, per Wikipedia's history summary, a data point on the compliance/trust landscape rather than a certification.",
-        shortValue: 'None documented; compliance posture depends on self-hosting operator',
+        shortValue: 'No SOC 2 or other certifications; compliance depends on self-hosting operator',
         confidence: 'estimated',
         sources: [
           {

apps/sim/lib/compare/data/competitors/power-automate.ts

@@ -966,10 +966,11 @@ export const powerAutomateProfile: CompetitorProfile = {
       },
       additionalCompliance: {
         value:
-          'HIPAA/HITECH (Microsoft will sign a BAA as a business associate) and inclusion in the broader Office 365/Azure compliance program, which separately covers ISO 27001, FedRAMP, and other certifications at the Azure/Office 365 platform level. The SOC 2 Type 2 report also incorporates the Cloud Security Alliance CCM and German BSI C5:2020 criteria.',
+          'SOC 2 Type 2 in-scope for Commercial and GCC environments only; HIPAA/HITECH (Microsoft will sign a BAA as a business associate); and inclusion in the broader Office 365/Azure compliance program, which separately covers ISO 27001, FedRAMP, and other certifications at the Azure/Office 365 platform level. The SOC 2 Type 2 report also incorporates the Cloud Security Alliance CCM and German BSI C5:2020 criteria.',
         detail:
           "HIPAA/BAA support and CSA CCM/BSI C5:2020 coverage are documented directly in Microsoft's SOC 2 documentation. No Power Automate-specific ISO 27001/FedRAMP attestation page exists, so treat those two as platform-level coverage rather than product-specific certification.",
-        shortValue: 'HIPAA/BAA, CSA CCM, BSI C5:2020; ISO/FedRAMP at platform level',
+        shortValue:
+          'SOC 2 Type 2 (Commercial/GCC), HIPAA/BAA, CSA CCM, BSI C5; ISO/FedRAMP platform-level',
         confidence: 'estimated',
         sources: [
           {

apps/sim/lib/compare/data/competitors/stackai.ts

@@ -748,10 +748,10 @@ export const stackaiProfile: CompetitorProfile = {
       },
       additionalCompliance: {
         value:
-          'ISO 27001 certified, and audited against HIPAA in the same review cycle as its SOC 2 Type II audit, though the public Trust Center page itself lists only SOC 2 and ISO 27001, not HIPAA',
+          'SOC 2 Type II and ISO 27001 certified, and audited against HIPAA in the same review cycle, though the public Trust Center page itself lists only SOC 2 and ISO 27001, not HIPAA',
         detail:
           'The Trust Center confirms SOC 2 Type II and ISO 27001, DPAs with OpenAI and Anthropic, and a May 2025 penetration test with a Low risk rating. A separate StackAI blog post states the company "was also audited against HIPAA standards during the same period as the SOC 2 Type II audit." GDPR compliance is referenced on the Enterprise pricing page but has no dedicated audit source.',
-        shortValue: 'ISO 27001 certified; HIPAA audited, GDPR marketing-only',
+        shortValue: 'SOC 2 Type II and ISO 27001 certified; HIPAA audited, GDPR marketing-only',
         confidence: 'estimated',
         sources: [
           { url: 'https://trust.stackai.com/', label: 'StackAI Trust Center', asOf: '2026-07-02' },

apps/sim/lib/compare/data/competitors/tines.ts

@@ -842,8 +842,8 @@ export const tinesProfile: CompetitorProfile = {
       },
       additionalCompliance: {
         value:
-          'ISO 27001, ISO 27701, and ISO 42001 (AI management systems), announced April 14, 2026 as the "ISO trifecta." No HIPAA, PCI, or FedRAMP certification; Tines says self-hosting can help meet regimes like FedRAMP, not that it holds FedRAMP certification',
-        shortValue: 'ISO 27001, 27701, and 42001 certified',
+          'SOC 2 Type II, audited annually, plus ISO 27001, ISO 27701, and ISO 42001 (AI management systems), announced April 14, 2026 as the "ISO trifecta." No HIPAA, PCI, or FedRAMP certification; Tines says self-hosting can help meet regimes like FedRAMP, not that it holds FedRAMP certification',
+        shortValue: 'SOC 2 Type II; ISO 27001, 27701, and 42001 certified',
         confidence: 'verified',
         sources: [
           {