{
  "name": "The Clean Opinion — tool manifest",
  "description": "Every free tool on the site, the query parameters it accepts, and worked example URLs.",
  "documentation": "https://thecleanopinion.com/tools/api/",
  "fullText": "https://thecleanopinion.com/llms-full.txt",
  "attribution": "The Clean Opinion (thecleanopinion.com)",
  "publisher": {
    "name": "The Clean Opinion",
    "url": "https://thecleanopinion.com",
    "email": "hello@thecleanopinion.com",
    "disclosure": "https://thecleanopinion.com/disclosure/",
    "professionalWorkBy": {
      "name": "Alpha Secure LLP",
      "url": "https://www.goalphasec.com"
    }
  },
  "interface": {
    "kind": "prefill-url",
    "returns": "text/html",
    "method": "GET",
    "note": "There is no JSON compute endpoint. Each tool is a page that computes in the visitor's browser; the URLs below pre-fill that page with the supplied answers so it opens showing the result. Fetching one returns HTML, not JSON. Give the URL to the person you are helping rather than parsing it.",
    "unknownParameters": "Ignored. An unrecognised key, or an unlisted value for a known key, is dropped rather than guessed at."
  },
  "disclaimer": "These tools give planning estimates from the answers supplied. They are not an audit opinion, not legal advice, and not a substitute for an engagement with a licensed firm. Audits and attestations are performed by Alpha Secure LLP, a licensed CPA firm. Every weight, threshold and interval is practitioner judgement published at https://thecleanopinion.com/how-scoring-works/, not a figure set by the AICPA, the SEC, the PCAOB or NIST.",
  "tools": [
    {
      "slug": "security-questionnaire-panic-checker",
      "name": "Security Questionnaire Panic Checker",
      "segment": "soc2",
      "description": "Paste the questionnaire a customer sent you. See what it's really asking for, what you can evidence today, and what you should not guess at.",
      "whoFor": "Founders, CTOs, and security owners at B2B SaaS or service companies who just received a customer or vendor-risk questionnaire.",
      "minutesToComplete": 3,
      "url": "https://thecleanopinion.com/tools/security-questionnaire-panic-checker/",
      "question": "What is a security questionnaire actually asking for?",
      "answer": "Most vendor security questionnaires cover the same eight areas in different words. This checker sorts each line you paste into one of those areas by keyword, shows how the questions are distributed, lists the evidence a reviewer will want for each area, and flags the answers that are dangerous to guess at.",
      "explain": [
        "Each pasted line is matched against 134 fixed keyword and regular-expression patterns grouped into eight control areas — audit evidence, access control, encryption, incident response, vendor management, privacy and data handling, business continuity, and change management — and filed under the single area whose patterns it matched most. It is deterministic pattern matching, not a language model, and it reads the questionnaire rather than your controls.",
        "Because a line is filed under exactly one area, a question spanning two areas is counted once. And any line containing a trigger word is counted, including a section header, a cover page, or a line from an answer column. The number reported is a count of lines kept, not a count of questions.",
        "Lines that match nothing are not discarded silently — they are listed back, so a real control question in an unusual phrasing can still be spotted. There is no category for risk assessment, personnel security, training, governance or physical security, so questions on those subjects land in that unmatched list rather than in a control area.",
        "Urgency is scored from what you enter alongside the paste: whether a live deal depends on it, how far away the customer's deadline is, whether SOC 2 is being asked for and what you hold today, how many areas the questionnaire covers, who sent it, and your headcount. It is a reading of the situation you described, not of your control environment. If nothing in the paste matched a control area at all, a high score is capped at medium, because urgency built on text the checker could not read would be a false alarm.",
        "The evidence list and the likely gaps are fixed text per area, not findings about your company. Every company pasting an access-control question receives the same access-control gap. The weights that rank those gaps are the practitioner judgement of the auditors who wrote them; no measured exception-rate dataset sits behind them."
      ],
      "sources": [],
      "parameters": [
        {
          "name": "deadline",
          "label": "Customer deadline",
          "type": "date",
          "note": "YYYY-MM-DD. Omit if none was given."
