diff --git a/apps/sim/app/(landing)/comparisons/comparison-sections.ts b/apps/sim/app/(landing)/comparisons/comparison-sections.ts
index adebba03394..309c119733c 100644
--- a/apps/sim/app/(landing)/comparisons/comparison-sections.ts
+++ b/apps/sim/app/(landing)/comparisons/comparison-sections.ts
@@ -87,11 +87,10 @@ export const COMPARISON_SECTIONS: ComparisonSectionDef[] = [
     group: 'security',
     title: 'Security & compliance',
     rows: [
-      { key: 'soc2', label: 'SOC 2' },
+      { key: 'compliance', label: 'Compliance' },
       { key: 'dataResidency', label: 'Data residency' },
       { key: 'rbac', label: 'Role-based access control' },
       { key: 'auditLogging', label: 'Audit logging' },
-      { key: 'additionalCompliance', label: 'Additional compliance' },
       { key: 'modelAndToolGovernance', label: 'Model & tool governance' },
       { key: 'credentialGovernance', label: 'Credential governance' },
       { key: 'sso', label: 'Single sign-on (SSO)' },
diff --git a/apps/sim/app/(landing)/comparisons/utils.ts b/apps/sim/app/(landing)/comparisons/utils.ts
index 1c896d501fe..d1c79bc228b 100644
--- a/apps/sim/app/(landing)/comparisons/utils.ts
+++ b/apps/sim/app/(landing)/comparisons/utils.ts
@@ -134,7 +134,7 @@ export function buildComparisonFaqs(competitor: CompetitorProfile): ComparisonFa
     },
     {
       question: `Is Sim more secure than ${name}?`,
-      answer: `Security is a like-for-like comparison, not a one-line verdict. Sim: ${summarizeFact(simProfile.facts.security.additionalCompliance.value)} ${name}: ${summarizeFact(facts.security.additionalCompliance.value)} Check the Security & compliance rows above for the full breakdown, including SSO, audit logging, and data residency.`,
+      answer: `Security is a like-for-like comparison, not a one-line verdict. Sim: ${summarizeFact(simProfile.facts.security.compliance.value)} ${name}: ${summarizeFact(facts.security.compliance.value)} Check the Security & compliance rows above for the full breakdown, including SSO, audit logging, and data residency.`,
     },
     {
       question: `Which has stronger AI agent capabilities, Sim or ${name}?`,
diff --git a/apps/sim/lib/compare/data/competitors/claude-cowork.ts b/apps/sim/lib/compare/data/competitors/claude-cowork.ts
index 520bf5550d4..f8c6af9d8b2 100644
--- a/apps/sim/lib/compare/data/competitors/claude-cowork.ts
+++ b/apps/sim/lib/compare/data/competitors/claude-cowork.ts
@@ -749,20 +749,6 @@ export const claudeCoworkProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes (company-wide, not Cowork-specific)',
-        detail:
-          'Anthropic holds SOC 2 Type I and Type II; the detailed report is available under NDA via the Anthropic Trust Portal. There is no Cowork-specific SOC 2 scoping statement.',
-        shortValue: 'Company-wide, not Cowork-specific',
-        confidence: 'estimated',
-        sources: [
-          {
-            url: 'https://trust.anthropic.com/',
-            label: 'Anthropic Trust Center',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'No Cowork-specific residency controls; company-wide default is multi-region processing, US-based storage',
@@ -807,11 +793,12 @@ export const claudeCoworkProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'ISO 27001:2022, ISO/IEC 42001:2023, HIPAA-ready (BAA via sales-assisted Enterprise)',
-        detail: 'Company-wide Anthropic certifications, not Cowork-scoped.',
-        shortValue: 'ISO 27001, ISO 42001, HIPAA-ready',
+          'SOC 2 Type I and Type II (company-wide, not Cowork-specific), ISO 27001:2022, ISO/IEC 42001:2023, HIPAA-ready (BAA via sales-assisted Enterprise)',
+        detail:
+          'Company-wide Anthropic certifications, not Cowork-scoped. The detailed SOC 2 report is available under NDA via the Anthropic Trust Portal.',
+        shortValue: 'SOC 2 Type I/II, ISO 27001, ISO 42001, HIPAA-ready',
         confidence: 'estimated',
         sources: [
           {
@@ -819,6 +806,11 @@ export const claudeCoworkProfile: CompetitorProfile = {
             label: 'What Certifications has Anthropic obtained?',
             asOf: '2026-07-08',
           },
+          {
+            url: 'https://trust.anthropic.com/',
+            label: 'Anthropic Trust Center',
+            asOf: '2026-07-02',
+          },
         ],
       },
       modelAndToolGovernance: {
diff --git a/apps/sim/lib/compare/data/competitors/crewai.ts b/apps/sim/lib/compare/data/competitors/crewai.ts
index 811898524c2..f0e189cf73c 100644
--- a/apps/sim/lib/compare/data/competitors/crewai.ts
+++ b/apps/sim/lib/compare/data/competitors/crewai.ts
@@ -786,21 +786,6 @@ export const crewaiProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          'Yes: CrewAI AMP has a SOC 2 Type 1 audit report (dated November 2025), available via its Trust Center',
-        detail:
-          "CrewAI's Trust Center (trust.crewai.com, indexed by Vanta) lists a SOC 2 Type 1 Audit Report from November 2025. This applies to the Enterprise/AMP offering, not to a self-hosted deployment of the open-source framework, which has no compliance certification of its own since it isn't a hosted service.",
-        shortValue: 'SOC 2 Type 1 report (Nov 2025) for the AMP platform',
-        confidence: 'estimated',
-        sources: [
-          {
-            url: 'https://trust.crewai.com/',
-            label: 'CrewAI Trust Center',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Yes: achievable via self-hosting the OSS framework or AMP Factory (on-prem/private VPC)',
@@ -846,12 +831,12 @@ export const crewaiProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'HIPAA (Enterprise edition, audit report dated February 2026); no ISO 27001, PCI, or FedRAMP certification confirmed',
+          'SOC 2 Type 1 for CrewAI AMP (audit report dated November 2025) and HIPAA for the Enterprise edition (audit report dated February 2026); no ISO 27001, PCI, or FedRAMP certification confirmed',
         detail:
-          "CrewAI's Trust Center lists a HIPAA Audit Report dated February 2026 for the Enterprise edition, alongside the SOC 2 Type 1 report. CrewAI's pricing page separately references 'FedRamp High compliance' language for its Enterprise tier, but no independent FedRAMP authorization listing corroborates that claim, so it is not treated as confirmed here.",
-        shortValue: 'HIPAA audit (Feb 2026); FedRAMP claim unconfirmed',
+          "CrewAI's Vanta-indexed Trust Center lists a HIPAA Audit Report dated February 2026 for the Enterprise edition, alongside the SOC 2 Type 1 report. The certifications apply to the Enterprise/AMP offering, not to self-hosted deployments of the open-source framework, which have no compliance certification of their own because they are not a hosted service. CrewAI's pricing page separately references 'FedRamp High compliance' language for its Enterprise tier, but no independent FedRAMP authorization listing corroborates that claim, so it is not treated as confirmed here.",
+        shortValue: 'SOC 2 Type 1 (AMP), HIPAA audit (Feb 2026); FedRAMP claim unconfirmed',
         confidence: 'estimated',
         sources: [
           {
diff --git a/apps/sim/lib/compare/data/competitors/dust.ts b/apps/sim/lib/compare/data/competitors/dust.ts
index 5ebf1328fe4..08fd10efee9 100644
--- a/apps/sim/lib/compare/data/competitors/dust.ts
+++ b/apps/sim/lib/compare/data/competitors/dust.ts
@@ -781,25 +781,6 @@ export const dustProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC 2 Type II certified, achieved audit readiness with Vanta in three weeks',
-        detail:
-          "Dust's own security page states SOC 2 Type II certification; a Vanta customer case study describes Dust achieving SOC 2 Type II audit readiness in three weeks using Vanta's automation, reducing compliance workload by roughly 50%. The report is downloadable via Dust's Trust Center.",
