Certification Trust Center

A certificate only has meaning when its boundaries are clear.

A Vulneras certificate follows only from a complete assessment with a positive, reasoned and signed expert decision. It applies to the contractually defined scope and methodology version.

Plan an intake Verify a certificate

What it confirms

Demonstrable control within scope.

All six domains in the selected profile were assessed.
Conclusions include verifiable evidence references.
Scope, exclusions, findings and expert rationale were recorded.
The report is signed, immutable and protected by a report hash.

What it does not confirm

No guarantee and no brand endorsement.

That the full organisation or every OutSystems system was assessed.
That a security incident can never occur.
That OutSystems issued, approved or endorsed the certificate.
That payment or participation automatically leads to a positive outcome.

Current status

A public status with a fixed meaning.

Valid

Within the validity period and without a registered material change.

Suspended

Temporarily invalid until a change or incident has been reassessed.

Expired

The validity date has passed. The historical record remains verifiable.

Superseded

A subsequent certificate was issued following a new assessment.

Revoked

Permanently invalid with a recorded reason. Revocation is irreversible.

Duty to report

Material changes require a new judgement.

Material new applications, environments or integrations.
A change between O11 and ODC.
Significant changes to authorisation, data or privileged access.
Introduction of agents with production access or authority to act.
A serious security incident within the assessed scope.

Public verification shows only certificate ID, organisation, current status, issue date and validity date. Scope, scores, evidence and findings remain confidential.

Methodology Trust