Compliance Labs builds its software evaluation from three independently maintained reference sources. A regulation corpus covering the obligations that apply to a software category, built directly from primary legal texts and official guidance. A capability reference list for the category (here Data Masking & TDM), built from product documentation across vendors plus expert input. A formal control relationship typology drawn from widely recognised standards, used to characterise how a capability relates to an obligation (direct, contributing, supporting, equivalent).

Each source is built independently to avoid the well-known failure mode where an LLM, asked to extract both obligations and capabilities in a single pass, invents mappings between them. Compliance Labs (CL) keeps the three sources separate, then articulates them in a controlled mapping step. This is the source of the coverage indicators shown throughout the fiche: what the software covers directly, and what remains operated or decided by the organisation.

For this Get Listed fiche, all software contribution signals are Vendor-Stated: derived from public vendor documentation that CL has organised, mapped, and cross-referenced, but not independently verified through artifact inspection or testing. Outcome verification requires the Get Proven or Get Scale tiers, see section 5.3.