Start With the Fact. Go Deeper When You Need the Analysis.
Six steps, one method. Every step asks the same question: what can actually be shown about how this company stores, moves, keeps, accesses and uses data? Each step answers it from better evidence than the one before. Every step below says what it needs from you, what it gives you, and whether it is running today.
Six Steps. The First Three Read Your Public Website.
Steps One to Three use what is already published, so they cost you nothing and need nothing from you. Steps Four to Six go further than a website can, so they use evidence you send us. That is the only real line in the method, and it is why the first step is free.
Observe
Reads One Public Website · The BSI CalculatorWe read a live website and answer in five words: Published, Partly, Not Published, Consistent, Not Determined. It covers how data is stored, moved, kept, accessed and used. Where the website says nothing, we say so. No account, no cost, and we never contact the company.
Run Free CheckCompare
Reads Other Companies Too · The BSI GridWe run the same read on other companies we have assessed and set them side by side at the same points. That is what turns a silence into a finding. If hardly anyone publishes something, that is normal. If only one supplier leaves it out, that is a question. It is not a rating, a score or a league table, and we never publish it as one.
Explain
One Company On One Page · BSI Insight CardsOne company, one page, written in that company's own words. Every finding shows where we read it, the sentence we read, and the date. So you can check us instead of trusting us. Published, Partly, Not Published and Not Determined stay apart on the page, because they are not the same thing.
Investigate
Reads The Paperwork · BSI Deep DiveWe stop working from the website and read the documents. Contracts, the legal route data takes out of the country, which countries are involved, and what you have to do as the buyer. Where something still cannot be settled, we name it instead of smoothing it over. A website does not carry this evidence, so this step starts with what you send us.
Connect
Follows Your Suppliers · Chain AssessmentYour suppliers read as one chain, not a list of names. Who handles what, where the work really happens, which steps are evidenced and which are only claimed. So you see the company your supplier hired, as well as the supplier you signed with. We have run this by hand. There is no self-serve import yet, so today it runs as an engagement — and we would rather say that than imply a button.
Resolve
A Person, Not A Report · BSI ConsultingA finding is not a fix. Here the person who built the method works on your own programme by hand. We do not sell you the software the assessment says you need, and we never will. That is the only way the assessment stays worth reading.
See Advisory EngagementsKnow The Day A Supplier Changes What They Publish.
Companies rewrite their privacy pages. They add a new sub-processor. They move where the data sits. Almost nobody sends you an email about it. BSI Live reads them again and compares the new version against the last one, so you find out when they change.
It also tells you which side changed. If our method stayed the same and the answer moved, they changed something. If the answer stayed the same and our method moved, we did. That comparison needs an earlier read to compare against, which is why BSI Live starts at Investigate and Connect and not on a single free check.