fix(comparisons): update compliance certifications

apps/sim/app/(landing)/comparisons/comparison-sections.ts

@@ -87,11 +87,10 @@ export const COMPARISON_SECTIONS: ComparisonSectionDef[] = [
     group: 'security',
     title: 'Security & compliance',
     rows: [
-      { key: 'soc2', label: 'SOC 2' },
+      { key: 'compliance', label: 'Compliance' },
       { key: 'dataResidency', label: 'Data residency' },
       { key: 'rbac', label: 'Role-based access control' },
       { key: 'auditLogging', label: 'Audit logging' },
-      { key: 'additionalCompliance', label: 'Additional compliance' },
       { key: 'modelAndToolGovernance', label: 'Model & tool governance' },
       { key: 'credentialGovernance', label: 'Credential governance' },
       { key: 'sso', label: 'Single sign-on (SSO)' },

apps/sim/app/(landing)/comparisons/utils.ts

@@ -134,7 +134,7 @@ export function buildComparisonFaqs(competitor: CompetitorProfile): ComparisonFa
     },
     {
       question: `Is Sim more secure than ${name}?`,
-      answer: `Security is a like-for-like comparison, not a one-line verdict. Sim: ${summarizeFact(simProfile.facts.security.additionalCompliance.value)} ${name}: ${summarizeFact(facts.security.additionalCompliance.value)} Check the Security & compliance rows above for the full breakdown, including SSO, audit logging, and data residency.`,
+      answer: `Security is a like-for-like comparison, not a one-line verdict. Sim: ${summarizeFact(simProfile.facts.security.compliance.value)} ${name}: ${summarizeFact(facts.security.compliance.value)} Check the Security & compliance rows above for the full breakdown, including SSO, audit logging, and data residency.`,
     },
     {
       question: `Which has stronger AI agent capabilities, Sim or ${name}?`,

apps/sim/lib/compare/data/competitors/claude-cowork.ts

@@ -749,20 +749,6 @@ export const claudeCoworkProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes (company-wide, not Cowork-specific)',
-        detail:
-          'Anthropic holds SOC 2 Type I and Type II; the detailed report is available under NDA via the Anthropic Trust Portal. There is no Cowork-specific SOC 2 scoping statement.',
-        shortValue: 'Company-wide, not Cowork-specific',
-        confidence: 'estimated',
-        sources: [
-          {
-            url: 'https://trust.anthropic.com/',
-            label: 'Anthropic Trust Center',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'No Cowork-specific residency controls; company-wide default is multi-region processing, US-based storage',
@@ -807,18 +793,24 @@ export const claudeCoworkProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'ISO 27001:2022, ISO/IEC 42001:2023, HIPAA-ready (BAA via sales-assisted Enterprise)',
-        detail: 'Company-wide Anthropic certifications, not Cowork-scoped.',
-        shortValue: 'ISO 27001, ISO 42001, HIPAA-ready',
+          'SOC 2 Type I and Type II (company-wide, not Cowork-specific), ISO 27001:2022, ISO/IEC 42001:2023, HIPAA-ready (BAA via sales-assisted Enterprise)',
+        detail:
+          'Company-wide Anthropic certifications, not Cowork-scoped. The detailed SOC 2 report is available under NDA via the Anthropic Trust Portal.',
+        shortValue: 'SOC 2 Type I/II, ISO 27001, ISO 42001, HIPAA-ready',
         confidence: 'estimated',
         sources: [
           {
             url: 'https://support.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained',
             label: 'What Certifications has Anthropic obtained?',
             asOf: '2026-07-08',
           },
+          {
+            url: 'https://trust.anthropic.com/',
+            label: 'Anthropic Trust Center',
+            asOf: '2026-07-02',
+          },
         ],
       },
       modelAndToolGovernance: {

