Digital Trust Accreditation
The credential earned from a Digital Trust Audit. Three levels, criteria published in full and applied without discretion, a hard floor that no score can buy past, a verification page for every badge, and an expiry twelve months after the assessment that earned it.
The hard floor, required at every level
Six items. A business with any of them open receives no accreditation at any score.
The register agrees with the site The registered name, company number and registered office appear on the website and match Companies House
Mail is enforced DMARC at p=quarantine or p=reject, with a reporting address
The company owns its domain The primary domain is registered to the company, the renewal contact is a monitored company mailbox, and it is not within 90 days of expiry
No dead credentials on display Every accreditation logo or claim on the site is current on the register that issued it
The legal pages are accurate The privacy policy names the correct legal entity as controller, and the cookie behaviour matches the cookie policy
Somebody answers The main published telephone number is answered in business hours on test
The three levels
Confirmed
- Overall score
- 65 or above
- Lowest area score
- No area below 45
- Hard floor
- All six clear
- Unconfirmed items
- Any number
- Monitoring
- Not required
- AI visibility
- Not required
- Valid for
- 12 months from the assessment
Proven
- Overall score
- 80 or above
- Lowest area score
- No area below 65
- Hard floor
- All six clear
- Unconfirmed items
- None
- Monitoring
- Active
- AI visibility
- Not required
- Valid for
- 12 months, refreshed at each quarterly re-run
Exemplary
- Overall score
- 90 or above
- Lowest area score
- No area below 80
- Hard floor
- All six clear
- Unconfirmed items
- None
- Monitoring
- Active
- AI visibility
- Named on at least 3 of the 7 answer surfaces in the most recent AI Visibility Audit
- Valid for
- 12 months, refreshed at each quarterly re-run
Confirmed means that what the business publishes about itself has been confirmed against the public record on the date shown — the overlap in the mark. Proven adds that nothing was left unconfirmed and the assessment is kept current. Exemplary adds that AI answer engines name the business.
There is no number on the badge. The score is in the report and on the verification page. A badge carrying a score invites comparison between businesses, and this assessment is not built for that.
How the badge works
The badge is not a file you are sent. It is served from this body’s own origin, with the level, the assessment month and the expiry rendered into the image at the moment it is requested.
That is what makes it a credential rather than a picture. When it expires, it changes on your site to “expired — re-audit due” on the day, without anyone touching anything. When it is stepped down, it steps down. A badge that cannot be lost is worth nothing, and a badge you host yourself cannot be lost.
The embed snippet is fixed and is not editable:
<a href="https://digitaltrustaudit.co.uk/verify/your-company/"
title="Digital Trust Audit — Confirmed">
<img src="https://digitaltrustaudit.co.uk/badge/your-company.svg"
alt="Digital Trust Audit — Confirmed, assessed September 2026"
width="440" height="112" loading="lazy">
</a>The link goes to your own verification page, never to this body’s homepage. The anchor is the image with a descriptive alt. There is no keyword anchor text, and there never will be.
The three badges
- Artwork pending
Confirmed
Proven
Exemplary
Every badge is checkable
Every badge links to a verification page carrying your company name, your company number, your website, the level, the assessment date, the expiry date, whether monitoring is active, and the eleven area names with a pass or attention indicator against each. Not the scores, and not the findings — those are yours.
A badge that cannot be clicked through to a live record on the issuing body’s own site proves nothing, because anyone can put an image on a website. The clickable verification is the credential; the image is a pointer to it.
Each credential also carries machine-readable metadata — the criteria, the issue date, the expiry and the assessment reference — so that a machine can verify it as well as a person. For a body whose product is machine-readability, that is the minimum.
How it is withdrawn
A quarterly re-run that drops a business below its level triggers thirty days’ notice by email, and then a step down a level or to expired. Anything that breaches the hard floor — a lapsed accreditation still displayed, a DMARC policy switched back to p=none — steps the badge straight to expired with no grace period.
Withdrawals appear on the register. A register that only ever grows is a rubber stamp and reads as one.
Where a connection exists, it is stated
Where this body has any connection to an accredited business, or to the supplier who built or maintains what was assessed, the connection is stated on the report and on the verification page, in accurate terms rather than as a generic label. There is no discretion about what counts as material.
Rules of use
Display the badge using the snippet as issued. Do not edit it, resize it below 220px wide, recolour it, or host the image yourself.
The badge may appear on the website, in email signatures and in proposals of the assessed business only.
It states the result of an assessment on the date shown. It does not state that this body endorses the business, its products or its people.
It expires on the date shown, and displays as expired from that day.
It may be withdrawn if a later assessment finds the level is no longer met. You will be told, and given thirty days.
A verification page is published for every badge. If you would prefer not to be listed, do not display the badge.
Putting the badge on your site
Pick the platform your site runs on. The snippet is the same in every one of them.
What it costs
£295 a year plus VAT, for the twelve-month term, the served badge, the verification page and the register entry. Renewed by re-assessment.
The register is not open yet
The register opens when the founding assessments are complete. Nothing is listed on it today, and nothing on this page describes a badge that has been issued.
There is a condition on opening it that is worth stating in advance: unconnected entries must outnumber connected ones before the register is published. A register launching with five connected businesses out of five is not evidence, and one look at Companies House would say so.
The criteria behind every level are in the published standard, the quarterly re-run that keeps a level current is Digital Trust Monitoring, and the assessment that earns it is the Digital Trust Audit. A level that is disputed has a published route on the complaints and appeals page.
A badge that cannot be lost is worth nothing.
Three levels, a hard floor, a verification page for every badge, and a stated expiry.
Request an audit