Independent verification methodology

## Purpose This methodology explains how AI TrustMark makes judgements. It is the detailed technical record. The homepage explains the idea; this page explains the tests. ## What we test - Organisation identity, governance, privacy, security, support, continuity and operational practice. - Named products, including architecture, hosting, authentication, access, data handling, model providers, APIs, dependencies, AI-specific security, agents, logging, evaluation and reliability, where that product is in scope. - Customer reviews and, where evidence is available, implementation and outcome claims. ## What we do not test - We do not certify legal compliance, government approval or accreditation by ISO, NIST, the EU or any other body unless a separate, named relationship exists. - We do not guarantee that a product is free from every vulnerability, defect or failure. - We do not treat supplier marketing claims as verified unless the named claim has supporting evidence on the public record. - Unverified submissions (V0) never count toward ratings. ## Evidence standards Evidence is graded by independence, contemporaneity and relevance to the named scope. Confidential reviewer identities never appear in HTML, APIs, structured data, sitemaps or public source-rendered pages. ## Bronze, Silver and Gold These levels describe **depth of assurance**, not a ranking of bad, good and best providers. - **Bronze — External Assurance:** what can independently be verified from outside, using public and external evidence. - **Silver — Operational Assurance:** whether the organisation operates as it claims, using operational evidence and policy-to-practice verification. - **Gold — Technical Assurance:** what can be established when the technology itself is examined, including source or architecture where access is granted. ## Customer verification levels - **V0 Submitted** — received; not independently verified; excluded from ratings. - **V1 Email verified** — reviewer controls the supplied email address. - **V2 Organisation verified** — relationship with the stated organisation has been verified. - **V3 Customer relationship verified** — evidence confirms a genuine customer/provider relationship. - **V4 Outcome independently evidenced** — evidence supports the implementation or outcome described. V3 normally matches the reviewer's verified email to a confirmable purchase, licence, seat or tenant. Supporting document upload is optional. Bank-account checks are not part of V3. ## Assurance Score The Assurance Score (0–100) scores applicable controls for the named scope and depth. A high score cannot compensate for a catastrophic hard-gate failure. It is separate from Bronze/Silver/Gold and from review stars. ## Star ratings and directory ranking Star ratings use a 1–5 scale. Qualifying reviews require at least email verification (V1), explicit aggregate consent and publication. Fully confidential reviews are excluded from public aggregates. Weighted rating uses a Bayesian / confidence-weighted average: `Weighted rating = (v/(v+m) × R) + (m/(v+m) × C)` Verification level increases confidence weight without changing the stars submitted: V1 = 1.0, V2 = 1.1, V3 = 1.25 and V4 = 1.4. V0 = 0 and never counts. These values are also stored in the versioned methodology configuration. Directory rank is ordered only by this Bayesian review-star aggregate. Assurance Score, Bronze/Silver/Gold depth and product risk do not enter the sort. Rank **position is never stored or manually set**. ## Product risk Products are classified Low, Elevated or High Impact. Risk class determines applicable controls, evidence strength, testing intensity and certification gates. It is not a popularity ranking. ## Expiry and reassessment Certificates name an assessment date and expiry. Material change can require reassessment before expiry. Expired, suspended and revoked records remain visible as live status. ## Conflicts of interest and paid relationships Directory listing is free. Payment for the ranking service funds customer collection and verification and gates eligibility to appear in ranked lists; it never purchases or alters review stars or ranking position. Separately, payment for assessment cannot improve Assurance Score or certificate outcome. Ranked order is calculated from verified customer feedback only. Advertising and other commercial relationships do not alter results. Related organisations, including AI Build where assessed, are disclosed on the relevant public profile. The first ten independent V1+ products activated site-wide have free ranking eligibility. AI Build and other disclosed related organisations do not consume a free slot and pay on the same terms as any other provider. Thereafter ranking eligibility is activated with a code pack: 100 codes for £200 or 1,000 for £500, GBP ex VAT. Three V3 relationship verifications are included; additional V3 verifies cost £150 each, and V4 is quoted separately. Bronze, Silver and Gold assessment is a separate SKU. High Impact handling is an assurance add-on of £1,500/year; impact class and that fee never affect directory eligibility, review stars or order. ## Provider review responses Providers may respond once per published review. They cannot edit customer text or buy removal of a negative review. ## Appeals, suspension and revocation Material manual decisions are audit-logged. Certificates can be suspended or revoked when their basis no longer holds. Appeals follow the published process for the methodology version in force at assessment. ## Versioning Published methodology versions are immutable. Private rotating test cases reduce gaming. Each public record names the methodology version used. ## Recognised standards Where controls are mapped to recognised publications, the relationship is a mapping of relevant requirements — not certification by those bodies. Authoritative sources are listed on this page.