        },
        {
          "name": "deal",
          "label": "A live deal depends on it",
          "type": "enum",
          "values": [
            "yes",
            "no"
          ]
        },
        {
          "name": "soc2",
          "label": "SOC 2 status today",
          "type": "enum",
          "values": [
            "none",
            "in-progress",
            "type1",
            "type2"
          ]
        },
        {
          "name": "asker",
          "label": "Who is asking",
          "type": "enum",
          "values": [
            "prospect",
            "customer",
            "insurer",
            "investor",
            "other"
          ]
        },
        {
          "name": "size",
          "label": "Headcount",
          "type": "enum",
          "values": [
            "1-10",
            "11-50",
            "51-200",
            "201-1000",
            "1000+"
          ]
        }
      ],
      "examples": [
        {
          "scenario": "A prospect sent a questionnaire tied to a live deal, due in two weeks, with no SOC 2 report in hand.",
          "url": "https://thecleanopinion.com/tools/security-questionnaire-panic-checker/?deadline=2026-09-24&deal=yes&soc2=none&asker=prospect&size=11-50"
        },
        {
          "scenario": "An existing customer's annual re-review, no deadline pressure, Type 2 already held.",
          "url": "https://thecleanopinion.com/tools/security-questionnaire-panic-checker/?deal=no&soc2=type2&asker=customer&size=51-200"
        }
      ],
      "inputsNotCarriedInUrl": [
        {
          "name": "The questionnaire itself",
          "reason": "Capped at 200,000 characters, and a real one runs to tens or hundreds of kilobytes — far past what a URL can carry. A link pre-fills everything else; the visitor still pastes."
        }
      ],
      "relatedArticles": [
        "https://thecleanopinion.com/articles/soc-2-type-1-vs-type-2/",
        "https://thecleanopinion.com/articles/access-review-auditor-will-accept/"
      ]
    },
    {
      "slug": "soc-2-timeline-calculator",
      "name": "SOC 2 Timeline Calculator",
      "segment": "soc2",
      "description": "Nine questions about where your controls stand. Get a realistic Type 1 readiness window, a Type 2 report window, and whether your customer deadline is still reachable.",
      "whoFor": "SaaS and service companies whose customer or procurement team just asked for a SOC 2 report.",
      "minutesToComplete": 2,
      "url": "https://thecleanopinion.com/tools/soc-2-timeline-calculator/",
      "question": "How long does a SOC 2 audit take?",
      "answer": "There is no single answer — it depends almost entirely on how much is already in place. This calculator turns nine answers about your controls into three dated ranges: when a Type 1 could be ready, when a Type 1 report could be in hand, and when a Type 2 could be, then compares each against your customer's deadline.",
      "explain": [
        "Five control areas carry a remediation cost in weeks: written policies, access reviews, vendor reviews, an incident response plan, and evidence collection. Each is answered yes, partial or no. A missing policy set counts six weeks and a partial one three; access reviews four and two; vendor reviews three and two; incident response three and two; evidence collection four and two.",
        "Those weeks are not added up. Gaps get worked in parallel, so the estimate takes the single longest gap and adds half of everything else. Systems beyond a baseline of five add 0.4 weeks each, capped at eight weeks in total. Where nobody owns the programme, the whole remediation figure is multiplied by 1.4 and two more weeks are added, because unowned readiness work starts later and runs slower.",
        "A floor of two weeks applies even when every answer is yes, since scoping, scheduling and pulling a point-in-time evidence set take that long regardless. The high end of every range is its low end multiplied by 1.4, plus one week. A Type 1 then adds two weeks of fieldwork and two weeks of report drafting; a Type 2 adds three and three.",
        "A Type 2 also needs an observation window, and this is where most timelines go wrong. Three calendar months are added to the early end of the Type 2 range and six to the late end. That spread is not an error bar — the two ends are two different scoping decisions, a three-month window and a six-month one. Three months is what most auditors and buyers accept in practice; it is a convention rather than a figure published by the AICPA.",
        "The observation clock starts the day controls are operating and evidence is being collected, not the day an auditor is engaged. Nothing before that day counts toward the window.",
        "A customer deadline moves none of the dates. It is compared with the relevant range and reported as on track when it falls on or after the end of that range, tight when it falls inside it, and likely late when it falls before the range begins. That rule is deliberately unforgiving and has no tolerance either side.",
        "Every constant here is a stated planning assumption drawn from practice, not a figure from a standard. None comes from the AICPA's attestation standards, from the trust services criteria, or from a published survey, and all of them are printed alongside the result so the arithmetic can be checked or argued with."
