DataGuard vs OneTrust: how they compare in 2026

Machine learning sits at the edges of a conventional compliance management platform. The substance of what is bought is a policy and control library, a risk register with pre-built treatment plans, an asset inventory, framework templates for ISO 27001, GDPR, NIS2, TISAX and the EU AI Act, evidence collection, and the statutory privacy workflows: record of processing, data subject requests, impact assessments and breach management. Strip the models out and all of that still functions, which is what the platform was before AI. Where AI actually appears is visible in the published plan comparison rather than in the marketing: an **AI co-pilot** listed as a feature line under Admin and Access Controls, and an **AI-assisted questionnaire processing tool for administrative support** under Trust Management, available only with the advanced security platform. AI-powered automation is named as a platform pillar included from the Base tier and the headline claim is up to forty per cent of tasks automated. That is a real layer and it is not the mechanism being sold. Recorded as a limit on this grade rather than glossed: the dedicated AI-Powered Automation page returned navigation and one line of body text, so the detail of the capability could not be read; the grade rests on the plan comparison table, which is explicit about where AI sits.

Artificial intelligence is present, shipped and contractually confirmed, and it is a layer on a product whose value stands entirely without it. The core is registry and workflow software: a data and activity map, consent banners and preference centres, data subject request automation, vendor and third-party inventories, assessment templates across more than fifty standards, and policy approval workflows. Remove every model and all of that continues to work, which is the distinction this axis asks about. Where AI appears it accelerates an existing step rather than constituting one, with an AI-assisted risk assessment producing a summary and key findings that then route to human approval. Worth separating two things that are easy to conflate here: OneTrust sells AI governance as a subject matter, maintaining registers of a customer's models, agents and datasets and applying runtime controls to them, and that is the product managing someone else's AI rather than the product being AI. The Master Terms confirm the vendor's own use, answering the question of whether AI is used in the services with a plain yes.

Nothing published addresses the accuracy or grounding of the AI features, and the numbers that are published are expressly disclaimed by the vendor. The AI capabilities located are an AI Co-pilot and an AI-assisted questionnaire processing tool for administrative support, the latter restricted to the Advanced tier in the published plan table. No accuracy figure, test set, evaluation, method, grounding description or hallucination statement attaches to either. The percentages the site does carry are operational rather than accuracy claims, running to automating up to 40 per cent of tasks, reaching certification 75 per cent faster and a 100 per cent first-try pass rate, and every page carrying them appends a statement that the data is for information only, based on internal estimates, is not indicative of KPIs, and is given without warranties or guarantees as to accuracy or reliability. A vendor disclaiming the reliability of its own published figures is the opposite of a measured accuracy position. Surfaces checked on 4 September 2026: the home page, the product and compliance product pages, the pricing plan table, the GDPR framework page and the DPIA and risk assessment page. The AI-Powered Automation page at /platform/ai-automation/ returned navigation, footer and a single body line across three attempts and was partially recovered through search; the Experts-in-the-Loop page and the Trust Center Controls section remain unread, and either could carry material that moves this row on amendment. Row written 4 September 2026.

Accuracy is not asserted loudly and it is not measured either, and the document that would answer it is obtainable rather than published. The AI-assisted assessment shown on the home page produces a risk summary and graded findings across personal data processing, model accuracy and transparency, which is an output a compliance officer will act on, and no accuracy rate, benchmark, test set or error mode for it was located on any public surface. Several limbs of this axis do not bite: the product does not retrieve primary legal authority, so grounding to openable sources and citator checking are not the relevant questions, and the applicable risk is a wrong risk rating rather than a fabricated citation. The AI Systems Transparency Report is the artifact that would carry this and the Master Terms describe it as available upon request, which under the gated-is-not-absent rule is the middle tier rather than an absence, but its contents could not be read on 1 September 2026. Checked the home page, the trust centre, the pricing and packaging page and the published contracting explainer.

Oversight is the explicit selling proposition and no mechanism is described. The published model is experts-in-the-loop: automate when you want it, get expert help when you need it, with certified consultants stepping in for complex decision-making and strategic review, and a dedicated platform page for the concept. That is a genuine position and it is unusual for being sold as a paid tier rather than asserted as a design principle. But the humans in that loop are **DataGuard's consultants, not the customer's own reviewers**, and access to them is what separates the Pro plan from Base, so on the Base plan the oversight described is simply absent from the purchase. Nothing published identifies a review point inside the product, no confidence or uncertainty signal is described against AI output, nothing states which automated actions require approval before taking effect, and nothing addresses what happens when the co-pilot is wrong in a record that later supports a certification audit. The dedicated Experts-in-the-Loop page was not opened in this pass.

