Every claim here has to survive a check
CMDash sells verifiable evidence, so the site that sells it has to be verifiable too. This page explains what a claim needs before it appears here, where the numbers come from, and why you will not find customer logos.
What it takes for a sentence to appear here
- Every claim a reader could check is tagged with an entry in our claims register, and only an entry marked LIVE may be shown.
- LIVE means true in production today and backed by production proof: a public page we fetched, with the date and what it showed; a fact from a probe of production; or a stated reason the claim has no production dependency. An entry without proof is not LIVE.
- A guard, check-claims-register, reads every page of this site and the public Trust Center and fails when a tag points at an entry that is not LIVE, when a LIVE entry has no proof, or when it has gone too long without being re-checked. It runs in the gate every change passes before it is pushed.
- A claim whose wording has to change is retired, never edited: the old entry is removed and a new one added, so every page still tagged with the old one fails until its copy is revisited.
Where the numbers come from
The line under the home page headline prints four numbers. Each is computed from what ships when the site is built, never typed, and drift tests recompute every one and fail the build if a page types it by hand.
- 48 connectors: the integration catalog that the integrations page lists, counted.
- 5 of them Verified: catalog connectors with a dated evidence record of a verification run, the latest dated .
- 22 frameworks: the framework catalog that the frameworks page lists, counted.
- 1,865 controls: the control rows the framework seeds write, summed across every framework.
Why there are no logos
A product whose pitch is verifiable evidence cannot advertise itself with numbers or names a reader cannot verify. Our messaging guide sets these rules for every marketing surface, quoted here as written:
No invented metrics. Every number is derived from a catalog in the repo (frameworks, controls, integrations, crosswalk mappings) or carries a verifiedOn date and a public source. Drift tests enforce this; do not hand-type a count.
No fabricated social proof. No customer logos, no testimonials, no "trusted by N teams", no invented case studies.
Illustrative material is labelled in visible text, not only in an aria-label.
Say what is not built. /status and the Trust Center both do this today, and it is a differentiator in a category where everyone claims everything.
So there are no customer logos until a customer consents to one. In their place, we are taking on a small number of design partners; the design-partner page sets out the terms.
Where to watch
- The status page — current component health and the incident history.
- The changelog — every release is listed, with an RSS feed to follow it.
- The Trust Center — security, subprocessors, the DPA, disclosure and what is still open, stated on the page that describes it.
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free: free forever, one framework (CMMC Level 1 or Level 2) for a small team, no credit card.