Methodology

An automated pipeline reads each vendor’s public pages (pricing, security and trust, documentation) and, where one exists, the company’s Wikipedia article. A language model turns those pages into structured facts, and the pipeline checks that the key facts cite a page we actually fetched. Each tool is refreshed about every six weeks.

Because the sources are the vendors’ own public pages, figures are estimates for a typical mid-sized deployment. Always confirm pricing and compliance with the vendor.

• Typical annual cost: an estimate of what a typical mid-sized deployment pays per year. Most business software vendors publish no price; those show as “On request”.
• Time-to-value: roughly how long from contract to first real use in production.
• Implementation friction: the engineering and admin effort a rollout takes, from 1 (frictionless) to 5 (heavy lift).
• Compliance: “Listed” means the vendor’s public pages state it. “Not listed” means they don’t say, not that the product lacks it. CMMC is listed only when the vendor says it holds a CMMC certification itself; a product that helps you prepare for CMMC does not count.
• “Not recorded” anywhere means we have no information yet. It is never a negative.
• Value-Position score (0–5): a model estimate from public information. It is not built from buyer reviews or ratings.

The AI facts are the ones buyers screen on, so their bar is the highest: a wrong claim is worse than a blank one. Each needs a page we actually fetched that states it, and anything short of that shows as “Not recorded”.

• AI features: what the AI does in the product, only where a page describes it. “AI-powered” on its own is not evidence.
• AI-native or AI added: AI-native means the vendor says AI does the product’s core job. “AI added” means AI features in a product whose core job is something else.
• Trains on your data: recorded only when the vendor’s own page says it in a sentence about training models on customer data: never, only if you opt in, by default with an opt-out, or yes. “Secure” or “private” is not a statement about training. Most vendors say nothing on the pages we read, so most tools show “Not recorded — ask the vendor”.
• Runs on: the model providers a page names, such as OpenAI, Anthropic or Google. A provider the page does not name is dropped.
• AI pricing: included in the plan, a paid add-on, or billed by usage or credits, from the vendor’s own pages.
• MCP: whether the product ships an MCP server, so AI assistants such as Claude, ChatGPT or Cursor can use it. It needs a documentation page as evidence.
• Model key and AI audit: whether you can bring your own model provider key, and whether AI actions are logged.
• ISO 42001: an AI management certification, set only from the vendor’s security, trust or compliance pages.

Some products are generated with AI app builders such as Lovable, Bolt, v0, Replit or Base44. Apps made this way have shipped with serious security gaps: in 2025, a scan of 1,645 apps built with Lovable found 170 exposing their users’ data because database access rules were never switched on (CVE-2025-48757).

Before each refresh, we load the vendor’s homepage, and at most one of its scripts, as any visitor’s browser would. We look for the markers these builders leave behind: their hosting addresses (such as a lovable.app address), their badges, their default page metadata and the paths they serve files from. We read the page’s tags, not its text, so a page that merely mentions or links to a builder does not count.

• Security caution: builder markers found, and no SOC 2 or ISO 27001 on the vendor’s public pages. The tool page says what we found, and the Security filter can hide these tools.
• No caution: builder markers found, but the vendor lists SOC 2 or ISO 27001. An independent audit covers what we cannot see.
• Not added: a new tool whose site is served straight from a builder’s own address (for example something.lovable.app) is not added to the database. Tools already listed are never removed automatically.

The limits matter. Apps written with coding assistants such as Cursor or Claude Code leave no markers, so the absence of a caution is not a clean bill of health. We only see the marketing site, not the product behind the login. A caution states what we found; it is not a finding that the product is insecure.

We never probe a vendor’s systems, test their database or try to log in: the check reads only what any visitor’s browser receives. If a caution is wrong or no longer applies, the vendor can email [email protected]. We verify by hand, clear the caution and check the site again.

Lists in our articles are ordered by a value index: for each tool, how it places on typical annual cost, time-to-value and implementation friction against the other tools in the same article, averaged. Lower cost, faster value and less effort rank higher. A vendor that publishes no price scores in the middle on cost, so withholding a price is never an advantage. The Value-Position score is not part of it.

“Strengths” shown for a tool are computed the same way against its whole category, for example “better time-to-value than 85% of Ops Efficiency tools”. Vendors cannot supply or edit them.

Articles are generated automatically, three times a week. A planner chooses a topic the data can support (a comparison, a buyer’s guide, a list of alternatives), and an AI model writes the text from a fact sheet drawn only from our database.

• The model never types a price, duration or rating. Every figure in an article is filled in from our database when the page loads, so it matches the tables and stays current.
• Tables, charts and rankings are computed from the data, not written by the model.
• Before anything is published, automated checks reject text that claims a certification, AI connection or “cheapest”/“fastest” position the data does not support, that talks about reviews or ratings, or that names products outside our dataset.
• We do not claim to have tested the products ourselves.

Some vendors pay to be featured more often. Their placements are always labelled, and they cannot change our data, rankings or tables. How we make money.