Questions we are asked most

No, and no honest verification can offer that. A certificate confirms that specific checks in a published scope passed on a specific date under a specific methodology edition. It is precise about what it does and does not cover.

By looking it up in the public registry by Certificate ID or domain. Every certificate has a signed registry record; a certificate that is not in the registry does not exist.

Published: level, status, dates, scope, exclusions, each check with its method and a public evidence summary, open Critical and High counts. Never published: vulnerability details, secrets, private addresses, code, or evidence that could facilitate an attack.

Twelve months from the verification date. Renewal is a full verification against the current methodology edition.

V1: one to two business days. V2: one to two weeks. V3: two to four weeks. V4: four to eight weeks. Durations depend on timely accesses and remediation.

Indicative starting prices per product per year: V1 from $5, V2 from $149, V3 from $499, V4 from $1,499. The final quote follows the free preliminary assessment and depends on size, components and risk.

Only what the level requires: public endpoints for V1; temporary test accounts for V2; read-only repository and pipeline access for V3; read-only cloud access and process documentation for V4. Accesses are provided through protected channels and revoked when the verification ends.

You receive a private report with details and remediation guidance. The certificate is not issued until the risk is remediated and re-tested. Nothing about the finding is published.

Critical must always be fixed. High must be fixed for V3 and V4. Medium and below can be accepted with a documented rationale; the acceptance is recorded but details are not published.

Report the change within ten business days. If it is material — a new authentication provider, a new API, a hosting migration — the affected checks are re-verified and the certificate is Suspended in the meantime.

Yes: for an unremediated Critical or High risk after the deadline, false information, misuse of the badge, obstruction of a re-check or non-payment. The reason is published. Revoked records stay in the registry.

Yes, in the issued form, linking to the Trust Page. The badge reflects the live status, so a suspended certificate is visibly suspended.

Yes, through the AI/Agent Security add-on: prompt injection, tool authorisation, output handling, data leakage, supply chain, abuse controls and oversight. Without the add-on, AI components are listed as an exclusion.