-        shortValue: 'SOC 2 Type II certified, report via Trust Center',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://www.vanta.com/customers/dust',
-            label: 'With Vanta, Dust achieved SOC 2 Type II audit readiness in three weeks',
-            asOf: '2026-07-02',
-          },
-          {
-            url: 'https://trust.dust.com/',
-            label: 'Dust Trust Center',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value: 'Yes: selectable US or EU data-hosting region',
         detail:
@@ -844,10 +825,10 @@ export const dustProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value: 'GDPR compliant, HIPAA-capable, SOC 2 Type II; no ISO 27001, PCI, or FedRAMP',
         detail:
-          "Dust's security page and enterprise materials state GDPR compliance and HIPAA-compliance capability alongside SOC 2 Type II. No source confirms ISO 27001, PCI-DSS, or FedRAMP.",
+          "Dust's security page and enterprise materials state GDPR compliance and HIPAA-compliance capability alongside SOC 2 Type II. A Vanta case study says Dust achieved SOC 2 Type II audit readiness in three weeks using Vanta's automation, reducing its compliance workload by roughly 50%; the report is downloadable through Dust's Trust Center. No source confirms ISO 27001, PCI-DSS, or FedRAMP.",
         shortValue: 'GDPR, HIPAA-capable, SOC 2 Type II',
         confidence: 'estimated',
         sources: [
@@ -856,6 +837,16 @@ export const dustProfile: CompetitorProfile = {
             label: 'Dust Security',
             asOf: '2026-07-02',
           },
+          {
+            url: 'https://www.vanta.com/customers/dust',
+            label: 'With Vanta, Dust achieved SOC 2 Type II audit readiness in three weeks',
+            asOf: '2026-07-02',
+          },
+          {
+            url: 'https://trust.dust.com/',
+            label: 'Dust Trust Center',
+            asOf: '2026-07-02',
+          },
         ],
       },
       modelAndToolGovernance: {
diff --git a/apps/sim/lib/compare/data/competitors/flowise.ts b/apps/sim/lib/compare/data/competitors/flowise.ts
index eda221873d5..1f844ef51b8 100644
--- a/apps/sim/lib/compare/data/competitors/flowise.ts
+++ b/apps/sim/lib/compare/data/competitors/flowise.ts
@@ -671,15 +671,6 @@ export const flowiseProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          'Unknown: a third-party security-scan aggregator (Nudge Security) lists Flowise as SOC 2 compliant among several other certifications, but Flowise has published no SOC 2 report, badge, or trust page of its own.',
-        detail:
-          'The same third-party source also claims FedRAMP and PCI compliance for a small startup, an atypical combination not corroborated on flowiseai.com.',
-        shortValue: 'No official confirmation found',
-        confidence: 'unknown',
-        sources: [],
-      },
       dataResidency: {
         value:
           'Yes, indirectly: self-hosting (including on-prem/air-gapped Enterprise deployment) lets an organization fully control data location. There is no dedicated regional-cloud-hosting option for the managed Cloud product.',
@@ -719,10 +710,12 @@ export const flowiseProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'Unknown: beyond the unconfirmed third-party SOC 2 claim, Flowise has published no HIPAA, ISO 27001, PCI, or FedRAMP certification.',
-        shortValue: 'Unknown, no official certifications published',
+        detail:
+          "The SOC 2 claim comes from third-party security-scan aggregator Nudge Security; Flowise has published no SOC 2 report, badge, or trust page of its own. The same source also claims FedRAMP and PCI compliance, an atypical combination for a small startup that is not corroborated on Flowise's own website.",
+        shortValue: 'SOC 2 claim unconfirmed; no official certifications published',
         confidence: 'unknown',
         sources: [],
       },
diff --git a/apps/sim/lib/compare/data/competitors/gumloop.ts b/apps/sim/lib/compare/data/competitors/gumloop.ts
index 936f979c68f..cac77f6f7fe 100644
--- a/apps/sim/lib/compare/data/competitors/gumloop.ts
+++ b/apps/sim/lib/compare/data/competitors/gumloop.ts
@@ -792,20 +792,6 @@ export const gumloopProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          'SOC 2 Type II attested; also HIPAA-compliant with BAAs available on eligible plans, and GDPR-aligned with EU-U.S. Data Privacy Framework (incl. UK Extension) certification',
-        shortValue: 'SOC 2 Type II, HIPAA, GDPR-aligned',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://www.gumloop.com/solutions/security',
-            label: 'Gumloop Security & Trust',
-            asOf: '2026-07-02',
-          },
-          { url: 'https://trust.gumloop.com/', label: 'Gumloop Trust Center', asOf: '2026-07-02' },
-        ],
-      },
       dataResidency: {
         value:
           'Enterprise VPC deployment into a customer-controlled cloud region provides data residency/control; zero data retention (ZDR) agreements are in place with major LLM providers',
@@ -854,7 +840,7 @@ export const gumloopProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'SOC 2 Type II, HIPAA (with BAAs), GDPR-aligned program plus EU-U.S. Data Privacy Framework (incl. UK Extension); no ISO 27001, PCI, or FedRAMP',
         detail:
@@ -867,6 +853,7 @@ export const gumloopProfile: CompetitorProfile = {
             label: 'Gumloop: Security and trust',
             asOf: '2026-07-02',
           },
+          { url: 'https://trust.gumloop.com/', label: 'Gumloop Trust Center', asOf: '2026-07-02' },
         ],
       },
       modelAndToolGovernance: {
diff --git a/apps/sim/lib/compare/data/competitors/langchain.ts b/apps/sim/lib/compare/data/competitors/langchain.ts
index 7c5b3e90b19..537b0135f67 100644
--- a/apps/sim/lib/compare/data/competitors/langchain.ts
+++ b/apps/sim/lib/compare/data/competitors/langchain.ts
@@ -781,21 +781,6 @@ export const langchainProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          "Yes: LangSmith is SOC 2 Type II certified. LangGraph Platform (now branded LangSmith Deployment) is publicly announced as carrying the same attestation, sharing LangSmith's infrastructure and compliance posture.",
-        detail:
-          "LangChain's Trust Center (trust.langchain.com) is the canonical source but renders via client-side JavaScript, so it could not be directly verified by an automated fetch; the LangSmith-side certification is independently confirmed on a static docs page.",
-        shortValue: 'Yes, SOC 2 Type II for LangSmith; LangGraph Platform shares it',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://docs.langchain.com/langsmith/regions-faq',
-            label: 'Regions FAQ - Docs by LangChain (confirms SOC 2 Type 2)',
-            asOf: '2026-07-08',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Yes: LangSmith offers selectable regions at no extra cost — US (GCP US), EU (GCP EU), APAC (GCP APAC), and a separate AWS US region',
@@ -835,11 +820,12 @@ export const langchainProfile: CompetitorProfile = {
         confidence: 'unknown',
         sources: [],
       },
-      additionalCompliance: {
-        value: 'HIPAA and GDPR, in addition to SOC 2 Type II',
+      compliance: {
+        value:
+          "LangSmith is SOC 2 Type II, HIPAA, and GDPR compliant; LangGraph Platform (now LangSmith Deployment) shares LangSmith's SOC 2 attestation and compliance posture",
         detail:
-          "LangChain's own docs and Trust Center state LangSmith is SOC 2 Type II, HIPAA compliant, and GDPR compliant; no ISO 27001, PCI-DSS, or FedRAMP attestation was found on LangChain's own compliance materials.",
-        shortValue: 'HIPAA and GDPR compliant, alongside SOC 2 Type II',
