SaaS security (SSPM): app and AI-agent discovery, posture and compliance, identity & access governance, and SaaS threat detection. AI-generated from public sourcesThe starting point for every profile: auto-generated by 0-Doubt from public vendor materials, and not yet confirmed by the vendor or an independent analyst. Nothing here is hidden or overstated — it simply has not been reviewed yet.Where every profile starts, before the vendor or an analyst has reviewed it. A higher label means a more independent source — not a better product.How trust works →
Capabilities AI-generated from public sourcesThe starting point for every profile: auto-generated by 0-Doubt from public vendor materials, and not yet confirmed by the vendor or an independent analyst. Nothing here is hidden or overstated — it simply has not been reviewed yet.Where every profile starts, before the vendor or an analyst has reviewed it. A higher label means a more independent source — not a better product.How trust works →
AI agent discovery
Agent ecosystem mapping
Permission scoping
Stale access revocation
Agent ownership assignment
Agent lifecycle management
Real-time prompt security
Real-time action security
Real-time event security
Pre-built threat detections
Redundant account discovery
SaaS deprovisioning
Password change for shared credentials
Compliance needs coverage
Read by an AI model from reco.ai’s own pages. What the vendor says it does, not independently verified.
Strengths & gaps by category
neutral · vendor-sourced
Drawn from this vendor's own public materials and authored to keep category questionnaires balanced. Gaps reflect capabilities not emphasized in public materials, not rankings.
Strengths: Identity-centric SaaS security with app and AI-agent discovery via a knowledge graph and broad integrations.
Gaps:Newer entrant; very-deep per-app misconfiguration libraries are still expanding versus incumbents.
External ratingsUI-22 — third-party ratingsAggregate rating and review count pulled directly from the source site's own published data — never the review text itself, which belongs to that site. Links go to the real page so you can read the actual reviews there.
IntegrationsUI-12 — integration graphDetected from this vendor's own published integration/partner pages by the enrichment loop — each entry links the exact page it was found on. Directional: "integrates with" is claimed by this vendor; "integrated by" is claimed by the other vendor's site. Coverage grows as the scan progresses.
Trust profileHow to read thisFive separate questions a buyer actually asks, each answered with its own evidence and a link to the source. There is deliberately no overall score: a single number invites comparison it cannot support, and would mostly reflect how much of Reco we have managed to scan rather than anything about the vendor.
Not checked means we have not looked yet, and is never counted against a vendor. Limited means we did look, but found only one line of evidence — enough to report, not enough to corroborate.
checked 13 of 16 signals
Limited
Independently verified
Has anyone other than the vendor confirmed this?
checked 3 of 4
1 independent source(s) corroborate this vendor's claims.
Security & trust signalsAbout these signalsCertifications are labeled by how well evidenced each one is — confirmed in a public registry, stated by the vendor, or merely detected on a page — and every claim links to its source. Security headers are checked live against the vendor's homepage, re-checked every 90 days. These are independent signals and are not blended into a single score.
9 of 9 technical checks completed — not a score, just coverage
Certifications & compliance claimsWhat the tiers meanVerified in a public registry — we confirmed this against an authoritative public registry (FedRAMP Marketplace, CSA STAR) and re-check it by the registry's own identifier. Stated by the vendor — the vendor says it on a page they control; a sourced claim about themselves, not an independent check. Detected on a page — found during automated enrichment, neither registry-confirmed nor stated on the vendor's own site.
Some certifications have no public registry at all — SOC 2 and HIPAA among them. For those, “not registry-verified” is not a shortfall and means nothing about the vendor.
Status historyAbout this timelineEvery incident detected on this vendor's own public status page since we started watching it — sourced from the same structural check as the status chip above, checked roughly hourly (every 5 minutes while an incident is active), never inferred. A resolution requires a real check confirming "operational" again; an incident with no resolution yet shown is still ongoing as of the most recent check.
No outages recorded since we started watching (first checked Aug 13, 2026, 8:46 PM).
Data coverage: 36/100What this measures (and doesn't)
Not a quality rating or endorsement — a measure of how much verified, disclosed data we actually have about this vendor. A low score usually means "we don't have much verified information yet," not "this is a bad vendor." Never used to sort or rank vendor lists.
The platform admin controls the formula's weights.
Data coverage profileHow to read thisThe same four components behind the data coverage score above, shaped instead of listed — a vendor strong on verification but thin on buyer feedback looks visibly different from one that's the other way around. Security and feedback plot at the neutral midpoint (50) when there's no data yet (no products tracked, no reviews), matching how the actual score itself treats missing data — not a guess either way.
Products (13)
Product information on this page is auto-generated by 0-Doubt from public sources and not yet confirmed by the vendor or an independent analyst, unless an item is individually labelled otherwise. How trust works →
Some of these (SOC 2, HIPAA and similar) have no public registry, so no one can independently verify them — that is a fact about the framework, not about this vendor.
Prioritize SaaS threat alerts with 1,000+ pre-built controls.
Recent news (2)Where this comes fromMostly Reco's own public feeds — a GitHub release feed, changelog, status page or company blog. Items marked industry coverage are the exception: those come from a trade publication's feed and name Recowithout being published by them, so they are somebody else's reporting rather than an announcement. Each headline links to the original source. Nothing here is written or reviewed by 0-Doubt, and this list is not a complete record of what the vendor has shipped.
