The proof page lists every verification record contributing to this provider's standing. Date and level are public; client identity is anonymised unless the client opts in; underlying data sources are held in the evidence vault.
Every level this provider has earned, with what the records at that level actually are, not a generic description. Underlying artefacts live in the evidence vault; what's disclosable is shown here.
Seeded from the public record. Not yet claimed by the provider.
A verified owner claims the listing and completes the structured profile.
Trustgent-attested checks of this provider's claims against independent public sources it does not control. Each item links to the source and shows when it was checked.
BTCPay Server's own project blog documents an XSS vulnerability responsibly disclosed by Doyensec researcher Kevin Joensen, evidencing Doyensec as a real practicing security research firm engaged with third-party customers.
“Kevin Joensen of [Doyensec] provided a proof of concept that showed us how the attack can be executed.”
Trustgent verifies privately and displays publicly. The evidence vault holds the underlying artefacts, analytics screenshots, exported CSVs, dashboard read-only access tokens, audited reports. The public proof page surfaces only what the client has agreed to disclose: typically the metric, the window, and an anonymised reference to the engagement.
Every record carries its last-verified date so recency is visible on the page. Automated decay + renewal is designed but not yet live, the schedule (~24 months for L3 ratings, 18 for L4, 12 for L5) ships with the concierge intake documented on how we verify. Until then, records can be revised or retracted via the correction flow, nothing here is set-and-forget.
Every claim is checked against an independent public source outside the provider's control.
A real customer rates a specific engagement through a domain-matched magic-link.
A project scored against a versioned AI rubric, then signed off by a human reviewer.
A quantified baseline → after outcome, twice-attested and held in the evidence vault.
A free-plan provider at L5 always ranks above a paid-plan provider at L1. The gold bar is earned through evidence, never sold.
Read the methodology1 claim cross-referenced against 1 independent public source.
Per-source claims and check dates are listed below.