SafeZoneAI Supply

Scoring Methodology

How we turn a supplier list into a risk number — what we look at, what we don't, and why.
v1.1 · published 2026-05-03 reproducible from public inputs
4
Sanctions regimes
14k+
Sanctioned entities
1–10
Audit-grade score
0
Black boxes

What this measures

SafeZoneAI Supply assigns each supplier in your portfolio an integer risk score from 1 to 10. The score is supplier-level, not country-level — a US-based vendor on the OFAC SDN list scores worse than a perfectly clean manufacturer in Yemen.

The score answers one question: should someone on my team look at this row before we send a PO?

Inputs

Every supplier row ingested through a CSV or PDF upload contributes three fields: name, country, and address. Name is required. Country and address are strongly recommended — a missing country falls back to a neutral default score.

Version 1.0 factors

1. Country baseline

Each country maps to a 1–10 score derived from three published indices, weighted equally:

Countries are matched by ISO 3166 name or common alias. The mapping is published in shared/country_risk.json alongside the code that reads it — every score a customer sees is reproducible from public inputs.

2. Sanctions screening — multi-regime

Each supplier name is compared — exact match only, including every published alias — against four primary-source sanctions lists:

On any hit the score is set to 10 regardless of country and the row is flagged sanctions_flag: true. Every regime that hit is recorded in sanctions_lists_hit, with each list's own canonical id preserved — so a single supplier matched on three regimes shows up as ["UK-OFSI","EU-FSF","OFAC-SDN"] with all three source ids cited in the audit JSON.

Names are normalized before comparison: lowercased, punctuation stripped, and one trailing corporate suffix (Inc, Ltd, GmbH, AG, PJSC, ООО, etc.) removed. Build-time and lookup use identical rules.

Why direct primary-source ingestion (not OpenSanctions)? Every regime above publishes its own feed for free. Audit-grade screening means citing the issuer's own id ("UK OFSI Group ID 17195") rather than a consolidator's surrogate id. We rebuild the unified index from primary sources and ship it with every deployment.
Why exact match only? A single false-positive flag on a clean supplier erodes trust in every real flag. We explicitly do not do fuzzy, phonetic, or edit-distance matching. A buyer who runs the same name through a commercial OFAC screening service should see us agree with them on every hit.

Bands

Scores are bucketed for display:

ScoreBandWhat it typically signals
1–3lowStable rule-of-law country, no sanctions exposure.
4–6moderateActive country programs or elevated institutional pressure.
7–8elevatedMajor sanctions jurisdiction (e.g. China sector controls, Russia).
9–10criticalComprehensive sanctions, active conflict, or direct SDN match.

Refresh cadence

What v1.0 is not

Being explicit about the limits keeps this useful:

Data sources

Reproducibility

Every scored row carries two audit fields: methodology_version (which scoring rules produced the score) and sanctions_version (which dated snapshot of the consolidated index was used). That pair plus sanctions_lists_hit is enough to re-derive any score from the published code and the dated source data.

Change log

Questions, corrections, or a score you disagree with?

Email hello@safezoneaitech.com. Methodology drift is how this kind of product goes stale — we want to hear about the case where our number doesn't match yours.

Cookie settings