How We Verify
Every business listed here proved it controls the domain it claims. This page is the complete process — what is automated, what a person checks, and what the badge does and does not mean.
How a business gets verified
A business proves it controls the domain it claims, using one of two methods. Both require access that only the real operator has — knowing a company's name or having an email at their domain is not enough.
Method One: A DNS Record
We generate a unique token. The business adds it as a TXT record on the root of their domain. Changing DNS requires access to the registrar account, which sits behind the company's own security. We check the record from our servers and confirm it matches.
Method Two: A File On The Server
The same token, uploaded as a plain text file at /.well-known/privacytestlab-verify.txt. Publishing a file at a specific path means write access to the web server.
We deliberately do not follow redirects when fetching that file. A redirect could be pointed at an address inside our own network, which would turn a verification check into an attack against us. The file has to sit at the exact address.
One domain can only ever be claimed by one account. Once verified, that pairing is locked, so nobody can register a second profile impersonating a company already listed here.
What we check by hand
Domain proof tells us who someone is. It does not tell us whether the business is real. After the automatic check passes, a person reviews the application against these points:
Is the site live and working? A domain that returns errors or shows a parked page does not get listed.
Does it match the category chosen? A site claiming to be a VPN provider that turns out to be a link farm is rejected.
How old is the domain? We look up the registration date. A domain registered last week claiming to be an established provider gets closer scrutiny — not automatic rejection, but we look harder.
Is the contact email on the claimed domain? A business address on the company's own domain is a stronger signal than a free inbox. Neither is disqualifying by itself.
Does the description attack competitors? Business profiles describe your own product. Naming or disparaging others is grounds for rejection.
If any of these raise a question we cannot settle from the public site, we ask for something more — a company registration document or a matching company page elsewhere. When we do, we look at it, record the decision, and delete the file. We do not keep business identity documents on our servers.
Rejections always come with a specific written reason, sent by email. A rejected business can fix the issue and apply again.
What the badge means
The check mark next to a business name means one thing: we confirmed that account controls that domain. That is the whole claim. It is not a rating, score, or endorsement of the product. It is not a statement that the company is trustworthy, secure, or good at what it does. It changes nothing about where a business appears in a listing, or which reviews are shown and in what order.
The badge is free. It is granted the moment we confirm a business controls the domain it claims, and it changes nothing about ranking or visibility.
Businesses without one appear in the directory on identical terms, with the same ranking, the same reviews, and the same visibility. The only difference is the mark next to the name. It used to cost $2 a year; charging for it made the badge look like something that could be bought, so we stopped.
Before the year is up we re-run the domain check. If it fails, the badge moves to a holding state and we contact the business — the listing itself is never affected. If a domain changes hands, the new owner does not inherit the badge.
How listings are ordered
Category pages are sorted by rating average and review count. Visitors can re-sort by newest, most reviewed, or alphabetically. That is the complete list of inputs.
| Affects ranking | Does not affect ranking |
|---|---|
| Average rating from published reviews | Whether a business has a verified badge |
| Number of published reviews | Affiliate relationships of any kind |
| The sort option the visitor chose | How much traffic a business sends us |
| Whether a business has complained about a review |
There is no paid placement, no sponsored slot, and no arrangement under which a company can buy a position. If that ever changes, this page changes first and the change is labelled on the listing itself.
How reviews are handled
Who Can Write One
Any user account with a confirmed email. One review per person per business, enforced at the database level. Bursts of reviews on one business in a short window are held automatically for a human to read — that catches coordinated fake reviewing without making genuine reviewers wait.
What Happens When A Review Is Posted
It publishes immediately, unless an automatic check holds it for a person to read. Those checks look for links, contact details, spam phrasing, bursts of reviews on one business, and accounts posting unusually fast. Held reviews are read by a human, usually within a day.
We do not approve every review by hand before it appears. Doing that would make our availability the ceiling on how fast the site can work, and would leave people writing into a void.
What A Business Can And Cannot Do
Can: reply publicly to any review, and report a review that breaks our published rules.
Cannot: edit, hide, remove, or reorder a review — or have one taken down by paying, asking repeatedly, or threatening.
When a review is reported, it stays visible while we look at it. Hiding reviews on report would mean any business could bury criticism simply by objecting to it.
When We Remove A Review
We remove reviews that contain links or contact details, name individual employees, use abusive language, share private information, describe a different company, or show clear signs of not being a genuine customer experience. The author is emailed the specific reason and can rewrite the same complaint within the rules.
A negative review is not a reason for removal. Reviews are opinions about an experience, and a bad experience is a legitimate thing to write about.
Where our money comes from
Being straight about this matters more than it usually does, because we publish ratings of companies that would like to be rated well.
Reader support. Voluntary contributions through the Support Us page, from readers and from businesses. They buy nothing — no badge, no listing, no placement, no influence over moderation — and we would refuse one that came with a condition attached. Listed businesses pay us nothing for anything.
Affiliate links. Some articles elsewhere on this site contain affiliate links, which are labelled where they appear. Affiliate relationships have no effect on directory rankings, ratings, or review moderation. Directory listings and business profiles contain no affiliate links at all — outbound links from a business profile earn us nothing.
Advertising. Where present, ads are labelled and never placed to look like a listing or a review.
Nobody can pay to be listed, to be ranked higher, to have a review removed, or to have a competitor's rating changed.
When we get it wrong
We will make mistakes. A legitimate business will get rejected, or a review that should have stayed up will come down. When that happens, reply to the email we sent about the decision — every rejection and removal comes with one, and every decision is logged with a timestamp and the reason given.
If we reverse a decision, we reverse it. There is no penalty for pushing back on a call we made.
Common questions
Can I get listed without paying anything?
Yes, all of it. Applying, being verified, being listed, the verified badge, receiving reviews, and replying to them are free. There is nothing on this site a business can pay us for.
Why do you show reviews from people who deleted their accounts?
They appear as "Former member" with nothing linking back to the person. If deleting an account erased its reviews, a business could get bad reviews removed by pressuring reviewers into closing their accounts.
What stops a business from writing its own reviews?
Business accounts cannot post reviews at all. Beyond that, the one-review-per-business limit and burst detection on new reviews make coordinated fake reviewing expensive rather than free.
Do you check that a reviewer was really a customer?
We cannot verify purchases — we have no access to any company's customer records, and we would not want it. What we do is make fake reviewing costly, act on reports with evidence, and never hide the fact that this is a limitation.
Can I see what data you hold about a decision?
Every admin action on your account is logged. Ask and we will tell you what was recorded and when.