Stack Check is a free, AI-assisted tool that reads a software vendor’s publicly posted legal documents and reports what those documents state about customer data. This page shows the prompt and scoring code in use as of the date in the changelog, so owners, vendors, and attorneys can check how a result was produced.
Stack Check is built by Documint PM (DPM). DPM also sells software to construction companies, so we are an interested party. To keep it fair, every vendor, including DPM, goes through the same prompt and the same scoring code. DPM’s own result is run on the same page as every other vendor at /stack-check. Stack Check does not recommend any product, including ours. No vendor pays for a result, a grade, or placement on the Reviewed list.
Stack Check reads Terms of Service, Master Services Agreements, Data Processing Addendums, AI terms, privacy policies, and trust centers posted on the vendor’s own website. It reports what those documents state against six questions every owner should ask, and shows a score calculated by code.
Stack Check uses only pages on the vendor’s own website and its subdomains (for example legal.vendor.com, trust.vendor.com, or vendor.com/legal). If you paste a link to another site, the result is labeled “Unverified source” and is never saved as that vendor’s result. Stack Check reads a few public pages per lookup, respects robots.txt where applicable, and limits each visitor to 5 fresh lookups an hour. Short passages from the vendor’s pages may be shown in the result, with a link back to the full document on the vendor’s own site.
Every result starts with the six questions an owner should ask any software company. Order is preserved on every card.
Every answer begins with one of “The documents state…”, “The documents suggest…”, “The documents allow…”, or “We did not find…” so the reader always knows the source is the paperwork, not the company. The source URL used to answer the question is linked at the end of each answer.
| Status | Meaning | Score |
|---|---|---|
| ✓Clear | The documents give a direct, favorable-to-a-US-shop answer. Examples: customer owns their content, no sale or license to third parties, no AI training without opt-in, data stored in the US, self-service export, 72-hour breach notice. US-based storage with vague replication language still counts as clear, because naming the US is favorable for a US shop. | 10 / 10 |
| !Attention | A specific clause in the documents a shop owner should raise with the vendor before signing. Requires a concrete clause (perpetual license, AI training with no opt-out, data stored only outside the US, no exit export, express sale to third parties). Ambiguity, lack of detail, or things the owner wishes were spelled out are NOT attention. A license to run the service is NOT a sale. | 2 / 10 |
| ?Not found | The documents are silent on this question. Used only when the public documents we read do not address it at all. Not used for ambiguity. Not found is neutral. It does not count for or against the vendor. | excluded |
The AI only classifies each question. Code in your browser calculates the grade. The score is the sum of earned points divided by the sum of possible points on the questions that were found (clear or attention). Questions marked Not found are excluded from both the numerator and the denominator, so silence never lowers the grade. Every card shows “Scored on N of 6 questions found in the public documents” so a reader knows exactly how much of the vendor’s terms the score is based on.
Q4 (“Do you sell it?”) triggers “Review carefully” even if the overall score is high, because sale or third-party license is a specific concern a shop needs to resolve before signing. A license granted to the vendor so the vendor can run the service is not treated as a sale; a finding on sale requires a clause that expressly allows selling, renting, or licensing customer data to third parties for the third party’s own use.
This is the full user-message prompt the Netlify function sends to Claude on every lookup. Nothing is hidden.
${effectiveVendor}, ${url}, and the questions list are the only interpolations.
buildPrompt() in /netlify/functions/tos-lookup.jsYou are the document reader for Stack Check, a free educational tool
by Documint PM (DPM). DPM also sells software, so you must be strictly
neutral: you do not favor, recommend, or criticize any vendor,
including DPM.
YOUR JOB
Read a software vendor's publicly posted legal documents (Terms of
Service, Master Services Agreement, Data Processing Addendum, AI or
acceptable use terms, privacy policy, trust or security center) and
report what those DOCUMENTS state about customer data. You describe
documents, never the company's conduct, intent, or actual practice.
WHAT YOU MUST NOT DO
- Do not give legal advice, say whether to sign, or say a contract
is safe, unsafe, legal, or illegal.
- Do not guess, infer, or fill gaps from memory, news, reviews, or
other vendors. If you did not read it in a qualifying document
today, it is unknown.
- Do not state facts about the company.
- Do not use words like dangerous, shady, toxic, scam, avoid,
winner, or loser.
SOURCE RULES
1. Qualifying sources are pages on the vendor's own primary domain
or its subdomains (legal.<domain>, trust.<domain>,
<domain>/legal).
2. Ignore third-party summaries, news, review sites, forums, and
cached copies.
3. Record the URL of every qualifying page you actually read in
"sources".
STEP 1. You have 3 web searches. Spend them like this:
* Search 1 — "${effectiveVendor} terms of service"
Read the FIRST result on the vendor's own website.
* Search 2 — "${effectiveVendor} privacy policy".
* Search 3 (only if needed) — "${effectiveVendor} data processing
addendum" OR "${effectiveVendor} trust center".
(If the user supplied a URL, Search 1 becomes the quoted URL and
the vendor-domain check still applies.)
STEP 2. Read what you find. For each of the six questions below,
write ONE plain-English paragraph (2 to 4 sentences, no legalese).
WORDING RULES (mandatory on every answer):
Begin every answer with one of these openers:
"The documents state..."
"The documents suggest..."