+          "LangChain's own docs and Trust Center state LangSmith is SOC 2 Type II, HIPAA compliant, and GDPR compliant; no ISO 27001, PCI-DSS, or FedRAMP attestation was found on LangChain's own compliance materials. The Trust Center is the canonical source but renders via client-side JavaScript, so it could not be directly verified by an automated fetch; the LangSmith certification is independently confirmed on the static Regions FAQ page.",
+        shortValue: 'LangSmith/LangGraph SOC 2 Type II; HIPAA and GDPR compliant',
         confidence: 'verified',
         sources: [
           {
diff --git a/apps/sim/lib/compare/data/competitors/langflow.ts b/apps/sim/lib/compare/data/competitors/langflow.ts
index c481c2f9548..ec27d0db6f4 100644
--- a/apps/sim/lib/compare/data/competitors/langflow.ts
+++ b/apps/sim/lib/compare/data/competitors/langflow.ts
@@ -689,15 +689,6 @@ export const langflowProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          "Unknown: no public documentation or official page states a SOC 2 certification for Langflow. The docs' Security page discusses infrastructure-level responsibility for operators, not a compliance certification.",
-        detail:
-          'Security docs place isolation and compliance burden on the deploying organization.',
-        shortValue: 'Unknown, no SOC2 certification documented',
-        confidence: 'unknown',
-        sources: [],
-      },
       dataResidency: {
         value:
           'Yes via self-hosting: Langflow can be fully self-hosted on Docker, Kubernetes, on-prem, or any cloud region, giving organizations full control over data residency. No dedicated managed regional-hosting product is documented for Langflow Cloud.',
@@ -737,10 +728,12 @@ export const langflowProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'Unknown: no public documentation or official page confirms HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP certification for Langflow.',
-        shortValue: 'Unknown, no compliance certifications documented',
+          'Unknown: no public documentation or official page confirms SOC 2, HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP certification for Langflow.',
+        detail:
+          "Langflow's security documentation treats infrastructure isolation and compliance as the deploying organization's responsibility rather than a certification held by Langflow.",
+        shortValue: 'Unknown, no SOC 2 or other compliance certifications documented',
         confidence: 'unknown',
         sources: [],
       },
diff --git a/apps/sim/lib/compare/data/competitors/make.ts b/apps/sim/lib/compare/data/competitors/make.ts
index d85f6158560..88ecc07e8ad 100644
--- a/apps/sim/lib/compare/data/competitors/make.ts
+++ b/apps/sim/lib/compare/data/competitors/make.ts
@@ -849,20 +849,6 @@ export const makeProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC 2 Type II and SOC 3 completed; ISO 27001 certified; GDPR compliant',
-        detail:
-          "Make's Security page lists completed SOC 2 Type II audit, a publicly available SOC 3 report, ISO 27001 certification for the platform, and GDPR compliance. HIPAA is not mentioned on this page.",
-        shortValue: 'SOC 2 Type II, SOC 3, ISO 27001, GDPR',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://www.make.com/en/security',
-            label: 'Make Security page',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Yes: choice of US or EU data center at organization creation; Enterprise gets an isolated AWS environment',
@@ -918,12 +904,12 @@ export const makeProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'SOC 2 Type II, SOC 3, and ISO 27001 certified, plus GDPR adherence; no HIPAA, PCI, or FedRAMP mentioned',
         detail:
           "Make's Security page states the company operates an ISO 27001-certified information security program and runs infrastructure compliant with SOC 3 and SOC 2 Type II audits, alongside GDPR adherence (Make also has a dedicated GDPR page). HIPAA compliance is not mentioned or offered.",
-        shortValue: 'No HIPAA, PCI, or FedRAMP',
+        shortValue: 'SOC 2 Type II, SOC 3, ISO 27001, GDPR; no HIPAA, PCI, or FedRAMP',
         confidence: 'verified',
         sources: [
           {
diff --git a/apps/sim/lib/compare/data/competitors/microsoft-copilot.ts b/apps/sim/lib/compare/data/competitors/microsoft-copilot.ts
index 716d2fe8b9e..41244b0d34a 100644
--- a/apps/sim/lib/compare/data/competitors/microsoft-copilot.ts
+++ b/apps/sim/lib/compare/data/competitors/microsoft-copilot.ts
@@ -904,27 +904,6 @@ export const microsoftCopilotProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          'Yes: Copilot Studio (listed by its former name, "Copilot Studios") is one of the Microsoft online services explicitly in scope of the Office 365 SOC 2 Type 2 attestation report, with audit reports available from the Microsoft Service Trust Portal',
-        detail:
-          'Copilot Studio\'s own admin-certification page confirms SOC compliance without naming the specific report type, but Microsoft\'s dedicated SOC 2 Type 2 compliance offering page lists "Copilot Studios" by name among the in-scope Office 365 services, resolving which SOC report type applies.',
-        shortValue: 'Yes, named in scope of the SOC 2 Type 2 attestation report',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-certification',
-            label:
-              'Review ISO, SOC, and HIPAA compliance - Microsoft Copilot Studio | Microsoft Learn',
-            asOf: '2026-07-04',
-          },
-          {
-            url: 'https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-2',
-            label: 'SOC 2 Type 2 - Microsoft Compliance | Microsoft Learn',
-            asOf: '2026-07-04',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Yes: organizations can create agents in a specific environment/region so agent data resides within that geography, with Microsoft replicating only within the same geographic area for durability',
@@ -974,12 +953,13 @@ export const microsoftCopilotProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'HIPAA (Business Associate Agreement), HITRUST CSF, FedRAMP, multiple ISO standards (9001, 20000-1, 22301, 27001, 27017, 27018, 27701), PCI DSS, CSA STAR, UK G-Cloud, Singapore MTCS Level 3, Korea K-ISMS, and Spain ENS, each with an audit report on the Microsoft Service Trust Portal',
+          'SOC 2 Type 2 (Copilot Studio is named in scope), HIPAA (Business Associate Agreement), HITRUST CSF, FedRAMP, multiple ISO standards (9001, 20000-1, 22301, 27001, 27017, 27018, 27701), PCI DSS, CSA STAR, UK G-Cloud, Singapore MTCS Level 3, Korea K-ISMS, and Spain ENS, each with an audit report on the Microsoft Service Trust Portal',
         detail:
-          "This is the full list from Copilot Studio's admin-certification documentation. Each certification links to a corresponding audit report or certificate.",
-        shortValue: 'HIPAA, HITRUST, FedRAMP, multiple ISO standards, PCI DSS, CSA STAR, and more',
+          'This is the full list from Copilot Studio\'s admin-certification documentation. Each certification links to a corresponding audit report or certificate. That page confirms SOC compliance without naming the report type; Microsoft\'s dedicated SOC 2 Type 2 offering page lists the product under its former name, "Copilot Studios," resolving the applicable report type and scope.',
+        shortValue:
+          'SOC 2 Type 2, HIPAA, HITRUST, FedRAMP, multiple ISO standards, PCI DSS, and more',
         confidence: 'verified',
         sources: [
           {
@@ -988,6 +968,11 @@ export const microsoftCopilotProfile: CompetitorProfile = {
               'Review ISO, SOC, and HIPAA compliance - Microsoft Copilot Studio | Microsoft Learn',
             asOf: '2026-07-02',
           },
+          {
+            url: 'https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-2',