      ],
      "sources": [],
      "parameters": [
        {
          "name": "goal",
          "label": "Which report is being asked for",
          "type": "enum",
          "values": [
            "type1",
            "type2"
          ],
          "note": "Anything else is read as type1."
        },
        {
          "name": "deadline",
          "label": "Customer or procurement deadline",
          "type": "date",
          "note": "YYYY-MM-DD. Omit for a timeline with no deadline risk assessment."
        },
        {
          "name": "p",
          "label": "Written, approved security policies",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "partial"
          ]
        },
        {
          "name": "a",
          "label": "Access reviews performed and evidenced",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "partial"
          ]
        },
        {
          "name": "v",
          "label": "Vendor reviews performed and evidenced",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "partial"
          ]
        },
        {
          "name": "ir",
          "label": "Incident response plan, tested",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "partial"
          ]
        },
        {
          "name": "e",
          "label": "Control evidence collected routinely",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "partial"
          ]
        },
        {
          "name": "ks",
          "label": "In-scope systems",
          "type": "integer",
          "note": "Clamped to 1–200; a non-number is read as 5."
        },
        {
          "name": "owner",
          "label": "A named owner for the work",
          "type": "boolean",
          "note": "1 or 0."
        }
      ],
      "examples": [
        {
          "scenario": "A prospect asked for a Type 2 report by the end of March, and nothing is evidenced yet.",
          "url": "https://thecleanopinion.com/tools/soc-2-timeline-calculator/?goal=type2&deadline=2027-03-31&p=partial&a=no&v=no&ir=partial&e=no&ks=8&owner=0"
        },
        {
          "scenario": "Controls are in place and owned; the question is only how soon a Type 1 can be in hand.",
          "url": "https://thecleanopinion.com/tools/soc-2-timeline-calculator/?goal=type1&p=yes&a=yes&v=yes&ir=yes&e=yes&ks=5&owner=1"
        }
      ],
      "inputsNotCarriedInUrl": [],
      "relatedArticles": [
        "https://thecleanopinion.com/articles/soc-2-type-1-vs-type-2/",
        "https://thecleanopinion.com/articles/access-review-auditor-will-accept/",
        "https://thecleanopinion.com/articles/ai-agents-soc-2-audit-trail/"
      ]
    },
    {
      "slug": "sox-404-deadline-calculator",
      "name": "SOX 404 Deadline Calculator",
      "segment": "sox",
      "description": "Enter your public-company date and fiscal year-end. Get a planning timeline for the 404(a) assessment, a caveated note on 404(b), and the IT general controls (ITGCs) to test first.",
      "whoFor": "CFOs, controllers, internal audit and ITGC owners at companies that recently went public or are preparing their first SOX cycle.",
      "minutesToComplete": 3,
      "url": "https://thecleanopinion.com/tools/sox-404-deadline-calculator/",
      "question": "When does your first SOX 404 assessment actually apply?",
      "answer": "Not on the date you went public. This calculator works out the first fiscal year-end that management's Section 404(a) assessment plausibly applies to, then lays out a working first-year calendar backwards from it. It produces a year-end to plan against, not a filing deadline, and it does not determine your filer status.",
      "explain": [
        "The starting point is the first fiscal year-end falling on or after your public-company date, which is taken as the period your first annual report covers. Entering the date that annual report was or will be filed pins the period down directly instead of deriving it.",
        "One fiscal year is then added, and this is the single most consequential assumption made here: that the transition relief for newly public companies applies. Instruction 1 to Item 308 of Regulation S-K suspends both management's report and the auditor attestation until the registrant has either been required to file, or has filed, an annual report for the prior fiscal year. The legal test is that reporting history, not how recently the company listed — so a de-SPAC survivor, whose registrant is the SPAC, is generally not treated as a newly public company at all, and a company with a prior filed annual report does not get the relief either. Those companies have a first assessment year a full year earlier than this arithmetic produces, and nothing here can detect the case. It is the assumption to confirm with securities counsel before relying on any date.",
        "Seven milestones are laid out backwards from the year-end being planned against: scoping at twelve months, the risk-control matrix at eleven, documentation and walkthroughs at nine, design testing at eight, remediation closing at six, management's operating-effectiveness testing at three, and the assessment itself at year-end. That spacing is a working practitioner calendar rather than a regulatory schedule, and an auditor's plan may compress or extend it.",
        "Where the year-end that comes out of this is fewer than ninety days away, it is treated as too close to plan a first-year programme against. It is reported separately, along with the milestones that would already have passed, and the plan moves to the following year-end.",
        "Filer status is read back, never determined. Whatever is selected is taken at face value and used only to phrase a caveated note on the Section 404(b) auditor attestation. It is never checked against the revenue or public float entered, and it changes no date, no milestone and no rating. That note carries a standing caveat that the SEC's May 2026 proposal, Release 33-11419, would eliminate the accelerated filer and smaller reporting company categories altogether; the calculator applies the rules as they stood when it was last reviewed rather than the proposal.",
        "A separate ITGC reading comes from four answers: whether one person owns ITGC evidence, the state of access-review and change-management evidence, and how many financial systems are in scope. It is a nine-point heuristic over those four answers and nothing else. It says nothing about the calendar, the scoping, or the financial controls themselves."