A review point is not merely claimed but drawn, with named roles, and the surrounding control structure is incomplete. The AI use case workflow published on the home page runs intake, then AI risk assessment, then a review and approve stage showing three pending reviewers identified as Privacy, Security and Legal, then continuous monitoring described as real-time oversight and alerts after workflow completion. That places the machine output before a human gate and says who holds it, which is more than most vendors in this lane publish. The AI Governance package reinforces it commercially, listing configurable approvals, attestations and evaluation gates before AI systems move to production, and runtime controls across prompts, outputs, data access and allowed AI actions. What is missing is the rest: nothing states what the assessment does unattended, at what confidence it defers, or what happens after it is wrong, and no statement was located about the behaviour of OneTrust's own models as distinct from the governance gates it sells.

Scale is asserted at corporate level and every performance figure is disclaimed by the vendor itself. The published claims are specific: more than 4,000 organisations across 50 or more countries, up to forty per cent of tasks automated, certification and compliance seventy-five per cent faster, fifty per cent lower costs, compliance reached in as little as three months, and a hundred per cent first-try pass rate on certification. Third-party standing is real and independently checkable, with G2 category leadership badges for Data Privacy Management across Europe, EMEA and the United Kingdom, a Consent Management high performer badge, a 4.6 rating on both G2 and Capterra, and a Gartner Peer Insights listing. What undercuts the numbers is DataGuard's own footer, which appears on every page: **all data provided is for information only, based on internal estimates, not indicative of KPIs, and given without warranty as to accuracy or reliability.** The vendor is telling a reader not to rely on its own figures, which is candid and leaves the outcome claims without a stated basis. No named customer was read; the Success Stories page was not opened in this pass.

A named customer, a named individual and real figures are published, and nothing carries a date. The GOL customer story quotes Bruna Boccini, Head of Compliance and Data Protection Officer at the airline, and gives specific before-and-after numbers in her own account: vendor approval falling from almost thirty days to between five and zero, and request completion falling from fourteen or fifteen days to a few minutes, against a described estate of seven billion identifiers and thousands of data flows and vendors. A commissioned Forrester Total Economic Impact study adds a 227 per cent three-year return and a seven-month payback, which is a figure attached to a documented methodology a reader can assess. Around those sit a large named logo set including Adobe, Samsung, Pfizer, Walgreens, Aetna, Atlassian, Maersk and Bristol Myers Squibb, and a claim of more than 14,000 customers with more than half the Fortune 500. What holds this below the top band is dating: no located customer story or study carries a date, and the operational figures are the interviewee's own account rather than a measured study.

Confidentiality is evidenced through security posture rather than through a readable commitment about customer content. What is located and solid: a trust centre publishing an ISO 27001 Statement of Applicability and reports available on request, single sign-on and granular user permissions as published plan features, an Admin and Access Controls feature group, and a company operating from Munich under German and EU data protection law selling data protection compliance as its business. What is not located is the substance this axis measures. Nothing readable states whether customer content is used to train models, no retention or deletion position for customer data was found, and no model provider is identified. **The limit is mine and is stated rather than converted into a finding**: the privacy policy and the separate platform privacy policy both returned navigation and footer with no body across three fetch attempts on two URLs, while the home and pricing pages rendered normally, so this is page-specific rather than a site property. The commitments may well exist in those documents; they could not be read on 4 September 2026 and are not credited either way.

The published commitments are substantive and contractual, and the training question is not answered. What a buyer can read before signing: a Data Processing Addendum published openly with version history, purpose limitation providing that personal data is processed only for the limited purposes described in the agreement and that OneTrust will not buy or sell customer personal data, customer retention of ownership of all data input into the services, tenant separation with data held in a logically-separated cloud database and a single production environment per customer, ISO 27701 certification for privacy information management, and deletion or export rights exercisable at any time during the term and for sixty days after it ends. Against that, nothing located states whether customer content is used to train or improve models, which is the first question this axis asks and a conspicuous silence for a company selling AI governance; the position on third-party model providers is equally absent; and privilege and work product are never mentioned, which matters because the platform is sold to privacy counsel and the workflow assigns a legal reviewer.

