ADBR

A rating for the data a company runs on.

Financial statements get audited. Security gets certified. The data underneath both — where it lives, who can read it, whether the numbers reported from it can be reproduced — has never had an equivalent. ADBR is that rating, and it is designed to be handed to someone who has no reason to trust the company holding it.

  • Two numbers: A grade, and — the same size, on the same line — how well corroborated that grade is. A letter printed alone invites being quoted alone.
  • One link: Every issued rating carries a verification address. Anyone holding the document can check it without an account, and without trusting either the company or us.
  • No data leaves: The rating is computed on the company's own machine. What travels is counts, ratios and disclosures — never a value from a row, never a line of SQL.

What an ADBR measures

Three axes, weighted. Each is scored from evidence the organization cannot restate, and each says plainly what it could not see.

Integrity (45%) — Are the numbers real?

Whether the figures a company reports can be recomputed from its own data, and whether the definitions behind them changed quietly. Structural health of the schema is measured everywhere; metric fidelity needs the company to certify which numbers it stands behind.

Governance (30%) — What sensitive data exists, and who can read it?

Personal data is inventoried where it rests and counted separately where it is merely reachable — a column exposed through three views is one piece of data in four places, not four findings. Where an engine will report column privileges, the rating measures who can actually read them.

Operations (25%) — How safely does this company operate against its own data?

Read from the record of what was actually run: how much production work is destructive, how much of it failed, and whether destructive work happened with a backup behind it.

Why it can be believed

A rating is only worth the constraints it puts on itself. These are the four that shape every grade.

Derived, never asserted

The organization being rated does not get to state its own result. Scope, coverage and protection are computed from evidence — including a comparison between the databases a company put in scope and the databases its own query history shows it actually uses.

Ceilings, not averages

A short observation window, an unexplained estate boundary or an unanchored figure each cap the grade outright. They compose by taking the lowest, so a strong score on one axis cannot buy back a weakness on another — which is precisely the trade a company with something to hide would want to make.

Unmeasured is never a pass

Every signal that could not be assessed is printed as unassessed and costs confidence. Nothing that went unmeasured can raise a grade. A rating that quietly omitted what it could not check would be worth less than no rating.

A first rating is deliberately modest

Time cannot be crammed. A newly rated estate is provisional regardless of how good it is, and the grade rises as a continuous, tamper-resistant record accumulates. That is the mechanic that makes an ADBR mean something a snapshot cannot.

What it will not claim

  • It cannot see what it was not shown. Where a company's own query record shows databases that were left out of the rating, that gap is reported as a finding rather than quietly ignored — but a database nobody has ever touched from a rated machine leaves no trace to find.
  • Reading a copy is not verifying a source. When a figure originates with a third party and the company holds a mirror of it, the rating checks the mirror's internal consistency and says so. Internally consistent is not the same as true, and the grade is capped accordingly.
  • Protection can only be measured where an engine reports it. Some databases expose who can read a column; others expose nothing. Where the question cannot be answered it is printed as unanswered — never inferred from a column's name or type.
  • The top scope band is not currently reachable. Confirming an estate against an independent inventory is not yet part of the rating, so no organization can presently earn the highest boundary rating, however complete its estate genuinely is.

Getting one

ADBR is produced by AddisDB on the Business plan. Connect the databases in scope, let the record accumulate, and issue a rating when you need one — for a data room, a board, a procurement review, or your own reading. Generating a rating and issuing a verifiable one are the same act on the same evidence; nothing is re-scored to make a document.

Holding a rating and want to check one? Every issued document carries its own verification address — open the link printed on it.