      ],
      "sources": [
        {
          "title": "17 CFR 229.308 (Item 308) — Internal control over financial reporting",
          "publisher": "Electronic Code of Federal Regulations",
          "url": "https://www.ecfr.gov/current/title-17/chapter-II/part-229/subpart-229.300/section-229.308"
        },
        {
          "title": "Release 33-11419 — Enhancement of Emerging Growth Company Accommodations and Simplification of Filer Status for Reporting Companies (proposed rule)",
          "publisher": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/files/rules/proposed/2026/33-11419.pdf"
        }
      ],
      "parameters": [
        {
          "name": "public",
          "label": "Public-company date",
          "type": "date",
          "required": true,
          "note": "YYYY-MM-DD. IPO pricing, de-SPAC close, or effectiveness. Not before 1990-01-01."
        },
        {
          "name": "fye",
          "label": "Fiscal year-end",
          "type": "string",
          "required": true,
          "note": "MM-DD, e.g. 12-31 or 01-31. MM/DD and MMDD are also read."
        },
        {
          "name": "filer",
          "label": "Filer status",
          "type": "enum",
          "values": [
            "large-accelerated",
            "accelerated",
            "non-accelerated",
            "smaller-reporting",
            "emerging-growth",
            "not-sure"
          ],
          "note": "Defaults to not-sure, which returns a caveated answer rather than a guess."
        },
        {
          "name": "rev",
          "label": "Annual revenue",
          "type": "integer",
          "note": "Whole US dollars, e.g. 250000000. The form field takes millions; this parameter does not."
        },
        {
          "name": "float",
          "label": "Public float",
          "type": "integer",
          "note": "Whole US dollars, e.g. 700000000. Drives the 404(b) answer, so an unsure value is better omitted."
        },
        {
          "name": "tenk",
          "label": "First 10-K date, if known",
          "type": "date",
          "note": "YYYY-MM-DD."
        },
        {
          "name": "owner",
          "label": "A named ITGC owner",
          "type": "boolean",
          "required": true,
          "note": "1 or 0."
        },
        {
          "name": "sys",
          "label": "Financially relevant systems",
          "type": "list",
          "values": [
            "erp",
            "payroll",
            "billing",
            "data-warehouse",
            "crm",
            "other"
          ],
          "note": "Comma-separated. Unrecognised entries are dropped."