No position on advice versus tooling was located, on a product that sells a regulated advisory role. This matters more here than on most records because of what is actually being offered: an add-on under which the customer **nominates DataGuard as its external Data Protection Officer**, a role with statutory duties and independence requirements under Articles 37 to 39 of the GDPR, alongside an equivalent external Information Security Officer offering and consultants providing information and advice on regulatory obligations and certification requirements. Nothing published addresses where the tooling stops and advice begins, whether the platform's guided workflows and template libraries constitute advice, how the independence of a nominated DPO is preserved when the same company also sells the compliance platform being assessed, or what the customer remains responsible for. Searched the home page, pricing page, product overview, trust centre and the published Consent and Preference Management documentation on 4 September 2026.

Nothing located addresses the line between an information tool and legal advice, on a product that produces compliance determinations for a professional audience. The platform assigns risk ratings, generates assessments against named regimes including the EU AI Act, GDPR and US state privacy laws, and routes them to a reviewer identified as Legal, so the output is consumed as a compliance judgement. What is published in its place is a performance commitment rather than an advice-line position: the Master Terms warrant that the cloud services will materially conform to the OneTrust User Guide throughout the subscription term. No statement was located that outputs are not legal advice, that OneTrust is not a law firm, that no professional relationship arises, or that a user should take advice on their own facts, and no jurisdiction limit or supervision and competence discussion appears. **This is the row most likely to move on this record**: the Master Terms PDF itself and the Legal and Compliance Information page were not opened on 1 September 2026, and a disclaimer may sit in either, so the grade rests on the home page, trust centre, pricing page and published contracting explainer.

No governance position for DataGuard's own artificial intelligence was located, on a vendor that sells AI governance to its customers. The product side is substantial and specific: EU AI Act is a named framework alongside GDPR, ISO 27001, TISAX and NIS2, the platform consolidates AI governance workflows with the customer's ISMS and privacy programme, and the assessment template library includes an AI system assessment. All of that is governance tooling the buyer operates over its own systems. Nothing published turns the same instrument on the vendor: no responsible AI statement, no named owner accountable for model behaviour, no pre-release evaluation regime, no testing results, and nothing at all on bias in the AI Co-pilot or the questionnaire processing tool. The distinction matters because it is the vendor's own mechanism that this axis asks about, and a customer-facing AI Act workflow is not a disclosure about the supplier. Surfaces checked on 4 September 2026: the home page, the product overview, the compliance product page, the pricing plan table, the GDPR framework page, the DPIA page and the site footer inventory, which lists no responsible AI or AI governance disclosure page. The AI-Powered Automation page did not render and was partially recovered through search; the Trust Center was not reached. Row written 4 September 2026.

A governance framework with real substance is published and its results are not. The trust centre states that OneTrust's AI governance programme is managed by an interdisciplinary AI Governance Committee, supported by AI governance processes across the organisation and the AI systems lifecycle, an internal AI use policy and employee training. That is an accountable body, a lifecycle scope and two named instruments rather than a list of adjectives, and it is backed by a dedicated Responsible AI section, a published Journey to AI Governance toolkit and an AI Systems Transparency Report. Two things keep it below the top band. No individual is named as accountable, the committee being identified only by function. And nothing has been disclosed about uneven output: no bias evaluation, no testing regime and no result appears on any public surface, which is a notable gap for a vendor whose own product sells bias and drift monitoring to others. The AI Systems Transparency Report is available on request rather than published, so it sits in the middle disclosure tier and its contents were not read.

Two limbs are answered and the rest could not be read. Access control is published as product substance rather than assertion, with single sign-on, granular user permissions and a dedicated Admin and Access Controls feature group in the plan comparison, plus role-based permissions reported in the platform's feature set. A trust centre exists at trust.dataguard.com, publishes an ISO 27001 Statement of Applicability and reports, and states its own access route plainly: documents are requested by entering an email address and the team reviews requests within 24 hours. Beyond that the set is unestablished. No retention period, no deletion commitment, no subprocessor list and no incident or breach notification practice for DataGuard's own processing was located, which is a conspicuous gap on a vendor whose product sells incident and breach management to others. As on the confidentiality axis, the reason is stated rather than dressed as an absence: both privacy policies returned no body text across three attempts, and the trust centre's Controls section did not render.

