§For buyers
Check the evidence before you buy
A vendor’s security questionnaire tells you what they say. A CyberSecurityV Trust Page tells you what an independent party verified, when, how and with what result — and what it did not verify.
Three minutes to a verified answer
Find the record
Enter the Certificate ID from the vendor’s badge or the product’s domain into the public registry. If nothing is found, the certificate does not exist — whatever the image says.
Read the scope and the exclusions
A certificate covers only the published components. If the part you are buying — the mobile app, the AI assistant, the payment flow — is in the exclusions, it was not verified.
Check the status and the date
Only Active means the certificate is valid now. Suspended, Expired and Revoked are shown for a reason, and the reason is published.
Hand it to your security team
The Trust Page lists every check with its method and a public evidence summary. The Security Summary prints in two pages.
Red flags
- 01A certificate image or badge that does not link to the registry.
- 02A vendor who cannot name the Certificate ID.
- 03A scope that excludes exactly the component you are buying.
- 04A certificate older than twelve months without a renewal.
- 05Claims of “full security” — no serious verification says that.
What a certificate is not
It is not a guarantee against every attack, not a penetration test report you can request, and not a statement about components outside the scope. It is a precise, dated, independently verified record — which is exactly what a security review needs.