Independent · buyer's-eye · in the open
The Granworth Index benchmarks how funded B2B software companies present trust to enterprise buyers. Each edition records what a logged-out visitor could reach on a stated date — the same view a prospect's procurement and InfoSec reviewers get — for one company and three named competitors, side by side.
Every finding is published in the open, with a source and a date. Nothing is gated behind a reply, a form, or a call. Corrections are free, forever.
How to read this series
An edition measures presentation, not protection: what a buyer can find, not what a company has built. It is never a security assessment, and “Not found” is a dated observation about the public web — never a claim about what exists internally.
Each edition replays an enterprise reviewer's public first pass: five observable trust artifacts and 20 standard questionnaire topics, checked for one company and three named competitors from a logged-out browser, every cell dated and sourced. A topic counts as publicly answerable only when the answer itself is reachable without emailing anyone — sections deferring to “details on request” count as not answerable. The full method — the topic list, the counting rule, the five artifacts, the correction policy, and the build-stamp scheme — is on the methodology page.
Every edition is complete as published: full findings, sources, and a per-company topic ledger. There is no fuller version behind a call. Each is one volume of the Index — one company against three named peers, measured the same day, by the same method.
Security and Trust Center are both footer-linked and 16 of the 20 reviewer topics are publicly answerable; one seam remains — vercel.com/security still reads ISO 27001:2013 where the certificate reads :2022.
build 57824a3276c03453Answers 18 of the 20 reviewer topics and publishes the set's most granular self-serve evidence — a 70-control public inventory; the Enterprise uptime-SLA figure is the one number left blank.
build 7135f0ebed111f46Publishes the deepest trust surface in its set — an ungated SOC 2 report, a DPA set as a page — reached from a posthog.com homepage that links to none of it.
build 51faa3fbc38d9bdaOne person runs Granworth — the research and every edition of the Index: no handoff, no account team. The house is independent, and not affiliated with any vendor, auditor, or platform that appears in any benchmark.
The register holds everywhere: observations, not accusations; every claim dated and sourced; competitors named as coordinates on the same scale, measured the same day, by the same method.
I benchmark what a logged-out visitor can reach, and I publish everything I find. — Javier Garcia