The Trust-IQ Score™ is the average outcome of audited parameters, each rated fully met, partially met or not met, expressed from 0 to 100. Each score is valid for 12 months, and paid placement never changes it. Buyers should read the outcomes and the date, not only the number.
A score untraceable to evidence is an opinion with a number attached. Here is what the Trust-IQ Score™ measures, and what it does not.
Recall a school report that said only "Grade: B". Every parent wanted to know which subject it described. A useful report shows the mark for each subject and the date of the examination. We hold the Trust-IQ Score™ methodology to that standard. This page explains how the score is built, what its rules mean, what it cannot tell you, and how to use it in your own due diligence.
Why a software score needs a published method
Most ratings buyers meet are a single grade. A star average shows that people liked a product, not why, and says little about how the company protects data. Risk work applies a simple test to any output: if it cannot be traced to its inputs, it cannot be challenged or relied upon.
That test matters more each year. Verizon's 2025 Data Breach Investigations Report found third parties involved in 30% of breaches, double the previous year. Gartner projects that AI agents will intermediate more than USD 15 trillion of B2B purchases by 2028, so machines will increasingly shortlist software by reading scores. A score with a hidden method asks for faith, and faith is not a control.
How the Trust-IQ Score™ methodology works
The method rests on five public rules. Each answers a question that a prudent buyer should ask of any rating.
| Rule | What it means | The buyer question it answers |
|---|---|---|
| Audited parameters | Each parameter is assessed by audit, not self-description | Did anyone independent check this? |
| Three outcomes | Each parameter is fully met, partially met or not met | Where exactly are the gaps? |
| An average from 0 to 100 | The average outcome across audited parameters | Can companies be compared on one scale? |
| 12-month validity | Each score is valid for 12 months | Is this still true today? |
| Payment independence | Paid placement never changes a score | Could money have moved this number? |
Three outcomes rather than pass or fail
Real controls are rarely all or nothing. A company may enforce multi-factor sign-in for staff but not yet for every administrative tool. A pass or fail scale would round that up or down, and either rounding misleads. Partially met records the truth, and such items make a natural agenda for follow-up.
What an average hides
An average places companies on one comparable scale, but it compresses detail. Two companies can reach the same number with very different gaps. We therefore treat the number as an index to the detail, never a substitute for it.
Validity and independence
Security posture drifts as teams, products and owners change. A 12-month validity period means the score must be earned again rather than inherited. Separately, commercial relationships may affect where a listing appears, but never the number. Buyers should hold every rating platform to that line, ours included.
What the score does not tell you
A Trust-IQ Score™ is evidence about a company's audited practices at a point in time. It is neither a product review nor a verdict on your use case.
- Product fit: whether the software meets your functional requirements. Only your own pilot can show that.
- Your configuration: many risks depend on how you deploy the product, which no external score can see.
- Events after the audit: an incident or major change is not reflected until the next assessment.
- Contract terms: notification times, liability and exit terms are for you to negotiate.
- Relevance to you: which parameters matter most for your deployment is your judgement.
These limits apply equally to every certification, attestation and rating. Stating them openly lets a buyer place the score correctly.
A worked example: reading a score in due diligence
Hypothetical case. A finance team is shortlisting an expense tool that will hold employee bank details. Two providers have the same score. The area names below are illustrative and are not actual Trust-IQ parameters.
| Check | Provider A | Provider B |
|---|---|---|
| Score | Same as B | Same as A |
| Outcomes not fully met | Partially met on training records and documentation | Partially met on key management; not met on data deletion |
| Relevance to this deployment | Low: neither affects employee financial data | High: both affect how bank details are protected |
| Validity left at contract start | Ten months | Two months |
| Next step | Standard checks, then pilot | Targeted evidence requests and a renewal clause |
On the headline number the providers are identical. On the outcomes and dates they are not. Provider B may still be the right choice, but the team now knows which two questions to ask and what to write into the contract.
The dates matter as well. Provider B's score covers only two months of a possible three-year term. Whatever the source of evidence, consider a clause requiring renewed assurance each year.
Five questions to ask of any trust score, including ours
A credible rating should answer each of these clearly and in writing.
- Breakdown: which parameters were partially met or not met, and in which areas?
- Evidence: what kind of evidence was audited for the items that matter to you?
- Date: when was the score issued, and when does it expire?
- Payment: is there a written statement that payment cannot change the score?
- Change: what happens if a material incident occurs before expiry?
Specific answers can be quoted in your own risk file. Vague ones, such as references to a proprietary model, signal that the rating is asking for faith. Above all, treat the score as the first page of the file, not the last.
The bottom line
Conclusion
The parent who asks "B in what?" is asking the right question, and buyers should ask it of every score. The Trust-IQ Score™ is designed to answer it: audited parameters, three honest outcomes, a 0 to 100 average, a 12-month life and no route for payment to alter the result.
Used well, a score does not replace judgement; it shows where to apply it. This week, choose one supplier on your current shortlist and put the five questions above to whatever rating you relied upon.
Frequently asked questions
Can a software company pay to improve its Trust-IQ Score?
No. Paid placement never changes a Trust-IQ Score™, which is the average outcome of audited parameters.
What does partially met mean in the Trust-IQ Score?
It means an audited parameter was found to be in place, but not fully. Such items make a useful focus for follow-up questions during due diligence.
How long is a Trust-IQ Score valid?
Each Trust-IQ Score™ is valid for 12 months. After that, it should not be treated as current evidence until the company has been assessed again.
Does a trust score replace my own due diligence?
No. A trust score narrows and focuses due diligence, but product fit, configuration, contract terms and the relevance of each gap still require the buyer's own review.
Why can two companies with the same score carry different risk?
An average compresses detail. Two companies can reach the same score with gaps in very different areas, which is why the individual outcomes matter.
References
Disclaimer: General information only, not legal, security, compliance or financial advice. Check the cited sources and seek professional advice. Names belong to their owners; no endorsement implied.