Every limb this band names is published, current and specific enough to hold the vendor to, and this is the strongest stewardship record located in the corpus. Retention is customer-configurable rather than merely stated, with services shipping built-in data minimisation functionality including auto-deletion and retention periods, and OneTrust expressly encouraging customers to configure them down. Deletion is contractual and time-bounded: customers may delete or export their data in a structured, commonly used and machine-readable format at any point during the term and for up to sixty days after termination, after which remaining data is deleted under a destruction policy. Access control runs through customer-administered user access plus ISO 27001, 27017 and 27701 certification, with the security obligations set out in Appendix 1 of the published DPA. Subprocessors are maintained on a list with a thirty-day advance notice commitment for changes and a right to object on reasonable data protection grounds, remedied by an alternative provider or termination of the affected subscription. Incident practice is stated: notification without undue delay, continuing updates on material developments, and cooperation with the customer's own reporting obligations. Encryption is given concretely at AES-256 at rest and in backup and a minimum of TLS 1.2 in transit, and the trust centre publishes a 2026 penetration test executive summary alongside disaster recovery and business continuity exercise memos. The one soft edge is that the subprocessor list itself sits on the customer portal rather than the open trust centre.

No customer agreement is published anywhere on the site, and this rests on an established page inventory rather than on a failed fetch. The footer carries exactly four legal links: Privacy Policy, Legal Notice, Cookie Policy and Trust Center. The Legal Notice is the Impressum that German law requires of any commercial website and does not govern the customer relationship. There are no terms of service, no general terms and conditions or AGB, no master subscription agreement, no service level document and no acceptable use policy in the navigation, the footer or anywhere else in the site map. No indemnity, liability cap, warranty, uptime commitment or insurance position could therefore be located. A buyer evaluating a platform that will hold its record of processing, its breach register and its certification evidence, and that may supply its nominated Data Protection Officer, has nothing to read on allocation of loss before entering a sales conversation. Checked the full navigation and footer across four rendered pages on 4 September 2026.

What the vendor stands behind is published, specific, versioned and independently assessed, which no other record in this pull matches. The Master Terms of Service are published in full at a dedicated legal centre, currently version 5.1 effective 23 March 2026, with every prior version back to August 2020 downloadable alongside the DPA, Standard Contractual Clauses, Business Associate Agreement and product-specific supplemental terms. The liability position is stated and benchmarked rather than buried: a cap on each party's liability equal to the total annual fees paid or payable in the preceding year, which OneTrust expressly notes is broader than the more common cap tied to fees for the applicable service only, with willful misconduct and intellectual property claims carved out and uncapped. An indemnity with stated scope covers third-party IP infringement claims arising from use of the cloud services, with OneTrust controlling the defence. A warranty a buyer can invoke commits the cloud services to conform materially to the User Guide throughout the term. OneTrust also publishes a plain-language explainer, Contracting with OneTrust, setting all of this out for a reviewer, and states plainly what it will not do, refusing uncapped liability for data breach and giving its reasoning. The Master Terms carry an independent TermScout assessment rating them 70 per cent customer favourable with a perfect score against buy-side deal breakers. What is absent is anything specific to AI output being wrong and any insurance position.

Named integrations with documentation an implementer could work from, scoped to one module. The published developer documentation covers the Consent and Preference Management product and names its integrations individually with setup guides for each: Salesforce, HubSpot and Microsoft Dynamics for CRM; Braze, Brevo, Mailchimp and Salesforce Marketing Cloud for marketing automation; Auth0 and Ping Identity for identity; Snowflake for data warehousing; FormAssembly, Formstack and WordPress Contact Form 7 for forms. Alongside those sit a documented REST API with an OpenAPI reference and Postman collection, webhooks, bulk data export, import and deletion endpoints, embeddable JavaScript widgets, native and webview mobile integration paths, and single sign-on via Azure Active Directory, SAML and OpenID Connect. Two limits hold this below the top band. The documentation covers the consent module only, which is sold as an add-on rather than as the core platform, and it sits on a separate domain carrying the branding of an acquired product, last updated November 2024. The main platform's own Integrations page was not opened in this pass.

Integration is plainly a real part of the offering and no individual connection could be named from the surfaces read. A dedicated Integrations page sits in the platform navigation and is described as an extensive set of integrations for adding data management to existing workflows, the Third-Party Management package refers to automating vendor assessments with ecosystem integrations, the Consent product is described as scaling through APIs to collect and enforce consent across emerging channels, and some services ship components that a customer implements on its own systems and websites such as cookie consent scripts and data discovery agents. OneTrust is additionally distributed through the Azure Marketplace, which has its own published supplemental terms. What is missing is the naming and the depth: no specific system is identified anywhere on the pages read, no API reference or developer documentation was located, and nothing describes what moves in which direction. **The Integrations page was not opened on 1 September 2026**, so this grade is rebuttable upward on one fetch and is recorded conservatively rather than assumed.

