Methodology & disputes
Scores are automated assessments, not legal advice. Every leaderboard entry reflects Fineprint's methodology applied to the vendor's public document as of the published date. Verify findings against the quoted source text.
Reading the score
This is a risk score, not a grade: 0 is best, 100 is worst. A score of 100 means the vendor's terms reserve the maximum measured rights against you — mandatory arbitration, broad data licenses, unilateral change clauses, and the like. A score of 0 would mean none of our 21 risk categories fired. Think of it as a smoke detector reading, not a report card.
Relatively clean terms. Few or no risky clauses found. Still worth a skim before your agent clicks accept.
Some rights reserved against you. Read the flagged clauses before committing data or money.
Significant one-sided terms. Negotiate or set policy guardrails before deploying agents against this vendor.
The vendor's terms heavily favor the vendor. Seven of our eleven launch vendors land here — including GitHub, OpenAI, and Stripe at 100. Assume your agent is signing away real rights.
Scores are comparative, not absolute: a vendor at 65 (Google) isn't "safe," it's just reserving fewer rights than one at 100. Always read the actual flagged clauses — the score tells you where to look, the quotes tell you what it costs.
How scoring works
The vendor's public terms document is fetched and normalized. A content hash is stored so every score is reproducible.
Clauses are extracted against a closed 21-category taxonomy (arbitration, data sharing, termination, plus four agent-friendliness categories — see below). Every clause must be quote-grounded in the source — no quote, no clause. Off-taxonomy output is dropped.
Risk scoring is deterministic: severity-weighted clause counts produce a 0–100 score, mapped to low / medium / high / critical. No language model participates in scoring. The same document always produces the same score.
Pass / flag / block is derived from deterministic policy rules over the extracted clauses — the same ruleset agents can apply to their own scans.
Entries older than the freshness window are marked stale. Terms change; scores are a snapshot, not a permanent grade.
Agent-friendliness
Alongside the risk score, every assessment answers a separate question: do these terms even permit an AI agent to use the service? Many terms prohibit bots or "automated access" — and that agreement binds the user, not the agent. An agent that accepts such terms on a principal's behalf may put the principal in violation.
The verdict is deterministic, computed from four taxonomy categories — not judged by a language model:
bot_automation_ban— the terms prohibit bots, crawlers, scrapers, or automated (non-human) access.account_delegation— rules on sharing credentials or authorizing a third party (including an AI agent) to act on the account holder's behalf.ai_agent_terms— explicit terms about AI agents: permitted, restricted, or subject to disclosure.automation_permitted— the terms explicitly allow automated access or agents acting for the user.
Automated access is prohibited. An agent should not use the service without the vendor's written permission.
Delegation limits or AI-agent conditions apply, but no outright ban. The conditions must be satisfiable before an agent proceeds.
Automation is explicitly permitted, or agent terms appear only neutrally. Assess the risk score as normal.
No agent-relevant clauses detected either way. Agent use is neither permitted nor prohibited on the face of the terms — treat as unknown, not as permission.
What scores don't mean
A high score does not mean a vendor is breaking the law, acting in bad faith, or unsafe to use. It means their written terms reserve more rights against the user across our taxonomy. Business context, negotiation, and actual behavior are outside what we measure.
Quotes and fair use
Published reports include short quotes from the vendor's own public document, attributed to the source, for purposes of commentary and criticism. If you believe a quote is misattributed or excessive, use the dispute process below.
Dispute a score
If you represent a listed vendor and believe a score is wrong — stale document, mis-scored clause, wrong document fetched — email fineprintcorp100@gmail.com with:
- The service name and the leaderboard entry URL.
- What is wrong: the specific clause(s), the correct reading, and a link to the current document.
- A contact who can answer follow-up questions.
Process: we acknowledge within 5 business days, re-run the assessment against the current document, and publish a correction or a written explanation within 14 days. Corrections update the entry in place with a new assessment date; the prior score remains visible in the entry history. Frivolous or abusive disputes are closed without action.
Request a re-scan
Vendors may also trigger a fresh assessment at any time after updating their terms — email the address above with a link to the new document and we will re-score and republish.
Embed your score (badges)
Vendors with a published score can embed a live Fineprint badge on their own site:
<a href="https://YOUR-API/methodology.html">
<img src="https://YOUR-API/v1/badge/your-service.svg"
alt="Fineprint ToS risk score">
</a>
Replace YOUR-API with the API host and your-service with your leaderboard service slug (lowercase, e.g. acme). The badge always shows your current published score and links back to this methodology page. If your score improves after a re-scan, the badge updates automatically.