apps/sim/lib/compare/data/competitors/crewai.ts

@@ -786,21 +786,6 @@ export const crewaiProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          'Yes: CrewAI AMP has a SOC 2 Type 1 audit report (dated November 2025), available via its Trust Center',
-        detail:
-          "CrewAI's Trust Center (trust.crewai.com, indexed by Vanta) lists a SOC 2 Type 1 Audit Report from November 2025. This applies to the Enterprise/AMP offering, not to a self-hosted deployment of the open-source framework, which has no compliance certification of its own since it isn't a hosted service.",
-        shortValue: 'SOC 2 Type 1 report (Nov 2025) for the AMP platform',
-        confidence: 'estimated',
-        sources: [
-          {
-            url: 'https://trust.crewai.com/',
-            label: 'CrewAI Trust Center',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Yes: achievable via self-hosting the OSS framework or AMP Factory (on-prem/private VPC)',
@@ -846,12 +831,12 @@ export const crewaiProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'HIPAA (Enterprise edition, audit report dated February 2026); no ISO 27001, PCI, or FedRAMP certification confirmed',
+          'SOC 2 Type 1 for CrewAI AMP (audit report dated November 2025) and HIPAA for the Enterprise edition (audit report dated February 2026); no ISO 27001, PCI, or FedRAMP certification confirmed',
         detail:
-          "CrewAI's Trust Center lists a HIPAA Audit Report dated February 2026 for the Enterprise edition, alongside the SOC 2 Type 1 report. CrewAI's pricing page separately references 'FedRamp High compliance' language for its Enterprise tier, but no independent FedRAMP authorization listing corroborates that claim, so it is not treated as confirmed here.",
-        shortValue: 'HIPAA audit (Feb 2026); FedRAMP claim unconfirmed',
+          "CrewAI's Vanta-indexed Trust Center lists a HIPAA Audit Report dated February 2026 for the Enterprise edition, alongside the SOC 2 Type 1 report. The certifications apply to the Enterprise/AMP offering, not to self-hosted deployments of the open-source framework, which have no compliance certification of their own because they are not a hosted service. CrewAI's pricing page separately references 'FedRamp High compliance' language for its Enterprise tier, but no independent FedRAMP authorization listing corroborates that claim, so it is not treated as confirmed here.",
+        shortValue: 'SOC 2 Type 1 (AMP), HIPAA audit (Feb 2026); FedRAMP claim unconfirmed',
         confidence: 'estimated',
         sources: [
           {

apps/sim/lib/compare/data/competitors/dust.ts

@@ -781,25 +781,6 @@ export const dustProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC 2 Type II certified, achieved audit readiness with Vanta in three weeks',
-        detail:
-          "Dust's own security page states SOC 2 Type II certification; a Vanta customer case study describes Dust achieving SOC 2 Type II audit readiness in three weeks using Vanta's automation, reducing compliance workload by roughly 50%. The report is downloadable via Dust's Trust Center.",
-        shortValue: 'SOC 2 Type II certified, report via Trust Center',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://www.vanta.com/customers/dust',
-            label: 'With Vanta, Dust achieved SOC 2 Type II audit readiness in three weeks',
-            asOf: '2026-07-02',
-          },
-          {
-            url: 'https://trust.dust.com/',
-            label: 'Dust Trust Center',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value: 'Yes: selectable US or EU data-hosting region',
         detail:
@@ -844,10 +825,10 @@ export const dustProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value: 'GDPR compliant, HIPAA-capable, SOC 2 Type II; no ISO 27001, PCI, or FedRAMP',
         detail:
-          "Dust's security page and enterprise materials state GDPR compliance and HIPAA-compliance capability alongside SOC 2 Type II. No source confirms ISO 27001, PCI-DSS, or FedRAMP.",
+          "Dust's security page and enterprise materials state GDPR compliance and HIPAA-compliance capability alongside SOC 2 Type II. A Vanta case study says Dust achieved SOC 2 Type II audit readiness in three weeks using Vanta's automation, reducing its compliance workload by roughly 50%; the report is downloadable through Dust's Trust Center. No source confirms ISO 27001, PCI-DSS, or FedRAMP.",
         shortValue: 'GDPR, HIPAA-capable, SOC 2 Type II',
         confidence: 'estimated',
         sources: [
@@ -856,6 +837,16 @@ export const dustProfile: CompetitorProfile = {
             label: 'Dust Security',
             asOf: '2026-07-02',
           },
+          {
+            url: 'https://www.vanta.com/customers/dust',
+            label: 'With Vanta, Dust achieved SOC 2 Type II audit readiness in three weeks',
+            asOf: '2026-07-02',
+          },
+          {
+            url: 'https://trust.dust.com/',
+            label: 'Dust Trust Center',
+            asOf: '2026-07-02',
+          },
         ],
       },
       modelAndToolGovernance: {