Cloud delivery is implied throughout and neither the tenancy model nor a region is stated. European positioning is heavy and consistent, with the company describing itself as the European leader in security and compliance software, operating from Munich, and marketing secure hosting and infrastructure built to meet strict GDPR requirements. None of that is a residency statement: no country, region or data centre is named for where customer data is stored or processed, and secure hosting built for GDPR describes an intention rather than a location. The nearest the published material comes is an enterprise-tier reference to multinationals needing region-specific configurations, which describes a configuration capability rather than a residency option a buyer could select. Nothing states whether the platform is single or multi-tenant, no dedicated or private deployment is offered at any tier, and no separation is drawn between where data sits and where any AI processing happens.

The tenancy model is stated plainly, residency is offered, and the processing question is left open. The published contracting explainer describes cloud services delivered on a shared architecture, codebase and infrastructure, with customer data held in a logically-separated cloud database and each customer receiving a single production tenant environment, with non-production environments included in some subscriptions and further environments purchasable. Residency is a customer choice: customers can select from various geographic hosting locations for their tenant environment. What changes between tiers is also addressed, with HIPAA-compliant and PCI-compliant environments available for customers with specialised requirements, backed by a published PCI attestation of compliance and a HITRUST certification. Two things hold it below the top band. The available regions are referred to collectively rather than enumerated, so a buyer cannot see the list without asking. And where processing happens is nowhere distinguished from where data is stored, which matters for the AI features specifically since no model or provider is identified.

A real trust centre with a self-serve access route, short of the naming a top grade needs. The portal at trust.dataguard.com renders, is publicly linked from the site footer, and states its own access mechanism plainly, which is the thing most portals leave ambiguous: documents are requested by clicking the document and entering an email address, requests are reviewed by the team typically within 24 hours, and anything not listed can be requested by email. That is a self-serve request fulfilled without a sales conversation rather than a form promising an account executive, which is the distinction that earns credit. One artifact is named specifically and is DataGuard's own ISMS document rather than a badge: an **ISO 27001 Statement of Applicability**, alongside a Resources section listing Reports. What is missing from the top band: no certifying body or auditor is named, no certificate number, scope or observation period is published, no date or validity period appears, and the Reports entry is generic so a buyer cannot tell which reports exist before asking. The Controls section of the portal did not render.

This is the trust centre the band describes and the first record in this pull to reach the top of this axis. Attestations are current, independent, and downloadable directly as PDFs with no form, no email capture and no NDA click-through: a SOC 2 Type II report, a second SOC 2 Type II for Certification Automation, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017 and ISO 9001 certificates, and, decisively for the scope limb, **a published Statement of Applicability** setting out which controls are in scope. Industry and sector records sit alongside them: a PCI DSS attestation of compliance signed November 2025 with a third-party responsibility matrix, a HITRUST certification letter, TISAX, TX-RAMP, the Spanish ENS conformity statement, and a CAIQ v4.0.3 self-assessment lodged on the Cloud Security Alliance STAR registry. Security documentation goes beyond certificates to a 2026 penetration test executive summary, a completed standard SIG questionnaire, a security, privacy and architecture whitepaper, and disaster recovery and business continuity exercise memos, with a live system status page. Under the gated-is-not-absent tiers this is open publication rather than the self-serve request tier, which is what separates it from every other record graded on this axis so far.

The vendor refers to its AI capability repeatedly and never identifies what sits underneath it. AI-Powered Automation is a named platform pillar, AI Co-pilot and an AI-assisted questionnaire processing tool appear as line items in the published plan table, and AI-powered automation is the phrase used in the organisation description carried in schema markup across every page. Against that, no model is named, no provider is identified, no version is given, no hosting or processing location is stated for the AI leg, and no commitment to notify customers when any of it changes was located. A buyer can establish that the platform uses AI and nothing about whose AI it is, which is the substance of this band. The company is DataCo GmbH of Munich and the platform is sold on European data protection positioning, which makes the absent processing location a more pointed gap than it would be elsewhere. Surfaces checked on 4 September 2026: the home page, the product overview, the compliance product page, the pricing plan table and the footer inventory. A Trust Center is linked in the footer and was not reached in this pass; it is the surface most likely to carry a subprocessor register naming a model provider, and is the cheapest available upgrade on this record. Row written 4 September 2026.

