Without source access
Public domains, TLS, DNS, HTTP configuration and exposed services. Internal application behavior remains outside visibility.
§Certification
From application to a public certificate
From application to retesting and certificate issuance — entirely online. Resources, access, load limits, pricing and issuance requirements are agreed before testing.
What an online assessment can cover
Online describes how the work is delivered. Available access determines the assessment coverage.
With test accounts
Private features, APIs, roles and user scenarios. Testing uses agreed test data and load limits.
With supporting access
Repositories, dependencies, configurations and supporting documents. Access is arranged separately; never send secrets in the application form.
The nine stages
- 01 · DraftProvide the resource, company and contact. Add optional details now or agree them after submission.
- 02 · SubmittedThe application is registered, a reference number is assigned and a verification team is appointed.
- 03 · Scope reviewConfirm owner authorization, domains, components, environment, exclusions, testing window and load limits. Record the scope before work begins.
- 04 · Access set-upYou provide the accesses the level requires — test accounts, read-only repository or cloud access — through protected channels.
- 05 · Automated testingAutomated checks run against the perimeter, the application, dependencies and code within the scope.
- 06 · Expert reviewExperts execute the manual scenarios of the level: authorisation, isolation, business logic, evidence review.
- 07 · Action requiredIf risks are found you receive a private report with severity, impact and remediation guidance, and a deadline.
- 08 · Re-testRemediated items are re-tested. Critical must be closed; High must be closed for V3 and V4.
- 09 · Certificate issuedThe certificate, the Trust Page, the badge and the Security Summary are published in the registry.
What you receive
01
Certificate
A signed registry record with a unique ID, level, scope, result and validity period.
02
Trust Page
A public page with the checks, methods, dates, evidence summaries and exclusions — readable by a buyer’s security team.
03
Badge and embed code
A badge for your site and documents that always links to the live status in the registry.
04
Security Summary
A short, printable summary for procurement and security questionnaires.
05
Private report
The full findings with technical details, impact and remediation guidance — never published.
Accesses by level
We never ask you to paste secrets into a text field. Accesses are provided through protected channels and revoked when the verification ends.
| Required accesses | V1 | V2 | V3 | V4 |
|---|---|---|---|---|
| Public endpoints only | ||||
| Temporary test accounts | — | |||
| Read-only repository access | — | — | ||
| CI/CD configuration and SBOM | — | — | ||
| Read-only cloud access | — | — | — | |
| Process documentation | — | — | — |
How long it takes
Durations assume timely provision of accesses and remediation. Re-tests are scheduled within five business days of your confirmation.
- V1 · Surface Verified
- 1–2 business days
- V2 · Application Verified
- 1–2 weeks
- V3 · Code Verified
- 2–4 weeks
- V4 · Assured
- 4–8 weeks
When a re-verification is required
You are required to report a material change within ten business days. Until the affected checks are re-verified the certificate is shown as Suspended.
- 01Replacement of the authentication or authorisation mechanism
- 02New components in scope: a new API, a new data store, a new cloud account
- 03Migration to another hosting or cloud provider
- 04A security incident affecting the components in scope
- 05A High or Critical vulnerability reported by a third party
Validity and renewal
Every certificate is valid for twelve months from the verification date. Renewal is a full verification against the current edition of the methodology; V4 includes quarterly re-checks and continuous perimeter monitoring during the validity period.