+            label: 'SOC 2 Type 2 - Microsoft Compliance | Microsoft Learn',
+            asOf: '2026-07-04',
+          },
         ],
       },
       modelAndToolGovernance: {
diff --git a/apps/sim/lib/compare/data/competitors/n8n.ts b/apps/sim/lib/compare/data/competitors/n8n.ts
index 441e002b667..991ee9195ce 100644
--- a/apps/sim/lib/compare/data/competitors/n8n.ts
+++ b/apps/sim/lib/compare/data/competitors/n8n.ts
@@ -864,27 +864,6 @@ export const n8nProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          "SOC 2: program 'aligned to' SOC 2 with annual third-party audits; report available to enterprise customers via Trust Center",
-        detail:
-          'n8n operates a Trust Center (trust.n8n.io, powered by SafeBase) covering security, compliance, privacy, and reliability. Its security program is aligned to the SOC 2 framework, with continuous evaluation and annual independent audits, and the SOC 2 report is provided to enterprise customers on request rather than published openly.',
-        shortValue: 'Aligned to SOC 2, report on request',
-        confidence: 'verified',
-        sources: [
-          { url: 'https://trust.n8n.io/', label: 'n8n Trust Center', asOf: '2026-07-02' },
-          {
-            url: 'https://support.n8n.io/article/request-for-soc-2-report',
-            label: 'n8n Help Center: Request for SOC-2 report',
-            asOf: '2026-07-02',
-          },
-          {
-            url: 'https://n8n.io/legal/security/',
-            label: 'Security | n8n',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Yes: achievable via self-hosting; specific cloud data-residency regions not confirmed',
@@ -929,11 +908,11 @@ export const n8nProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'GDPR (as data processor), SOC 2 Type II certification, and a publicly downloadable SOC 3 report; no HIPAA, ISO 27001, PCI, or FedRAMP certification found',
         detail:
-          "n8n's Trust Center (SafeBase-hosted) and legal/security page list GDPR compliance (as a data processor with a standard DPA), CAIQ self-assessment questionnaires for both cloud and self-hosted deployments, and a SOC 3 report that is publicly downloadable from the Security page. n8n now holds SOC 2 Type II certification, viewable via the Trust Center, in addition to the public SOC 3 report. n8n holds no ISO 27001, HIPAA BAA, PCI-DSS, or FedRAMP certification. Third-party blog posts describe self-hosted n8n as helping organizations map to HIPAA/ISO 27001 requirements, but that is not the same as holding those certifications.",
+          "n8n's Trust Center (SafeBase-hosted) and legal/security page list GDPR compliance (as a data processor with a standard DPA), CAIQ self-assessment questionnaires for both cloud and self-hosted deployments, and a SOC 3 report that is publicly downloadable from the Security page. n8n now holds SOC 2 Type II certification, viewable via the Trust Center, in addition to the public SOC 3 report. Its security program is continuously evaluated and independently audited annually, with the SOC 2 report available to Enterprise customers on request rather than published openly. n8n holds no ISO 27001, HIPAA BAA, PCI-DSS, or FedRAMP certification. Third-party blog posts describe self-hosted n8n as helping organizations map to HIPAA/ISO 27001 requirements, but that is not the same as holding those certifications.",
         shortValue: 'GDPR, SOC 2 Type II certified, public SOC 3 report',
         confidence: 'verified',
         sources: [
diff --git a/apps/sim/lib/compare/data/competitors/openai-agentkit.ts b/apps/sim/lib/compare/data/competitors/openai-agentkit.ts
index d66a26c90de..054f93ed876 100644
--- a/apps/sim/lib/compare/data/competitors/openai-agentkit.ts
+++ b/apps/sim/lib/compare/data/competitors/openai-agentkit.ts
@@ -836,25 +836,6 @@ export const openaiAgentkitProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC 2 Type 2, plus ISO 27001, 27017, 27018, and 27701 certifications',
-        detail:
-          "OpenAI's most recent SOC 2 report covers January 1, 2025 through June 30, 2025 for Security, Availability, Confidentiality, and Privacy Trust Services Criteria across the API Platform, ChatGPT Enterprise, ChatGPT Edu, and ChatGPT Team.",
-        shortValue: 'SOC 2 Type 2 plus ISO 27001/27017/27018/27701',
-        confidence: 'estimated',
-        sources: [
-          {
-            url: 'https://trust.openai.com/',
-            label: 'OpenAI Trust Portal (SafeBase)',
-            asOf: '2026-07-02',
-          },
-          {
-            url: 'https://openai.com/security-and-privacy/',
-            label: 'Security and privacy at OpenAI',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Yes: data residency at rest available in US, Europe, UK, Japan, Canada, South Korea, Singapore, Australia, India, and UAE for eligible enterprise customers',
@@ -910,11 +891,11 @@ export const openaiAgentkitProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'FedRAMP Moderate Authorization (ChatGPT Enterprise and API Platform), PCI DSS v4.0.1, SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 27701:2019; supports customer HIPAA compliance via BAA and GDPR/CCPA via DPA; FERPA covered via a separate Student Data Privacy Agreement for ChatGPT Edu',
         detail:
-          "OpenAI's ChatGPT Enterprise and API Platform hold FedRAMP Moderate (Class C) authorization per the FedRAMP Marketplace listing. OpenAI's trust portal lists PCI DSS v4.0.1 for payment-processing components, a SOC 2 Type 2 examination (Security, Availability, Confidentiality, Privacy criteria) covering the API Platform, ChatGPT Enterprise, ChatGPT Edu, and ChatGPT Team, plus ISO/IEC 27001:2022, 27017:2015, 27018:2019, and 27701:2019 certifications, and lists GDPR and CCPA. OpenAI offers a Data Processing Addendum for GDPR/CCPA and a Business Associate Agreement for HIPAA-regulated customers on ChatGPT Enterprise/Edu and the API (not standard ChatGPT Business); this is enablement rather than OpenAI itself being HIPAA-certified, since HIPAA has no formal certification body. FERPA compliance for ChatGPT Edu/for Teachers runs through a separate Student Data Privacy Agreement rather than the general DPA.",
+          "OpenAI's ChatGPT Enterprise and API Platform hold FedRAMP Moderate (Class C) authorization per the FedRAMP Marketplace listing. OpenAI's most recent SOC 2 report covers January 1, 2025 through June 30, 2025 for the Security, Availability, Confidentiality, and Privacy Trust Services Criteria across the API Platform, ChatGPT Enterprise, ChatGPT Edu, and ChatGPT Team. OpenAI's trust portal also lists PCI DSS v4.0.1 for payment-processing components, plus ISO/IEC 27001:2022, 27017:2015, 27018:2019, and 27701:2019 certifications, and lists GDPR and CCPA. OpenAI offers a Data Processing Addendum for GDPR/CCPA and a Business Associate Agreement for HIPAA-regulated customers on ChatGPT Enterprise/Edu and the API (not standard ChatGPT Business); this is enablement rather than OpenAI itself being HIPAA-certified, since HIPAA has no formal certification body. FERPA compliance for ChatGPT Edu/for Teachers runs through a separate Student Data Privacy Agreement rather than the general DPA.",
         shortValue: 'FedRAMP Moderate, PCI DSS, SOC 2, ISO 27001/27701, HIPAA BAA',
         confidence: 'verified',
         sources: [
@@ -930,6 +911,11 @@ export const openaiAgentkitProfile: CompetitorProfile = {
               'How can I get a Business Associate Agreement (BAA) with OpenAI? | OpenAI Help Center',
             asOf: '2026-07-08',
           },
+          {
+            url: 'https://openai.com/security-and-privacy/',
+            label: 'Security and privacy at OpenAI',
+            asOf: '2026-07-02',
+          },
         ],
       },
       modelAndToolGovernance: {
