1. Consent and secure test preparation
Investigation starts only after authority or permission is confirmed and the exact domain, environments, access, safe test windows, and boundaries with third-party systems are documented in writing. These agreements protect business operations and determine what the certificate pertains to; they do not reduce the fixed control framework.
2. Fixed audit framework and result
Every website audit includes the complete security audit and website-related GDPR privacy audit according to the applicable framework version. Each check receives an outcome; only demonstrably absent functions are recorded as not applicable, with a documented reason. The certificate confirms the latest successful retest for the stated domain and published validity period.
3. Changes and remediation
The assignment defines which remediation Charter Nine performs and at what price. Additional work requires a separate agreement. An audit or remediation assignment does not automatically entitle you to C9 Verified; all applicable certification criteria must demonstrably be met.
For each finding, we record who performs the remediation and when it must be completed. When your developer or supplier carries out the remediation, our technical retest is still required for certification. Additional work and extra retests are priced and agreed upon in advance.
Remediation work is scoped, tested and performed with a rollback option where possible. The customer remains responsible for valid backups, decisions about business operations and access to systems, unless otherwise agreed in writing.
4. Right of use and validity period
C9 Verified is Charter Nine's own certification. It confirms the review at the stated time and within the recorded scope of control. It does not guarantee future security or general legal compliance and is not a government, EU, ISO, or OWASP certification.
The badge remains the property of Charter Nine. The client receives the right to use for the mentioned domain as long as the public certificate is valid and the placement rules are followed.
5. Reinspection and new findings
The certificate is valid for one year. The owner receives one reminder eleven calendar months after the start of the certificate period. A new recheck begins only after a new assignment. Report relevant changes, new vulnerabilities, and incidents as soon as they become known through the agreed contact channel. C9 Verified does not include continuous monitoring.
For a new non-critical finding, we record 'Remediation required'. Remediation and a successful retest must take place within the stated period: a maximum of 30 calendar days from registration and never later than the expiry date. During this status, the hosted badge is not displayed. Without a timely successful retest, the certificate is suspended or expires when the validity period ends. Critical or other situations that block the badge lead to immediate suspension.
6. Current status and termination
The register shows the current registered status. In addition to the periods above, misleading badge use, terminated cooperation, or a material change may lead to suspension, revocation, or expiration. After termination, the badge is removed.
7. Confidentiality and data
Both parties handle non-public technical information carefully. Secrets are shared exclusively via the protected client environment, not through the regular contact form. Personal data is processed according to the applicable privacy agreements.
8. Assignment agreements
External services are assessed insofar as their use and connection are part of the examined website; their entire infrastructure is therefore not certified. Missing access for a mandatory check remains a limitation and blocks issuance.
The signed proposal can establish price, schedule, access, test windows, and remediation work. It cannot limit the fixed assessment framework or the certification criteria. The written agreement contains the applicable terms and, where necessary, the processor agreements. This public summary does not replace those assignment agreements.