How this page was built

What you're looking at

Every Torii industry page shares one layout and one section order. Only the content changes from one industry to the next: the headline framing, the customer proof, the benchmark figures, and the three pressures in "What your customers make you prove." The structure is fixed on purpose. It is ordered by evidence, not by art direction.

Where the numbers come from

The application counts, the shadow-IT rate and the AI-spend growth all come from Torii's own internal data, aggregated and anonymized. Torii's 2026 SaaS Benchmark is one example of that data; in other cases a figure is sourced live, from current discovery rather than a fixed reporting window.

We count applications found through browser activity, OAuth grants and direct sign-ups, not only the ones visible in spend or SSO, which is why our figures run higher than licence-based benchmarks. Where a figure is an all-industry average rather than a software-specific one, we label it that way on the page itself.

• Torii internal dataAggregated, anonymized discovery data. Sometimes reported as a point-in-time benchmark, such as Torii's 2026 SaaS Benchmark; sometimes sourced live from current discovery. The source for every application count, shadow-IT and spend-growth figure.
• Published standards and frameworksAICPA Trust Services Criteria, the EU Standard Contractual Clauses, the CSA Cloud Controls Matrix, and vendor supplier requirements, each quoted verbatim and linked to its primary source.
• Named companies' contract termsSubprocessor notice periods and similar commitments, read from each company's own public supplier pages and dated to the day we checked them.

How the page is tailored

Every content element on the page is tagged with one of three scopes. This is what changes, and what never does:

• Fixed Identical on every industry page: the promises we make, the linked security pack, and the booking flow.
• Industry One value per industry: the headline, the proof, the benchmark figures, and the three pressures your buyers apply.
• Account Per-account detail, shown only after a person has verified it, and quietly falling back to the industry default when we can't.

How we cite external standards

Every standard, framework or contract term we quote links to a primary source, and carries the date we last verified it. Three rules we hold ourselves to:

• We quote verbatim and link the clause itself, not a summary of it.
• We cite the source document or report page, never a press release, which can render a figure incorrectly.
• Contract terms belonging to named companies are re-checked on a schedule, because those pages change quietly and without notice.

What we don't claim

Torii produces and maintains the inventory these obligations start from. It does not file your register or write your subprocessor list. It will not find the infrastructure your engineers chose, such as hosting, telemetry, or the model API your backend calls, because no employee "uses" those. What it finds is the other half: the tools your own staff adopted, increasingly AI tools, that touch customer data and are not on the list you published.

These figures are averages, not a promise about your environment. Your numbers are what the two-week, read-only discovery is for.