Depth of assurance, not a provider ranking
Bronze — External Assurance
What can independently be verified from outside?
What can independently be verified from outside the organisation.
Bronze is the external-assurance on-ramp: public identity, website security, privacy and policy analysis, and AI transparency disclosures.
No internal company or source-code access is required. Bronze is a depth of investigation, not a judgement that the provider is “entry-level”.
Provider
Legal entity, domain association, trading identity and functioning contact routes.
Web security
Safe, non-destructive HTTPS, TLS, redirects, security headers and public attack-surface checks.
Privacy
Policies, terms, trackers, subprocessors, retention, transfers, rights and policy-to-observed-behaviour analysis.
AI transparency
Use of AI, model providers, limitations, human review, training, retention and consequential use disclosures.
Accessibility
Automated accessibility checks, without claiming complete WCAG compliance.
What the result means
The certificate identifies the product, assessment depth, risk classification, Assurance Score, standard version, assessment date and expiry. Bronze, Silver and Gold describe how deeply the named scope was examined. They do not rank providers as bad, good or best. The certificate is not a guarantee that the product is free from every vulnerability, defect or failure.
Start Bronze