        },
        {
          "name": "access",
          "label": "Access-review evidence retained",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "partial"
          ],
          "required": true
        },
        {
          "name": "change",
          "label": "Change-management evidence retained",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "partial"
          ],
          "required": true
        }
      ],
      "examples": [
        {
          "scenario": "A company that listed in March 2026 with a December year-end, no named ITGC owner, and no evidence retained yet.",
          "url": "https://thecleanopinion.com/tools/sox-404-deadline-calculator/?public=2026-03-15&fye=12-31&filer=non-accelerated&owner=0&sys=erp%2Cpayroll&access=no&change=no"
        },
        {
          "scenario": "An accelerated filer with a $700M float and a January year-end, checking whether 404(b) applies.",
          "url": "https://thecleanopinion.com/tools/sox-404-deadline-calculator/?public=2025-06-30&fye=01-31&filer=accelerated&rev=250000000&float=700000000&owner=1&sys=erp%2Cbilling%2Cdata-warehouse&access=partial&change=yes"
        }
      ],
      "inputsNotCarriedInUrl": [],
      "relatedArticles": [
        "https://thecleanopinion.com/articles/sox-404-first-year-timeline/",
        "https://thecleanopinion.com/articles/itgc-scoping-sox-four-controls-auditors-test-first/"
      ]
    },
    {
      "slug": "breach-aftermath-control-checklist",
      "name": "Breach Aftermath Control Checklist",
      "segment": "cyber",
      "description": "After an incident, the second wave is questions — from customers, insurers, the board, and your auditor. A checklist of the controls and evidence they will ask about.",
      "whoFor": "CFOs, general counsel, CIOs and CISOs at companies working through the follow-up to a security incident.",
      "minutesToComplete": 3,
      "url": "https://thecleanopinion.com/tools/breach-aftermath-control-checklist/",
      "question": "What will auditors, insurers and your board ask for after a breach?",
      "answer": "The second wave of a breach is questions. This checklist takes eight answers about the incident and selects, from a fixed library, the controls to review, the evidence to gather, and the questions each party — customers, your cyber insurer, the board, your auditor, lenders — tends to ask, alongside the artifact that answers each one.",
      "explain": [
        "Eight answers about the incident — its type, whether customer or personal data was involved, whether financial systems were touched, whether a vendor was involved, whether ransomware was involved, whether anything has been disclosed publicly, who is already asking questions, and what remediation evidence exists — select items from a fixed library of forty-five checklist items, forty-one stakeholder questions and thirteen worksheet rows. Nothing is written per incident, and roughly half the control-review items appear for everyone.",
        "The score is a weighted count of how much follow-up scrutiny those answers imply, and it is dominated by who is already asking: each party is worth fourteen points out of a hundred. Financial systems touched is twenty, a public disclosure eighteen, ransomware sixteen, customer data ten, and no remediation evidence fourteen. Fifty or more reads high, twenty-five or more medium. Every term is itemised in the result, so the arithmetic can be checked.",
        "One override sits on top of those bands: a confirmed exposure of customer or personal data can never read as low urgency and is raised to medium regardless of the total. A result can therefore read medium at a score of ten. The score itself is deliberately left alone, so the published weighting stays true.",
        "An item marked critical means a party who is already asking will raise it — not that it is the most severe thing on the list. The warning about how the incident timeline and root-cause analysis are commissioned is arguably the highest-stakes item, and it is marked critical only when the board or the auditor is among those asking.",
        "Nothing here is legal advice, and no notification obligation is decided. Which notification clocks may be running, whether anything is material, and whether a disclosure is required are all routed to counsel. This is preparation for the period after the immediate response is under control; during a live incident, counsel and an incident-response provider come first."
      ],
      "sources": [],
      "parameters": [
        {
          "name": "type",
          "label": "What kind of incident",
          "type": "enum",
          "values": [
            "ransomware",
            "credential-compromise",
            "vendor-incident",
            "data-exposure",
            "insider",
            "other"
          ],
          "note": "ransomware and vendor-incident each imply the matching question below unless it is answered otherwise."
        },
        {
          "name": "data",
          "label": "Customer or personal data involved",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "unknown"
          ]
        },
        {
          "name": "fin",
          "label": "Financial systems touched",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "unknown"
          ],
          "note": "ERP, billing, payroll, banking, or the identity provider in front of them."
        },
        {
          "name": "vendor",
          "label": "A third-party vendor involved",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "unknown"
          ]
        },
        {
          "name": "ransom",
          "label": "Ransomware involved",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "unknown"
          ]
        },
        {
          "name": "disclosed",
          "label": "A public disclosure already made",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "unknown"
          ]
        },
        {
          "name": "asking",
          "label": "Who is already asking questions",
          "type": "list",
          "values": [
            "customers",
            "insurer",
            "board",
            "auditor",
            "lenders-investors"
          ],
          "note": "Comma-separated. Blank is a real answer: nobody has asked yet."
