How we decide what to tell you

What we check

• Domain history — registration and expiry dates via public RDAP registry data, registrar, privacy-proxy use, internationalized-name (homograph) risks, suspicious name patterns.
• Technical & security — HTTPS and certificate validity (direct TLS inspection), redirect behavior, security headers, DNS mail configuration (MX, SPF, DMARC) via DNS-over-HTTPS.
• Company identity — company details published on the site (imprint, contact, terms, privacy pages), cross-page consistency, contact quality, and verification against official registers: the Swiss Zefix index, UK Companies House, and EU VIES VAT validation. Jurisdictions without a supported register are reported as Unknown, never as negative.
• Website consistency — essential policies, placeholder content, mixed currencies or languages, pressure tactics, copied legal text.
• Reputation — independent web mentions, classified conservatively into counts of positive and negative experiences. Scored only when a search provider is configured; otherwise shown as ⚪ Unknown.
• Offer plausibility — not scored yet; appears as ⚪ Unknown and is excluded from the score entirely rather than silently counted.

How the score works

Each finding maps to a signal with a fixed impact between −1 and +1 and a confidence factor (low 0.35, medium 0.7, high 1.0). Per category:

category = clamp(0.5 + Σ(impact × confidence × 0.35), 0, 1)
score    = weighted mean over evaluated categories × 100    (trust-score-v1.4)

0.5 is the neutral baseline. Categories with no evaluable signals are excluded from the weighted mean — an unknown never lowers a score. The algorithm version is stored with every scan so older reports remain interpretable.

Every signal we score

57 signals in trust-score-v1.4. Positive impacts add trust; negative impacts reduce it; zero-impact entries only document unknowns.

Where AI is involved — and where it isn't

AI-text analysis

“Is This AI?” text verdicts come from three independent signals, each shown transparently in the report:

• Statistical analysis — burstiness (variation in sentence length; human writing varies more), vocabulary diversity, repeated phrases, punctuation variety, and the density of AI-typical stock phrases.
• Language-model perplexity — we run a small language model (distilgpt2) on our own servers and measure how predictable the text is to it. AI-generated text is typically far more predictable than human writing. English only; other languages report as inconclusive rather than guessing.
• Style review — a language model checks for characteristics commonly associated with AI-assisted writing.

One signal alone never produces more than “Some AI-like characteristics”; the strongest verdict requires independent signals to agree, and no percentage scores are ever shown. Text AI detection must not be the sole basis for academic, employment, legal or disciplinary decisions.

AI-image analysis

“Is This AI?” verdicts follow a strict evidence hierarchy: cryptographically verified C2PA Content Credentials outrank generator metadata (Midjourney, Stable Diffusion, Firefly, DALL-E markers), which outrank coherent camera EXIF, which outranks visual observations by a vision model. Visual observations alone can never produce more than “Probably AI-generated” at medium confidence, and results are never presented as proof. Detector placeholders that are not configured are clearly marked and ignored by the verdict.

Sources we verify against

Every company-identity and domain check resolves against these public registers and specifications. We link them so you can repeat any check yourself.

• RDAP (Registration Data Access Protocol) — registration and expiry dates, registrar, privacy-proxy use
• Zefix — Swiss Central Business Names Index — Swiss company register verification
• UK Companies House — UK company register verification
• EU VIES VAT validation — EU VAT number validation
• C2PA Content Credentials — cryptographically signed provenance for AI-image checks
• DNS-over-HTTPS (RFC 8484) — MX, SPF and DMARC mail configuration lookups

Limitations & independence

• A high score is evidence-based reassurance, not a guarantee; a low score is a set of concerns, not an accusation.
• Some registries (certain country domains) don't expose registration data — those lookups become Unknown, not negative.
• Sites behind aggressive bot protection may only be partially analysable; reports say so explicitly.
• Trust scores cannot be bought. There is no paid way to improve a score, and there never will be.
• Site owners can dispute findings — contact us with verifiable documentation and we'll re-examine the evidence.

Questions or a dispute? Reach us on the contact page.