Badges
What a trust badge actually proves
A trust badge proves nothing on its own, because a badge is an image file and anyone can copy one. What it can point to is a register entry — and the only badge worth displaying is one where the issuer, not the company showing it, controls what the register says. The single question that separates the two: can the issuer change this to "revoked" tomorrow without the company's permission, and would the badge on the company's own site change too?
If the answer is no, you are looking at decoration. That is not always dishonest — plenty of sincere organisations display badges that mean less than they think — but it is not evidence, and it should not be treated as any.
Three things that look identical in a website footer
| Self-declared badge | Directory listing | Verified credential | |
|---|---|---|---|
| Who decided | The company itself | Nobody — payment or signup | A named reviewer at the issuer |
| Evidence checked | None, or a questionnaire | Usually none | Documentary, before publication |
| Public register | None | A list of members | Queryable, returns negatives |
| Can return "no" | No | Absence only | Yes, explicitly |
| Can be revoked | No | Only by cancelling | Yes, unilaterally |
| Machine-checkable | No | Sometimes | Free, no account |
| What it tells a buyer | That the company wanted to look trustworthy | That the company paid a listing fee | That a specific claim was checked on a specific date |
The middle column is the one that catches people out. A directory listing feels like verification because it lives on somebody else's domain — but if the only requirement was signing up, then the register is a customer list wearing a lanyard.
Four questions to ask about any badge
-
Where is the register, and can I get a "no" out of it?
Query a domain you are certain is not certified. If there is no way to receive a negative answer, there is no register — only a page listing whoever paid. A register that can only confirm is a brochure.
-
Does the badge check the register, or is it a picture?
View the page source. If the badge is a static image with a link back to the issuer's homepage, nothing is being checked at load time and a revoked credential will keep displaying indefinitely. A badge that queries the register on render can go dark the moment status changes.
-
Who signed the decision?
A name, or at minimum a role held by an identifiable person. "Reviewed by our platform" means an automated check passed, which is a receipt for a form submission.
-
What exactly was checked?
A narrow claim checked carefully beats a broad claim checked vaguely. "This company is legally registered and controls this domain" is a small, true, useful statement. "This company's AI is safe and compliant" cannot be established from a form and should make you more suspicious, not less.
Why this market has a credibility problem
Because badges are sold and audits are expensive, and the badge is the part the customer sees. When a single organisation controls both the standard and the certification against it, the commercial pressure runs one way: approve. The badge becomes the product and the audit becomes a cost centre, and the failure surfaces only when somebody scrutinises a certified company after an incident.
That is not a hypothetical. It is the pattern behind the collapse of confidence in AI compliance certification through 2026, which we wrote about at more length in our analysis of centralised certification.
The structural fix is not a better badge. It is putting the status somewhere the certified party cannot edit, and making the withdrawal mechanism real and public.
How Lunara's badge works, and how it can fail
Our badge queries the public register when the page renders. If a credential is withdrawn, the badge changes on the certified party's own site without their involvement — that is the whole point of it, and it is a commitment against our own commercial interest, since a revoked customer is a lost customer.
Its honest weaknesses, stated here rather than left for you to find: a badge that depends on a network call fails to a neutral state if our register is unreachable, so it cannot be used as proof of absence during an outage. And the register is nearly empty — Lunara is new, so a Lunara badge currently signals very little to a buyer who has never heard of us. A young credential is worth what a young credential is worth.
Revocation is the test
Everything else — the design, the wording, the issuer's reputation — follows from whether the status can be taken away by someone other than the party displaying it. Apply that one question to every badge you see, including ours.
Questions
Are website trust badges worth anything?
Only when the issuer maintains a public register that can return a negative or revoked answer, and the badge checks that register rather than being a static image. Without both, a badge tells you the company wanted to look trustworthy, which every company does.
How do I check whether a trust badge is real?
Go to the issuer's register yourself and query the company's domain. Do not click the badge — a badge that links back to the site displaying it, or to the issuer's homepage rather than to a specific register entry, proves nothing. If the issuer has no queryable register, the badge is decoration.
What is the difference between a trust badge and a certification?
A badge is the visual artefact. A certification is the decision and the register entry behind it. They are frequently sold as the same thing, and the gap between them is where the entire problem lives — you can buy a badge, but a certification has to be granted by somebody who could have refused.
Can a trust badge be faked?
The image, trivially — it is a file. What cannot be faked is the issuer's register, which is why every check should end there rather than at the badge. This is also why a register must be able to answer for domains that are not in it.
Should a small company bother getting certified at all?
If applying is free and a human reviews it, the cost is your time and the downside is a rejection you can appeal. If it costs money, ask what the register would say about you today and whether your buyers check registers at all. For many small companies the honest answer is that a published corrections record and citable claims will do more for trust than any badge.