Make demonstrable web security visible

This is how you obtain the certificate

You obtain the certificate through a complete audit process

1. Prepare website and access

   We record your domain, environments, existing features, and required access for a secure start of the full process.

2. Security and privacy research

   We assess every check in the fixed framework for code, configuration, privacy, data flows and the production environment. Only demonstrably absent functions are recorded as not applicable, with a documented reason.

3. Remediation of confirmed findings

   Remediation takes place within the agreed assignment, by us or together with your developer. For certification, all confirmed findings within the audit scope must be resolved.

4. Targeted retest of the result

   We reassess every correction. Your regular contact person guides the investigation, remediation, and retest from start to finish.

5. Issuance and publication

   After admission, you receive your unique certificate, a personal embed code for the centrally managed badge and one reminder after eleven calendar months.

Validity and follow-up

Valid for one year

• Time-bound assessmentThe first annual period begins with the successful retest. After eleven calendar months, you receive one reminder for a new assessment. That assessment begins only after a new engagement. With a timely renewal within that month, the next annual period starts at the existing expiry date. The certificate applies to the stated domain and assessment scope.
• Keeping pace with your websiteAfter a major release, new payment flow, authentication, data processing or infrastructure change, you can request a new assessment. This requires a separate engagement.
• Targeted follow-upA new non-critical finding receives a remediation and retest period of up to 30 calendar days, never later than the expiration date. The hosted badge is hidden in the meantime. Without a timely successful retest, suspension or expiration will follow.
• Rapid protectionIn case of a critical or actively exploitable risk, we immediately pause the valid status. After remediation and retesting, the current quality is confirmed again.
• Reliable statusThe register shows the registered certificate status, so visitors can rely on up-to-date information.

For visitors

The current status in one click

Each issued badge links directly to the current certificate status of the audited domain. Visitors can see the retest, validity period, the full fixed audit framework, and the framework version in plain language.

Centrally managed and up to date

We host the badge for you

You place a personal HTML snippet on your website. The badge is supplied directly by Charter Nine provided and automatically follows the current certificate status. This means you do not need to change your website after a reassessment.

The badge does not set cookies. Thanks to the setting referrerpolicy="no-referrer" the visited page is not sent when the image loads.

Trust through transparency

C9 Verified by Charter Nine

Your visitors can see which domain was investigated, when the last retest took place, which version of the full fixed control framework was applied, and how long the certificate remains valid.

This is how you make demonstrable attention to web security visible and give visitors clear proof of quality at important contact, account, and sales moments.