        },
        {
          "name": "remediation",
          "label": "Documented remediation evidence",
          "type": "enum",
          "values": [
            "yes",
            "no",
            "partial",
            "unknown"
          ]
        }
      ],
      "examples": [
        {
          "scenario": "Credentials were compromised, customer data was involved, and the auditor and insurer are both asking.",
          "url": "https://thecleanopinion.com/tools/breach-aftermath-control-checklist/?type=credential-compromise&data=yes&fin=yes&vendor=no&ransom=no&disclosed=no&remediation=partial&asking=insurer%2Cauditor"
        },
        {
          "scenario": "The bare minimum: three questions answered, nobody asking yet, everything else still unknown.",
          "url": "https://thecleanopinion.com/tools/breach-aftermath-control-checklist/?type=vendor-incident&data=unknown&fin=no"
        }
      ],
      "inputsNotCarriedInUrl": [],
      "relatedArticles": [
        "https://thecleanopinion.com/articles/breach-is-a-financial-reporting-problem/",
        "https://thecleanopinion.com/articles/access-review-auditor-will-accept/"
      ]
    },
    {
      "slug": "trust-page-grader",
      "name": "Trust Page Grader",
      "segment": "trust",
      "description": "Paste your security or trust page. Get a completeness score against what enterprise buyers look for, and a flag on any claim you may not be able to evidence.",
      "whoFor": "Founders, sales and marketing leads, and security owners at SaaS companies moving upmarket.",
      "minutesToComplete": 2,
      "url": "https://thecleanopinion.com/tools/trust-page-grader/",
      "question": "What should a trust page include?",
      "answer": "Ten things, in roughly the order enterprise reviewers look for them: an audit report, a trust page or security overview, a privacy policy, a subprocessor list, a way to request evidence, a security contact, a status page, a vulnerability disclosure path, an incident response process, and data retention and deletion.",
      "explain": [
        "You paste the text of your trust or security page and it is graded locally, in your own browser. The URL field is a label for the report header only — no page is ever fetched, by your browser or by a server — so a URL on its own grades nothing.",
        "Ten completeness checks run over the pasted text, each owning a list of keyword patterns, fifty-five in total. A check is credited the first time any one of its patterns matches somewhere that is not negated. The ten weights sum to a hundred: an audit report is worth eighteen, a trust page or security overview twelve, then privacy policy, subprocessor list and evidence process at ten each, and security contact, status page, vulnerability disclosure, incident response and data retention at eight each.",
        "Negation is honoured. A match is discarded when a negating word appears within the ten words before it, so a page saying it has no status page is not credited with one. Where a check's only matches were negated, the page's own sentence is quoted back as an admission rather than counted as present.",
        "Scoring is a plain sum of the weights credited — no partial credit, no penalties, and no interaction between checks. Eighty-five or more is a complete page, seventy a mostly complete one, fifty partial, thirty thin, and under thirty is not yet a trust page. The two questions about who your buyers are steer the urgency and the notes; they never move the score.",
        "Separately, thirteen phrase rules flag claims that tend to invite harder questions than they answer: absolute language, framework names used as though they were certifications, and promises of security that cannot be evidenced. These are wording flags, not findings. The grader cannot tell whether a claim is true, and it will flag an accurate statement that is merely imprecisely worded. They never affect the score.",
        "What the grade measures is the page, not the company. A perfect hundred means ten families of keywords appeared in the text pasted, and it is fully reachable by a page that simply says it has all ten things. It is not an audit, not an assessment of controls, and says nothing about whether a company is secure."
      ],
      "sources": [],
      "parameters": [
        {
          "name": "url",
          "label": "The address of the page being graded",
          "type": "string",
          "note": "Display only — it is never fetched, by this tool or by anything behind it. Capped at 2048 characters; a non-http(s) scheme is dropped."
        },
        {
          "name": "enterprise",
          "label": "Selling to enterprise buyers",
          "type": "boolean",
          "note": "1 or 0."
        },
        {
          "name": "asking",
          "label": "Customers ask for security documentation",
          "type": "boolean",
          "note": "1 or 0."
        }
      ],
      "examples": [
        {
          "scenario": "A company moving upmarket whose buyers have started asking for documentation.",
          "url": "https://thecleanopinion.com/tools/trust-page-grader/?url=https%3A%2F%2Fexample.com%2Fsecurity&enterprise=1&asking=1"
        },
        {
          "scenario": "A self-check before going upmarket, with no documentation requests yet.",
          "url": "https://thecleanopinion.com/tools/trust-page-grader/?url=https%3A%2F%2Fexample.com%2Ftrust&enterprise=0&asking=0"
        }
      ],
      "inputsNotCarriedInUrl": [
        {
          "name": "The pasted page",
          "reason": "Capped at 200,000 characters, and a real one runs to tens or hundreds of kilobytes — far past what a URL can carry. A link pre-fills everything else; the visitor still pastes."
        }
      ],
      "relatedArticles": [
        "https://thecleanopinion.com/articles/soc-2-type-1-vs-type-2/",
        "https://thecleanopinion.com/articles/ai-agents-soc-2-audit-trail/"
      ]
    }
  ]
}