apps/sim/lib/compare/data/competitors/flowise.ts

@@ -671,15 +671,6 @@ export const flowiseProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          'Unknown: a third-party security-scan aggregator (Nudge Security) lists Flowise as SOC 2 compliant among several other certifications, but Flowise has published no SOC 2 report, badge, or trust page of its own.',
-        detail:
-          'The same third-party source also claims FedRAMP and PCI compliance for a small startup, an atypical combination not corroborated on flowiseai.com.',
-        shortValue: 'No official confirmation found',
-        confidence: 'unknown',
-        sources: [],
-      },
       dataResidency: {
         value:
           'Yes, indirectly: self-hosting (including on-prem/air-gapped Enterprise deployment) lets an organization fully control data location. There is no dedicated regional-cloud-hosting option for the managed Cloud product.',
@@ -719,10 +710,12 @@ export const flowiseProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'Unknown: beyond the unconfirmed third-party SOC 2 claim, Flowise has published no HIPAA, ISO 27001, PCI, or FedRAMP certification.',
-        shortValue: 'Unknown, no official certifications published',
+        detail:
+          "The SOC 2 claim comes from third-party security-scan aggregator Nudge Security; Flowise has published no SOC 2 report, badge, or trust page of its own. The same source also claims FedRAMP and PCI compliance, an atypical combination for a small startup that is not corroborated on Flowise's own website.",
+        shortValue: 'SOC 2 claim unconfirmed; no official certifications published',
         confidence: 'unknown',
         sources: [],
       },

apps/sim/lib/compare/data/competitors/gumloop.ts

@@ -792,20 +792,6 @@ export const gumloopProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          'SOC 2 Type II attested; also HIPAA-compliant with BAAs available on eligible plans, and GDPR-aligned with EU-U.S. Data Privacy Framework (incl. UK Extension) certification',
-        shortValue: 'SOC 2 Type II, HIPAA, GDPR-aligned',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://www.gumloop.com/solutions/security',
-            label: 'Gumloop Security & Trust',
-            asOf: '2026-07-02',
-          },
-          { url: 'https://trust.gumloop.com/', label: 'Gumloop Trust Center', asOf: '2026-07-02' },
-        ],
-      },
       dataResidency: {
         value:
           'Enterprise VPC deployment into a customer-controlled cloud region provides data residency/control; zero data retention (ZDR) agreements are in place with major LLM providers',
@@ -854,7 +840,7 @@ export const gumloopProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'SOC 2 Type II, HIPAA (with BAAs), GDPR-aligned program plus EU-U.S. Data Privacy Framework (incl. UK Extension); no ISO 27001, PCI, or FedRAMP',
         detail:
@@ -867,6 +853,7 @@ export const gumloopProfile: CompetitorProfile = {
             label: 'Gumloop: Security and trust',
             asOf: '2026-07-02',
           },
+          { url: 'https://trust.gumloop.com/', label: 'Gumloop Trust Center', asOf: '2026-07-02' },
         ],
       },
       modelAndToolGovernance: {