"The documents allow..."
"We did not find..."
End each answer with the source URL in parentheses, for example
"(Source: https://example.com/privacy)".
LICENSE IS NOT SALE
- A license for the vendor to host, process, or use content to
provide or improve the service is a LICENSE. Report it in Q1,
not Q4.
- Q4 attention is reserved for a clause that expressly permits
selling, renting, trading, or licensing customer data (or
identifiable records derived from it) to third parties for the
third party's own use.
- A CCPA "Do Not Sell" link is a California legal requirement for
most sites; it does not mean the vendor sells data.
Then classify each answer:
"clear" - The documents give a direct, favorable-to-a-US-shop
answer.
"attention" - A concrete clause the shop should raise with the
vendor before signing. Requires a specific clause.
"unknown" - The qualifying documents did not address this at
all. Use for silence only, NOT ambiguity.
NEVER flag "attention" for:
- a license to run the service (Q1 clear)
- a long but named subprocessor list (Q3 clear)
- a CCPA "Do Not Sell" link alone (Q4 clear)
- API-based or request-based export (Q5 clear)
- generic "improve the Services" language (Q6 clear)
- US-based storage with vague replication language (Q2 clear)
- ambiguity, lack of extra detail, or wishes
Silence on AI = unknown.
QUESTIONS (answer in this exact order):
1. What do you do with our data?
2. Where is it stored?
3. Who has seen it?
4. Do you sell it?
5. Can I have a copy?
6. Are you training models or using our data for any development?
STEP 3. Write a one-sentence "tldr" starting with "The documents"
or "We did not find". If there are concerns worth flagging, write
1 to 3 short "key_concerns" bullets. Write 2 to 3 neutral
"next_steps" questions the owner can take to the vendor.
STEP 4. Return a single JSON object and NOTHING else:
{
"vendor_name": "<canonical name>",
"tldr": "<one sentence, with required opener>",
"key_concerns": ["<concern 1>", "<concern 2>"],
"answers": ["<q1>", ..., "<q6>"],
"statuses": ["clear"|"attention"|"unknown", ... x6],
"next_steps": ["<step 1>", "<step 2>", "<step 3>"],
"sources": ["<url 1>", "<url 2>"],
"confidence": "high" | "medium" | "low",
"notes": "<any caveats>"
}
Scoring is done in the browser, by code, not by the AI. The model only classifies each
question. The percentage, the verdict, and the icon come from this JavaScript. It is identical to what
ships in the deployed /stack-check/stack-check.js file.
// Per-section score out of 10. Not Found (unknown) does NOT
// contribute to the score or the denominator per methodology v0.2:
// silence is neutral, never a penalty.
// clear = 10 of 10 (favorable, verifiable)
// attention = 2 of 10 (specific clause works against the shop)
function scoreForStatus(s) {
if (s === 'clear') return 10;
if (s === 'attention') return 2;
return 0; // unknown — excluded from both numerator and denominator
}
// Verdict math (methodology v0.2):
// * Score = sum(points) / (10 * number of checks with status clear
// or attention). Unknown checks are excluded from the denominator.
// * "Incomplete" tag applies when fewer than 4 of 6 checks were
// found, because the sample is too thin to grade.
// * Review-carefully (skull) when score < 70% OR Q4 flagged
// attention (sale/third-party license concern).
// * All headlines describe DOCUMENTS, not company conduct, so copy
// stays defensible.
function computeVerdict(statuses) {
var earned = 0, denom = 0, foundCount = 0;
for (var i = 0; i < statuses.length; i++) {
if (statuses[i] === 'unknown') continue;
earned += scoreForStatus(statuses[i]);
denom += 10;
foundCount++;
}
var pct = denom > 0 ? Math.round((earned / denom) * 100) : 0;
var sellMayApply = statuses[3] === 'attention';
var incomplete = foundCount < 4;
var bad = !incomplete && (pct < 70 || sellMayApply);
// ... (full function in the deployed source)
}A “Reviewed” card on the Verified vendors list means a person at DPM read the cited documents on the date shown and confirmed that each finding matches its quoted clause. It does not mean the vendor endorsed or approved the result, and it is not a legal review. Reviewed cards still carry the same disclaimers as AI-generated cards.
Vendors and users can request a correction with the buttons below. We reply within 2 business days. If a quoted clause does not support a finding, we hide that card while we re-review it and repost it corrected within 5 business days. We fix AI errors as well as outdated documents. Every corrected card shows “Corrected on [date]” and what changed.
If a Stack Check report misses or mischaracterizes something in your public documents, we want to know. We will re-read the documents you link, re-run the lookup, and update the card. If your documents have moved, send us the new links. If you want to appear on the Reviewed vendors list, send us the links you want graded.
Request a correction Submit your doc linksStack Check is an educational research tool and is not legal advice. Nothing on this site is a substitute for an attorney. Stack Check is provided “as is,” without warranties of any kind, including accuracy, completeness, or fitness for a particular purpose. To the fullest extent allowed by law, DPM is not liable for any decision made, or loss suffered, from using Stack Check results. Use of Stack Check is subject to our Terms of Use.
Vendor names are trademarks of their owners and are used only to identify whose documents were reviewed. Stack Check is not affiliated with, sponsored by, or endorsed by any vendor listed, or by the maker of the AI model it uses.