How much does a public customer list prove? A reproducible evidence audit
Audit a fixed VendorCensus export for source types, missing dates and scope before turning observations into customer claims.
Sample and method
We audited 78 records covering 37 company domains. This is the entire merged presence dataset from current.json and the September 12, September 15, September 20 and October 15 batches, with later records replacing earlier records with the same ID. Historical AX records are separate and excluded. This is a metadata audit of our own selected coverage, not a random sample of software buyers or an independent re-verification of every live source.
Computed findings
The script reads the downloadable frozen input, counts missing fields and reports a SHA-256 hash so another reader can verify they used identical bytes.
| Check | Result | Interpretation |
|---|---|---|
| Records / companies | 78 / 37 | Multiple vendor records can refer to one company |
| Duplicate IDs | 0 | ID uniqueness does not establish factual accuracy |
| Missing source URL / scope | 0 / 0 | Field completeness, not proof that a URL is still live |
| Missing publication date | 77 | Observation date must not stand in for publication |
| Missing effective date | 75 | Not every source type has an effective date |
| Missing adoption date | 78 | Do not infer a buying date from first observation |
| Observation range | 2026-09-10 to 2026-10-15 | When these records were reviewed, not today’s deployment inventory |
Source-type mix
Different sources answer different questions. The counts below come directly from the script.
| Source type | Records |
|---|---|
| Customer story | 33 |
| Public job board | 12 |
| Security documentation | 2 |
| Subprocessor disclosure | 30 |
| Vendor access documentation | 1 |
A claim ladder for analysts
A public job board can show an observable hiring system for that domain. A customer story can describe historical implementation. A subprocessor disclosure can name a supplier for a processing purpose. None, alone, gives current contract value or proves every subsidiary uses a product.
- Retain the original URL and exact scope before deduplicating.
- Store publication, effective, observed and adoption dates in separate columns.
- Use “not stated” when the source does not answer a question.
- Recheck important rows manually before an account decision; do not treat complete metadata as complete truth.
Reproduce or challenge the audit
Download the input and script into one directory and run: python3 audit-evidence.py evidence-audit-input.json. Compare the output hash and counts with evidence-audit-results.json. The audit does not fetch URLs, test their availability or score claim correctness. A useful extension is a separately dated manual review of a defined subset with row-level pass/fail reasons.