diff --git a/apps/sim/lib/compare/data/competitors/openclaw.ts b/apps/sim/lib/compare/data/competitors/openclaw.ts
index ad3b531b36b..92f6a69daad 100644
--- a/apps/sim/lib/compare/data/competitors/openclaw.ts
+++ b/apps/sim/lib/compare/data/competitors/openclaw.ts
@@ -130,7 +130,7 @@ export const openClawProfile: CompetitorProfile = {
     {
       title: 'No SOC 2 report or other compliance attestation',
       description:
-        "OpenClaw has no OpenClaw-operated hosted service, only self-hosted software, and no SOC 2 report, trust center, or other compliance attestation is published anywhere on its official sites. Sim is SOC 2 compliant; like OpenClaw, Sim does not currently hold ISO 27001 or HIPAA certification. OpenClaw's own security documentation places responsibility for data-at-rest and processing security squarely on the operator running their own instance.",
+        'OpenClaw has no OpenClaw-operated hosted service, only self-hosted software, and no SOC 2 report, trust center, or other compliance attestation is published anywhere on its official sites. Unlike Sim, which documents SOC 2 Type II, ISO 27001:2022, and GDPR compliance, OpenClaw places responsibility for data-at-rest, processing security, and compliance on the operator running their own instance.',
       shortDescription: 'No SOC 2 report; the self-hosting operator owns all compliance risk.',
       source: {
         url: 'https://docs.openclaw.ai/gateway/security',
@@ -814,21 +814,6 @@ export const openClawProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          'No: OpenClaw is a self-hosted open-source project run by a non-profit Foundation, not a vendor selling a hosted service, and publishes no SOC 2 report.',
-        detail:
-          'No SOC 2 attestation, trust center, or audit report exists for OpenClaw. Responsibility for infrastructure security rests entirely with whoever self-hosts the Gateway.',
-        shortValue: 'No SOC 2 report published',
-        confidence: 'estimated',
-        sources: [
-          {
-            url: 'https://docs.openclaw.ai/gateway/security',
-            label: 'OpenClaw Docs: Security',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           "Yes, by construction: because OpenClaw runs only as a self-hosted Gateway process, with no OpenClaw-operated hosted/SaaS version, all agent data (sessions, memory files, credentials) resides wherever the operator chooses to run it, e.g. a personal laptop or a self-hosted VPS/homelab using the project's own Ansible/NixOS deployment tooling, giving the operator full control over data location with no vendor-side residency question.",
@@ -879,14 +864,19 @@ export const openClawProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'No compliance certifications (no HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP). As open-source, self-hosted software from a non-profit Foundation, OpenClaw is not the kind of vendor entity that typically pursues these certifications; compliance posture depends entirely on how and where the operator self-hosts it.',
+          'No compliance certifications (no SOC 2, HIPAA, ISO 27001, GDPR-specific attestation, PCI, or FedRAMP). As open-source, self-hosted software from a non-profit Foundation, OpenClaw is not the kind of vendor entity that typically pursues these certifications; compliance posture depends entirely on how and where the operator self-hosts it.',
         detail:
-          "China restricted state enterprises and government agencies from deploying OpenClaw in March 2026 over security concerns, per Wikipedia's history summary, a data point on the compliance/trust landscape rather than a certification.",
-        shortValue: 'None documented; compliance posture depends on self-hosting operator',
+          "OpenClaw publishes no SOC 2 attestation, trust center, or audit report; responsibility for infrastructure security and compliance rests entirely with the self-hosting operator. China restricted state enterprises and government agencies from deploying OpenClaw in March 2026 over security concerns, per Wikipedia's history summary, a data point on the compliance/trust landscape rather than a certification.",
+        shortValue: 'No SOC 2 or other certifications; compliance depends on self-hosting operator',
         confidence: 'estimated',
         sources: [
+          {
+            url: 'https://docs.openclaw.ai/gateway/security',
+            label: 'OpenClaw Docs: Security',
+            asOf: '2026-07-02',
+          },
           {
             url: 'https://en.wikipedia.org/wiki/OpenClaw',
             label: 'Wikipedia: OpenClaw',
diff --git a/apps/sim/lib/compare/data/competitors/pipedream.ts b/apps/sim/lib/compare/data/competitors/pipedream.ts
index ebfce7c7a49..30c15331304 100644
--- a/apps/sim/lib/compare/data/competitors/pipedream.ts
+++ b/apps/sim/lib/compare/data/competitors/pipedream.ts
@@ -739,25 +739,6 @@ export const pipedreamProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC 2 Type II',
-        detail:
-          'Pipedream provides a SOC 2 Type 2 report on request, undergoes annual third-party audits, and uses continuous-compliance monitoring tooling. It also supports HIPAA, acting as a Business Associate and offering BAAs.',
-        shortValue: 'SOC 2 Type II, HIPAA BAA available',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://pipedream.com/docs/privacy-and-security',
-            label: 'Pipedream Docs: Privacy and Security',
-            asOf: '2026-07-02',
-          },
-          {
-            url: 'https://pipedream.com/docs/privacy-and-security/hipaa',
-            label: 'Pipedream Docs: HIPAA Compliance',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value: 'Single-region (AWS us-east-1); no customer-selectable data residency documented',
         detail:
@@ -801,11 +782,11 @@ export const pipedreamProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'SOC 2 Type 2, HIPAA (via BAA, Enterprise), GDPR (SCCs), and AWS KMS infra with ISO 27001/27017/27018. No independent Pipedream-held ISO 27001/PCI/FedRAMP certification on the trust page',
         detail:
-          "Pipedream's Privacy and Security page states it provides a SOC 2 Type 2 report on request, signs Business Associate Addendums (BAAs) for HIPAA/PHI use cases (Enterprise), and uses Standard Contractual Clauses (SCCs) for GDPR-related data transfers. Sensitive data (OAuth grants, key-based credentials, env vars) is encrypted at rest with AES-256-GCM via AWS KMS, which itself holds SOC 1/2/3 and ISO 27001/27017/27018 certifications. That ISO/PCI/FedRAMP coverage is inherited from the AWS infrastructure layer, not a certification Pipedream independently holds on its own trust page. Some third-party review sites describe Pipedream itself as directly PCI, FedRAMP, and CSA STAR compliant, but Pipedream's own security documentation does not corroborate this.",
+          "Pipedream's Privacy and Security page states it provides a SOC 2 Type 2 report on request, undergoes annual third-party audits, and uses continuous-compliance monitoring tooling. It signs Business Associate Addendums (BAAs) for HIPAA/PHI use cases (Enterprise) and uses Standard Contractual Clauses (SCCs) for GDPR-related data transfers. Sensitive data (OAuth grants, key-based credentials, env vars) is encrypted at rest with AES-256-GCM via AWS KMS, which itself holds SOC 1/2/3 and ISO 27001/27017/27018 certifications. That ISO/PCI/FedRAMP coverage is inherited from the AWS infrastructure layer, not a certification Pipedream independently holds on its own trust page. Some third-party review sites describe Pipedream itself as directly PCI, FedRAMP, and CSA STAR compliant, but Pipedream's own security documentation does not corroborate this.",
         shortValue: 'SOC 2, HIPAA BAA, GDPR SCCs; ISO via AWS only',