apps/sim/lib/compare/data/competitors/langchain.ts

@@ -781,21 +781,6 @@ export const langchainProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          "Yes: LangSmith is SOC 2 Type II certified. LangGraph Platform (now branded LangSmith Deployment) is publicly announced as carrying the same attestation, sharing LangSmith's infrastructure and compliance posture.",
-        detail:
-          "LangChain's Trust Center (trust.langchain.com) is the canonical source but renders via client-side JavaScript, so it could not be directly verified by an automated fetch; the LangSmith-side certification is independently confirmed on a static docs page.",
-        shortValue: 'Yes, SOC 2 Type II for LangSmith; LangGraph Platform shares it',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://docs.langchain.com/langsmith/regions-faq',
-            label: 'Regions FAQ - Docs by LangChain (confirms SOC 2 Type 2)',
-            asOf: '2026-07-08',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Yes: LangSmith offers selectable regions at no extra cost — US (GCP US), EU (GCP EU), APAC (GCP APAC), and a separate AWS US region',
@@ -835,11 +820,12 @@ export const langchainProfile: CompetitorProfile = {
         confidence: 'unknown',
         sources: [],
       },
-      additionalCompliance: {
-        value: 'HIPAA and GDPR, in addition to SOC 2 Type II',
+      compliance: {
+        value:
+          "LangSmith is SOC 2 Type II, HIPAA, and GDPR compliant; LangGraph Platform (now LangSmith Deployment) shares LangSmith's SOC 2 attestation and compliance posture",
         detail:
-          "LangChain's own docs and Trust Center state LangSmith is SOC 2 Type II, HIPAA compliant, and GDPR compliant; no ISO 27001, PCI-DSS, or FedRAMP attestation was found on LangChain's own compliance materials.",
-        shortValue: 'HIPAA and GDPR compliant, alongside SOC 2 Type II',
+          "LangChain's own docs and Trust Center state LangSmith is SOC 2 Type II, HIPAA compliant, and GDPR compliant; no ISO 27001, PCI-DSS, or FedRAMP attestation was found on LangChain's own compliance materials. The Trust Center is the canonical source but renders via client-side JavaScript, so it could not be directly verified by an automated fetch; the LangSmith certification is independently confirmed on the static Regions FAQ page.",
+        shortValue: 'LangSmith/LangGraph SOC 2 Type II; HIPAA and GDPR compliant',
         confidence: 'verified',
         sources: [
           {

apps/sim/lib/compare/data/competitors/langflow.ts

@@ -689,15 +689,6 @@ export const langflowProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          "Unknown: no public documentation or official page states a SOC 2 certification for Langflow. The docs' Security page discusses infrastructure-level responsibility for operators, not a compliance certification.",
-        detail:
-          'Security docs place isolation and compliance burden on the deploying organization.',
-        shortValue: 'Unknown, no SOC2 certification documented',
-        confidence: 'unknown',
-        sources: [],
-      },
       dataResidency: {
         value:
           'Yes via self-hosting: Langflow can be fully self-hosted on Docker, Kubernetes, on-prem, or any cloud region, giving organizations full control over data residency. No dedicated managed regional-hosting product is documented for Langflow Cloud.',
@@ -737,10 +728,12 @@ export const langflowProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'Unknown: no public documentation or official page confirms HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP certification for Langflow.',
-        shortValue: 'Unknown, no compliance certifications documented',
+          'Unknown: no public documentation or official page confirms SOC 2, HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP certification for Langflow.',
+        detail:
+          "Langflow's security documentation treats infrastructure isolation and compliance as the deploying organization's responsibility rather than a certification held by Langflow.",
+        shortValue: 'Unknown, no SOC 2 or other compliance certifications documented',
         confidence: 'unknown',
         sources: [],
       },

apps/sim/lib/compare/data/competitors/make.ts

@@ -849,20 +849,6 @@ export const makeProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC 2 Type II and SOC 3 completed; ISO 27001 certified; GDPR compliant',
-        detail:
-          "Make's Security page lists completed SOC 2 Type II audit, a publicly available SOC 3 report, ISO 27001 certification for the platform, and GDPR compliance. HIPAA is not mentioned on this page.",
-        shortValue: 'SOC 2 Type II, SOC 3, ISO 27001, GDPR',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://www.make.com/en/security',
-            label: 'Make Security page',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Yes: choice of US or EU data center at organization creation; Enterprise gets an isolated AWS environment',
@@ -918,12 +904,12 @@ export const makeProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'SOC 2 Type II, SOC 3, and ISO 27001 certified, plus GDPR adherence; no HIPAA, PCI, or FedRAMP mentioned',
         detail:
           "Make's Security page states the company operates an ISO 27001-certified information security program and runs infrastructure compliant with SOC 3 and SOC 2 Type II audits, alongside GDPR adherence (Make also has a dedicated GDPR page). HIPAA compliance is not mentioned or offered.",
-        shortValue: 'No HIPAA, PCI, or FedRAMP',
+        shortValue: 'SOC 2 Type II, SOC 3, ISO 27001, GDPR; no HIPAA, PCI, or FedRAMP',
         confidence: 'verified',
         sources: [
           {