Skip to content
Digital Trust Audit

Before anyone does business with you, your website, your domain and your company record get checked.

Digital Trust Audit is an independent UK body. We check what a customer, a bank, a procurement team or an AI answer engine can verify about a business from the outside — its website, its domain, its email authentication and its company record — against a published standard. We do not sell the remediation.

You are rarely refused. You are quietly marked down.

Banks, insurers, payment processors and procurement teams run these checks as routine. So do the AI systems that now answer your buyers’ questions. Almost none of them tell you what they found.

None of these processes carries a duty to notify you. A business is not usually turned away with a reason. It is scored, or left out of the answer, and the conversation simply does not happen.

Most businesses have no idea they are being marked down. Nobody is required to tell them.

Asked who does this, the answer engines said nobody

In September 2026 we put one question to the seven systems that answer buyers’ questions — Google’s AI Overview and AI Mode, ChatGPT, Copilot, Claude, Perplexity and Gemini. The question was who can independently check a UK business’s website, domain, email set-up and company records and give it a written report.

Six of the seven opened by saying that no single provider does it. Every one of them then handed the enquirer a homework list: commission a digital agency, a credit reference agency, a cyber consultancy and a trust scheme, and reconcile the four results yourself.

That is the gap this body was set up to close. One assessment, one standard, one report.

Eleven areas, checked against live sources, on a stated date

The eleven areas checked in a Digital Trust AuditEleven small hexagons in a row, one for each of the eleven areas the audit checks.
  1. Company record — the registered name, number, registered office and filing status, and whether the address itself tells a checker anything.

  2. One business or several — whether the trading names, brands and legal entities a visitor encounters resolve to the company they think they are dealing with.

  3. Machine-readability — whether the site states, in a form a machine can extract, what the business is, where it is and what it sells.

  4. Navigability — whether a visitor and a crawler can reach everything the business claims to publish.

  5. Email authentication — SPF, DKIM and DMARC, and whether the domain can be impersonated.

  6. Contactability and identification — whether the published contact routes reach the business, and whether the business is identifiable from them.

  7. Proof — whether case studies, figures and claimed accreditations reconcile against the registers that issue them.

  8. Presence away from the site — what independent sources say, and whether they agree with the site.

  9. Domain ownership — who holds the domain, how it renews, and how close it is to expiry.

  10. Legal pages and company particulars — whether the statutory disclosures are present and name the correct entity.

  11. Accessibility — conformance against the published standard, checked rather than fixed.

Each finding carries one of four flags: Passed, Needs a decision, Weak, or Failed. A fifth state, Could not be confirmed, covers anything not establishable from outside — and those items are lifted out of the score rather than counted against it.

Read the published standard

We do not sell the fix

The auditor should not be the agency that built the website, configured the email system, or sells the certification being recommended. That is the test buyers are increasingly told to apply, and it is the reason this body does not sell remediation and never will.

It is also why the report has no fix list. A remediation plan is priced, in a buyer’s mind, against the number of problems in it — which gives whoever writes it an interest in finding more. What the report gives you instead is the finding and the criterion: this is what we found, this is what the standard requires. Any competent supplier can act on that, and you choose who.

What it costs

Digital Trust Audit

£1,200

+ VAT

Eleven areas, human-verified, report in five working days.

AI Visibility Audit

£595

+ VAT

25 agreed buyer questions, seven answer surfaces, run twice.

Digital Trust Monitoring

£395

+ VAT per quarter

The assessment re-run every quarter.

Supplier Check

£450

+ VAT

The same assessment, applied to a supplier you are considering.

Free website health check

No charge

Automated, returned the same working day.

See what is included at each price

Start with the free check

The free check is automated. It reads what is publicly published about a domain — DNS, mail authentication, the company record, the site’s structured data, certificates and broken links — and emails you what it found, the same working day.

It is not the audit. No human reviews it, it produces no findings detail, and it cannot earn accreditation. It also is not tuned to alarm you: it is capable of returning nothing significant found, and it sometimes does. That sentence is in the published standard, where you can hold us to it.

Request the free check

Checking somebody else’s company rather than your own? That is a different assessment — see Supplier Check.

See how your business reads from the outside.

The free check is automated and costs nothing. The full audit is £1,200 + VAT.

Request the free check

Frequently asked questions

Digital Trust AuditVerified from the outside in.

No. Digital Trust Audit is a private certification scheme. It is not a statutory scheme and it is not connected to UK CertifID or the UK digital identity and attributes trust framework.

Digital Trust Audit is a trading name of DTA Registry Ltd, which is wholly owned by OD3X Ltd, a Hong Kong company. OD3X Ltd also owns a half share in a UK agency that carries out remediation work. That relationship is set out in full on the About page, and it is the reason the scoring criteria are published and carry no discretion.

No. We assess and we certify. Remediation is carried out by other firms, and we take no commission on it.

The report is issued within five working days of the assessment starting.

Yes — an automated website health check, returned the same working day. It cannot earn accreditation.