         confidence: 'estimated',
         sources: [
@@ -819,6 +800,11 @@ export const pipedreamProfile: CompetitorProfile = {
             label: 'Pipedream Blog – Pipedream supports HIPAA compliance',
             asOf: '2026-07-02',
           },
+          {
+            url: 'https://pipedream.com/docs/privacy-and-security/hipaa',
+            label: 'Pipedream Docs: HIPAA Compliance',
+            asOf: '2026-07-02',
+          },
         ],
       },
       modelAndToolGovernance: {
diff --git a/apps/sim/lib/compare/data/competitors/power-automate.ts b/apps/sim/lib/compare/data/competitors/power-automate.ts
index dc080a88d1d..047039cb029 100644
--- a/apps/sim/lib/compare/data/competitors/power-automate.ts
+++ b/apps/sim/lib/compare/data/competitors/power-automate.ts
@@ -904,22 +904,6 @@ export const powerAutomateProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          "Power Automate is SOC 2 Type 2 in-scope for Commercial and GCC environments only. It is not in-scope for GCC High or DoD in that attestation, separate from the product's general availability in those government clouds.",
-        detail:
-          "Microsoft's compliance documentation lists Power Automate among in-scope Commercial/GCC services.",
-        shortValue: 'SOC 2 Type 2 in-scope for Commercial and GCC only',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-2',
-            label:
-              'System and Organization Controls (SOC) 2 Type 2 - Microsoft Compliance | Microsoft Learn',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Yes: environments/regions can be selected at creation to control where Dataverse and related customer data resides, with data kept within the chosen geography (Microsoft may replicate only within the same geographic area for resiliency)',
@@ -964,12 +948,13 @@ export const powerAutomateProfile: CompetitorProfile = {
         confidence: 'unknown',
         sources: [],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'HIPAA/HITECH (Microsoft will sign a BAA as a business associate) and inclusion in the broader Office 365/Azure compliance program, which separately covers ISO 27001, FedRAMP, and other certifications at the Azure/Office 365 platform level. The SOC 2 Type 2 report also incorporates the Cloud Security Alliance CCM and German BSI C5:2020 criteria.',
+          'SOC 2 Type 2 in-scope for Commercial and GCC environments only; HIPAA/HITECH (Microsoft will sign a BAA as a business associate); and inclusion in the broader Office 365/Azure compliance program, which separately covers ISO 27001, FedRAMP, and other certifications at the Azure/Office 365 platform level. The SOC 2 Type 2 report also incorporates the Cloud Security Alliance CCM and German BSI C5:2020 criteria.',
         detail:
-          "HIPAA/BAA support and CSA CCM/BSI C5:2020 coverage are documented directly in Microsoft's SOC 2 documentation. No Power Automate-specific ISO 27001/FedRAMP attestation page exists, so treat those two as platform-level coverage rather than product-specific certification.",
-        shortValue: 'HIPAA/BAA, CSA CCM, BSI C5:2020; ISO/FedRAMP at platform level',
+          "Microsoft's compliance documentation lists Power Automate among the Commercial and GCC services covered by its SOC 2 Type 2 attestation. The attestation excludes GCC High and DoD even though Power Automate is generally available in those government clouds. HIPAA/BAA support and CSA CCM/BSI C5:2020 coverage are documented directly in Microsoft's SOC 2 documentation. No Power Automate-specific ISO 27001/FedRAMP attestation page exists, so treat those two as platform-level coverage rather than product-specific certification.",
+        shortValue:
+          'SOC 2 Type 2 (Commercial/GCC), HIPAA/BAA, CSA CCM, BSI C5; ISO/FedRAMP platform-level',
         confidence: 'estimated',
         sources: [
           {
diff --git a/apps/sim/lib/compare/data/competitors/retool.ts b/apps/sim/lib/compare/data/competitors/retool.ts
index 5f4fb90bfb3..bd4c456618d 100644
--- a/apps/sim/lib/compare/data/competitors/retool.ts
+++ b/apps/sim/lib/compare/data/competitors/retool.ts
@@ -787,21 +787,6 @@ export const retoolProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC 2 Type 2, plus ISO/IEC 27001:2022, GDPR, and CCPA.',
-        detail:
-          'Reports/certificates are downloadable via the self-serve Trust Center (SafeBase-powered).',
-        shortValue: 'SOC 2 Type 2, ISO 27001, GDPR, CCPA',
-        confidence: 'verified',
-        sources: [
-          { url: 'https://trust.retool.com/', label: 'Retool Trust Center', asOf: '2026-07-02' },
-          {
-            url: 'https://docs.retool.com/legal/security',
-            label: 'Security Practices | Retool Docs',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Cloud: customer data stored redundantly across multiple AWS data center locations (no customer-selectable region specified). Self-hosted: no Retool systems store customer data and no Retool personnel have technical/logical access to it.',
@@ -845,11 +830,11 @@ export const retoolProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'SOC 2 Type II, ISO/IEC 27001:2022, GDPR, and CCPA certifications, plus HIPAA via BAA on Enterprise.',
         detail:
-          'The Trust Center (SafeBase-powered) lists SOC 2 Type 2, ISO/IEC 27001:2022, GDPR, and CCPA certifications. HIPAA compliance is available with a signed BAA on Enterprise (self-hosted) plans. PCI and FedRAMP are not confirmed.',
+          'The Trust Center (SafeBase-powered) lists SOC 2 Type 2, ISO/IEC 27001:2022, GDPR, and CCPA certifications, with reports and certificates downloadable through the self-serve portal. HIPAA compliance is available with a signed BAA on Enterprise (self-hosted) plans. PCI and FedRAMP are not confirmed.',
         shortValue: 'SOC 2, ISO 27001, GDPR, CCPA; HIPAA via BAA',
         confidence: 'estimated',
         sources: [
diff --git a/apps/sim/lib/compare/data/competitors/stackai.ts b/apps/sim/lib/compare/data/competitors/stackai.ts
index 31f4adff439..9380135b422 100644
--- a/apps/sim/lib/compare/data/competitors/stackai.ts
+++ b/apps/sim/lib/compare/data/competitors/stackai.ts
@@ -17,10 +17,10 @@ export const stackaiProfile: CompetitorProfile = {
     'StackAI is a proprietary, enterprise-focused visual platform for building, deploying, and governing AI agents, connecting LLMs and business systems through a drag-and-drop, low-code node builder.',
   standoutFeatures: [
     {
-      title: 'ISO 27001 certified, with a public Trust Center detailing pen tests and DPAs',
+      title: 'Public Trust Center detailing pen tests and vendor DPAs',
       description:
-        'StackAI publishes a Trust Center (trust.stackai.com) documenting ISO 27001 certification, third-party penetration test results, and DPAs with OpenAI and Anthropic. StackAI also holds a SOC 2 Type II audit, but so does Sim, so ISO 27001 is the actual point of difference here.',
-      shortDescription: 'Public Trust Center with ISO 27001, pen test results, and DPAs.',
+        "StackAI publishes a Trust Center (trust.stackai.com) documenting ISO 27001 certification, third-party penetration test results, and DPAs with OpenAI and Anthropic. StackAI's SOC 2 Type II and ISO 27001 certifications overlap with Sim's documented compliance posture, so the public penetration-test results and vendor DPAs are the distinguishing evidence here.",
+      shortDescription: 'Public Trust Center with pen test results and vendor DPAs.',
       source: {
         url: 'https://trust.stackai.com/',
         label: 'StackAI Trust Center',
@@ -695,19 +695,6 @@ export const stackaiProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC 2 Type II, audited by Modern Assurance',
-        shortValue: 'SOC 2 Type II certified',
-        confidence: 'verified',
