Browse by what vendors disclose

Entries whose own published documentation mentions SOC 2. Each one quotes the sentence it came from, so you can see whether the vendor claims SOC 2 Type I, Type II, or simply says the words.

Entries whose documentation states MCP support. Protocol claims are among the easiest to verify and the fastest to go stale, so the retrieval date next to each is worth reading.

Entries whose published pages reference GDPR. A mention is not an adequacy decision — read the quote, which is often narrower than the claim implied by the badge on the page it came from.

Entries whose documentation references HIPAA. For anything touching protected health information, the quote matters more than the claim: several of these describe HIPAA-eligible infrastructure rather than a signed BAA.

Entries describing themselves as open source. We record the claim and quote it; we do not resolve what licence actually governs the code, which is a question the repository answers better than a marketing page.

Entries that state a self-hosted or on-premise deployment option — the question every buyer with a data-residency constraint asks first, and one general agent directories do not record at all.

Entries referencing ISO 27001 certification in their own documentation, each with the sentence it was taken from.

The smallest facet here, and the most telling: of more than 1,700 published entries, only these mention the EU AI Act on their own pages at all.