AI use is confirmed and nothing underneath it is identified publicly. The Master Terms answer the question of whether OneTrust uses artificial intelligence in the services with a plain yes, and direct the reader to the AI Systems Transparency Report, described as available upon request. No model, model family, provider or architecture is named on any public surface read on 1 September 2026, and no statement excludes a third-party foundation model either, so a customer cannot tell from published material whose model processes the assessments and documentation it generates. Where inference runs is not addressed separately from where data is stored. No commitment to notify customers when the model set changes was located, though the subprocessor change process does carry a thirty-day notice commitment and would capture a model provider engaged as a subprocessor. This sits above the bottom band because a dedicated transparency artifact exists and is obtainable rather than absent, which is the middle disclosure tier, and below the band above because nothing is actually named where a reader can see it.

Unusually detailed package structure with no figure and no unit of charge anywhere. What is published is genuinely useful: three named tiers with stated audiences, Base as the platform alone for teams with internal expertise, Pro adding hands-on access to in-house experts, Enterprise for complex multi-entity needs; a feature comparison running across roughly fifteen areas covering ISMS documentation, training, risks, controls, vendor management, assets, trust management, admin controls, onboarding, expertise, the annual security programme and information security officer support; explicit markers showing which capabilities require the advanced platform or a dedicated expert; and seven named add-ons that establish what costs extra, including consent management, cookie management, whistleblowing, global legal analysis, exposure management, external Information Security Officer and external Data Protection Officer. A buyer can therefore work out precisely what is in and out of each tier. What no buyer can learn is what any of it costs, or even how it is metered: every tier and every route resolves to Get a quote, and no figure, band, range or charging unit appears anywhere. Nothing states whether pricing runs per seat, per entity, per framework or per employee.

The unit and the structure are published in more detail than anywhere else in this corpus, and no figure appears. A dedicated pricing and packaging page sets out nine named packages across five solution families, each with its key capabilities listed so the feature split between base and suite editions is visible, and, unusually, **each with its own charging meter stated explicitly**: AI Governance priced on admin users and AI inventory; the Consent Management Platform on average daily visitors aggregated across channels and properties; Universal Consent and Preference Management on total data subject profiles captured; Privacy Automation on users and privacy asset inventory; Tech Risk and Compliance on admin users and asset inventory; and Third-Party Management on admin users and third-party inventory. Published FAQs explain what a solution package is, that pricing runs on value-based usage meters, and that a tiered model applies with an account executive moving a customer up a tier when usage consistently exceeds limits. What is absent is the number: no rate, band, floor or currency appears anywhere, every package routes to a Get Pricing form, and nothing states what implementation or professional services add.

Coverage is described by regulatory framework and by company size, and the buyer this index cares about is never addressed. The framework dimension is precise and is the product's real organising principle: GDPR and UK GDPR, ISO 27001, NIS2, TISAX and the EU AI Act, each with its own page, with multi-entity and multi-framework operation named as a capability and 4,000 organisations across 50 or more countries claimed. The segmentation dimension is thin and revealing. **The Solutions menu contains exactly two entries, DataGuard for SMEs and DataGuard for Corporates**, so the only buyer axis the vendor publishes is headcount. No legal, in-house counsel, data protection officer or compliance function page exists, no role is addressed by title anywhere, and no case study was read that would identify who inside a customer owns the tool. That absence is what makes the membership screen turn on function rather than on the buyer surface, and it is recorded here because it is also a coverage finding: a reader of this index cannot learn from DataGuard's own material whether the legal department is the intended owner.

Coverage is described across three deliberate axes with substance behind each, and the boundary is left open. Solutions are organised by function into six families, by role into data, marketing, privacy, and security and risk teams, and by regulation with dedicated pages for GDPR, US privacy law and the EU AI Act plus a wider regulatory index. Practice depth is real: the Tech Risk and Compliance package cites templates and guidance across more than fifty standards, regulations and frameworks, the AI Governance package names the EU AI Act, NIST and ISO 42001 as the frameworks assessments align to, and third-party screening reaches politically exposed persons, sanctions and watchlists through Dow Jones data. The customer base spans regulated industry, retail, pharmaceutical, technology and non-profits on the published logo set. Two gaps keep it here. Nothing states where the product stops, with no statement of organisation size, data volume or the situations it does not fit. And the By Role navigation, which is where a legal buyer would look, offers privacy, security and risk, data and marketing teams and **no page for legal or counsel**, even though the product's own published workflow assigns a legal reviewer.