-        sources: [
-          { url: 'https://trust.stackai.com/', label: 'StackAI Trust Center', asOf: '2026-07-02' },
-          {
-            url: 'https://www.stackai.com/blog/soc2-type2-hipaa',
-            label: 'StackAI SOC 2 Type II & HIPAA blog',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value: 'Unknown',
         shortValue: 'Not documented',
@@ -746,12 +733,12 @@ export const stackaiProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'ISO 27001 certified, and audited against HIPAA in the same review cycle as its SOC 2 Type II audit, though the public Trust Center page itself lists only SOC 2 and ISO 27001, not HIPAA',
+          'SOC 2 Type II and ISO 27001 certified, and audited against HIPAA in the same review cycle, though the public Trust Center page itself lists only SOC 2 and ISO 27001, not HIPAA',
         detail:
-          'The Trust Center confirms SOC 2 Type II and ISO 27001, DPAs with OpenAI and Anthropic, and a May 2025 penetration test with a Low risk rating. A separate StackAI blog post states the company "was also audited against HIPAA standards during the same period as the SOC 2 Type II audit." GDPR compliance is referenced on the Enterprise pricing page but has no dedicated audit source.',
-        shortValue: 'ISO 27001 certified; HIPAA audited, GDPR marketing-only',
+          'The Trust Center confirms SOC 2 Type II, audited by Modern Assurance, and ISO 27001, DPAs with OpenAI and Anthropic, and a May 2025 penetration test with a Low risk rating. A separate StackAI blog post states the company "was also audited against HIPAA standards during the same period as the SOC 2 Type II audit." GDPR compliance is referenced on the Enterprise pricing page but has no dedicated audit source.',
+        shortValue: 'SOC 2 Type II and ISO 27001 certified; HIPAA audited, GDPR marketing-only',
         confidence: 'estimated',
         sources: [
           { url: 'https://trust.stackai.com/', label: 'StackAI Trust Center', asOf: '2026-07-02' },
diff --git a/apps/sim/lib/compare/data/competitors/tines.ts b/apps/sim/lib/compare/data/competitors/tines.ts
index 1440063c07c..bab4e5df30e 100644
--- a/apps/sim/lib/compare/data/competitors/tines.ts
+++ b/apps/sim/lib/compare/data/competitors/tines.ts
@@ -784,18 +784,6 @@ export const tinesProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC 2 Type II, audited annually',
-        shortValue: 'SOC 2 Type II, audited annually',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://www.tines.com/security/',
-            label: 'Security at Tines',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           "Cloud-hosted (Tines-managed, AWS-based) or self-hosted in the customer's own data center/region for data-residency requirements; granular data retention controls provided",
@@ -840,20 +828,20 @@ export const tinesProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'ISO 27001, ISO 27701, and ISO 42001 (AI management systems), announced April 14, 2026 as the "ISO trifecta." No HIPAA, PCI, or FedRAMP certification; Tines says self-hosting can help meet regimes like FedRAMP, not that it holds FedRAMP certification',
-        shortValue: 'ISO 27001, 27701, and 42001 certified',
+          'SOC 2 Type II, audited annually, plus ISO 27001, ISO 27701, and ISO 42001 (AI management systems), announced April 14, 2026 as the "ISO trifecta." No HIPAA, PCI, or FedRAMP certification; Tines says self-hosting can help meet regimes like FedRAMP, not that it holds FedRAMP certification',
+        shortValue: 'SOC 2 Type II; ISO 27001, 27701, and 42001 certified',
         confidence: 'verified',
         sources: [
           {
-            url: 'https://www.tines.com/blog/tines-achieves-the-iso-trifecta-iso-27001-iso-27701-and-iso-42001-certification/',
-            label: 'Tines achieves the ISO trifecta (27001, 27701, 42001)',
+            url: 'https://www.tines.com/security/',
+            label: 'Security at Tines',
             asOf: '2026-07-02',
           },
           {
-            url: 'https://www.tines.com/security/',
-            label: 'Security at Tines',
+            url: 'https://www.tines.com/blog/tines-achieves-the-iso-trifecta-iso-27001-iso-27701-and-iso-42001-certification/',
+            label: 'Tines achieves the ISO trifecta (27001, 27701, 42001)',
             asOf: '2026-07-02',
           },
         ],
diff --git a/apps/sim/lib/compare/data/competitors/vellum.ts b/apps/sim/lib/compare/data/competitors/vellum.ts
index 1b9046b0dfc..fa993b86c39 100644
--- a/apps/sim/lib/compare/data/competitors/vellum.ts
+++ b/apps/sim/lib/compare/data/competitors/vellum.ts
@@ -760,25 +760,6 @@ export const vellumProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC 2 Type 2',
-        detail:
-          'Documented at docs.vellum.ai and corroborated by a third-party Drata customer case study noting Vellum achieved SOC 2 Type 1 and Type 2 attestations.',
-        shortValue: 'SOC 2 Type 2 attested',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://docs.vellum.ai/product/security/data-privacy-and-storage',
-            label: 'Vellum Docs: Data Privacy and Storage',
-            asOf: '2026-07-02',
-          },
-          {
-            url: 'https://drata.com/customers/vellum',
-            label: 'Vellum Case Study: Drata',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value: 'Unknown: no specific region/residency options documented',
         detail:
@@ -821,12 +802,12 @@ export const vellumProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
-          'HIPAA compliant, with a BAA available for enterprise customers; no other certifications (ISO 27001, GDPR-specific attestation, PCI, FedRAMP) confirmed',
+          'SOC 2 Type 2 and HIPAA compliant, with a BAA available for enterprise customers; no other certifications (ISO 27001, GDPR-specific attestation, PCI, FedRAMP) confirmed',
         detail:
-          "Vellum's docs and a third-party Drata case study state it is HIPAA compliant and that enterprise customers can sign a Business Associate Agreement (BAA). No mention of ISO 27001, PCI, or FedRAMP certification was found.",
-        shortValue: 'HIPAA + BAA; no other certs confirmed',
+          "Vellum's docs state it is HIPAA compliant and that enterprise customers can sign a Business Associate Agreement (BAA). A third-party Drata case study also notes its SOC 2 Type 1 and Type 2 attestations. No mention of ISO 27001, PCI, or FedRAMP certification was found.",
+        shortValue: 'SOC 2 Type 2, HIPAA + BAA; no other certs confirmed',
         confidence: 'verified',
         sources: [
           {
diff --git a/apps/sim/lib/compare/data/competitors/workato.ts b/apps/sim/lib/compare/data/competitors/workato.ts
index 78bb10089cd..c105d38e193 100644
--- a/apps/sim/lib/compare/data/competitors/workato.ts
+++ b/apps/sim/lib/compare/data/competitors/workato.ts
@@ -899,24 +899,6 @@ export const workatoProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value:
-          'Workato maintains SOC 1 Type II, SOC 2 Type II, and SOC 3 reports (SOC 2 aligned to AICPA Trust Services Criteria, reports available to customers under NDA), plus PCI-DSS v4.0.1 Level 1, ISO 27001/27701/42001, HIPAA (with BAAs), IRAP, and NIST 800-171A r2 certifications',
-        shortValue: 'SOC 1/2/3, PCI-DSS, ISO, HIPAA, IRAP, NIST',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://docs.workato.com/security/security-compliance.html',
-            label: 'Security compliance | Workato docs',
-            asOf: '2026-07-02',
-          },
-          {
-            url: 'https://www.workato.com/legal/security',
-            label: 'Workato Security Overview',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           "Yes, for enterprise customers: Workato enterprise customers can choose the region where their organization's automation data is stored and processed, from regional data centers (US, EU/Frankfurt, Japan, Singapore, Australia, Israel, China, South Korea). Once stored, data remains isolated in that region and is not shared or transferred across regions; there is no ongoing per-workspace or per-project residency toggle. Self-service (non-enterprise) users can't choose a region and are hosted in one of Workato's US data centers. Using more than one region requires signing up for and maintaining a separate Workato account in each desired region.",
@@ -961,12 +943,12 @@ export const workatoProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           'SOC1 Type II, SOC2 Type II, SOC3, ISO 27001, ISO 27701, ISO 42001, HIPAA (BAA), PCI-DSS v4.0.1 Level 1, IRAP (PROTECTED, Australia), NIST 800-171A r2',
         detail:
-          "Workato's certifications go well beyond SOC 2: SOC 1 Type II covers financial reporting controls, ISO 27001 covers infosec management, ISO 27701 covers privacy (PIMS extending 27001, aligning with GDPR handling of PII), ISO 42001 covers AI governance, HIPAA compliance runs through signable BAAs with annual third-party attestation, PCI-DSS v4.0.1 Level 1 covers cardholder data, IRAP is assessed at the Australian government PROTECTED level, and NIST 800-171A r2 supports federal contractors handling Controlled Unclassified Information. There is no FedRAMP authorization or a standalone GDPR certification; GDPR compliance is represented through the ISO 27701 PIMS alignment.",
-        shortValue: 'SOC, ISO 27001/27701/42001, HIPAA, PCI-DSS, IRAP, NIST',
+          "Workato's certifications go well beyond SOC 2: SOC 1 Type II covers financial reporting controls, while its SOC 2 Type II report is aligned to the AICPA Trust Services Criteria and is available to customers under NDA. ISO 27001 covers infosec management, ISO 27701 covers privacy (PIMS extending 27001, aligning with GDPR handling of PII), ISO 42001 covers AI governance, HIPAA compliance runs through signable BAAs with annual third-party attestation, PCI-DSS v4.0.1 Level 1 covers cardholder data, IRAP is assessed at the Australian government PROTECTED level, and NIST 800-171A r2 supports federal contractors handling Controlled Unclassified Information. There is no FedRAMP authorization or a standalone GDPR certification; GDPR compliance is represented through the ISO 27701 PIMS alignment.",
+        shortValue: 'SOC 1/2/3, ISO 27001/27701/42001, HIPAA, PCI-DSS, IRAP, NIST',
         confidence: 'verified',
         sources: [
           {
@@ -979,6 +961,11 @@ export const workatoProfile: CompetitorProfile = {
             label: 'Automation Governance and Data Security | Workato',
             asOf: '2026-07-02',
           },
+          {
+            url: 'https://www.workato.com/legal/security',
+            label: 'Workato Security Overview',
+            asOf: '2026-07-02',
+          },
         ],
       },
       modelAndToolGovernance: {
diff --git a/apps/sim/lib/compare/data/competitors/zapier.ts b/apps/sim/lib/compare/data/competitors/zapier.ts
index 55632637da7..c9fc812fb17 100644
--- a/apps/sim/lib/compare/data/competitors/zapier.ts
+++ b/apps/sim/lib/compare/data/competitors/zapier.ts
@@ -804,21 +804,6 @@ export const zapierProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'SOC 2 Type II and SOC 3 certified',
-        detail:
-          'Reports are published and available via the Zapier Trust Center (trust.zapier.com). Zapier also maintains GDPR and CCPA compliance.',
-        shortValue: 'SOC 2 Type II and SOC 3 certified',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://zapier.com/blog/zapier-completes-soc-2-compliance-audit/',
-            label: 'Zapier completes SOC 2 compliance audit',
-            asOf: '2026-07-02',
-          },
-          { url: 'https://trust.zapier.com/', label: 'Zapier Trust Center', asOf: '2026-07-02' },
-        ],
-      },
       dataResidency: {
         value: 'No selectable data residency documented',
         detail:
@@ -861,7 +846,7 @@ export const zapierProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
+      compliance: {
         value:
           "SOC 2 Type II, SOC 3, GDPR, and CCPA compliant. Not HIPAA-compliant (no BAAs, PHI unsupported). Some third-party sources also cite ISO 27001 and PCI DSS, though these aren't confirmed on Zapier's trust page.",
         detail:
@@ -889,6 +874,11 @@ export const zapierProfile: CompetitorProfile = {
             label: 'Data Privacy Overview | Zapier',
             asOf: '2026-07-02',
           },
+          {
+            url: 'https://zapier.com/blog/zapier-completes-soc-2-compliance-audit/',
+            label: 'Zapier completes SOC 2 compliance audit',
+            asOf: '2026-07-02',
+          },
         ],
       },
       modelAndToolGovernance: {
diff --git a/apps/sim/lib/compare/data/sim.ts b/apps/sim/lib/compare/data/sim.ts
index 8bf43d4c589..dc7b80451ce 100644
--- a/apps/sim/lib/compare/data/sim.ts
+++ b/apps/sim/lib/compare/data/sim.ts
@@ -833,23 +833,6 @@ export const simProfile: CompetitorProfile = {
       },
     },
     security: {
-      soc2: {
-        value: 'Yes: SOC2 compliant',
-        shortValue: 'SOC2 compliant',
-        confidence: 'verified',
-        sources: [
-          {
-            url: 'https://sim.ai',
-            label: 'Sim Landing Page',
-            asOf: '2026-07-02',
-          },
-          {
-            url: 'https://sim.ai/enterprise',
-            label: 'Sim Enterprise Page',
-            asOf: '2026-07-02',
-          },
-        ],
-      },
       dataResidency: {
         value:
           'Full data control via self-hosting (Docker/Kubernetes); data never leaves customer infrastructure when self-hosted. On Sim Cloud, async job execution has an internal US/EU region toggle, but it is deployment-wide, not a customer-selectable per-workspace residency option',
@@ -912,17 +895,15 @@ export const simProfile: CompetitorProfile = {
           },
         ],
       },
-      additionalCompliance: {
-        value: 'SOC2',
-        detail:
-          'Self-hosting is the primary lever Sim offers for data-residency-sensitive compliance needs beyond SOC2, rather than additional certifications.',
-        shortValue: 'SOC2',
-        confidence: 'estimated',
+      compliance: {
+        value: 'SOC 2 Type II, ISO 27001:2022, GDPR',
+        shortValue: 'SOC 2 Type II, ISO 27001:2022, GDPR',
+        confidence: 'verified',
         sources: [
           {
-            url: 'https://sim.ai/enterprise',
-            label: 'Sim Enterprise Page',
-            asOf: '2026-07-02',
+            url: 'https://trust.sim.ai',
+            label: 'Sim Trust Center',
+            asOf: '2026-09-03',
           },
         ],
       },
diff --git a/apps/sim/lib/compare/data/types.ts b/apps/sim/lib/compare/data/types.ts
index b974b845ccd..a4ff85d2788 100644
--- a/apps/sim/lib/compare/data/types.ts
+++ b/apps/sim/lib/compare/data/types.ts
@@ -116,12 +116,11 @@ export interface ComparisonFacts {
     byok: Fact
   }
   security: {
-    soc2: Fact
     dataResidency: Fact
     rbac: Fact
     auditLogging: Fact
-    /** Compliance certifications beyond a bare SOC2 mention. HIPAA, ISO 27001, GDPR-specific attestations, PCI, FedRAMP, etc. */
-    additionalCompliance: Fact
+    /** Compliance certifications and attestations, including SOC 2, ISO 27001, GDPR, HIPAA, PCI, and FedRAMP. */
+    compliance: Fact
     /** Admin-configurable restrictions on which LLM providers/models members may use, and which specific tools/integrations a role can call. Finer-grained than plain workspace admin/write/read. */
     modelAndToolGovernance: Fact
     /** Restricting which specific stored credentials/connections a role or permission group may use, distinct from feature-level RBAC or integration-level allow/deny. */