Trust Registry publication terms
These terms apply when an enterprise allows Attestia to publish its verification results to Trust Registries. They add to the Attestia terms of service and the privacy notice, which continue to apply.
1. What you allow
By allowing publication, you (the Accountable Party) permit Attestia to send your current Attestia Token, your Verification Score and any change to their status to the Trust Registries Attestia has enabled for your country, so that terminating operators, messaging platforms and network API providers can check that your business and its assets are verified.
Publication is optional unless your Attestia agreement says otherwise. Without it, relying parties can still check your token and score through their own connection to Attestia.
2. What is published
- Your legal name, trading name, country and Attestia Identity ID.
- The verification result, its date, any conditions attached to it, and the next recertification date.
- Your verified assets: their names, types, channels (voice, video, messaging, network APIs) and identifiers, such as telephone numbers, sender IDs or RBM agent IDs.
- Your Verification Score: the level, number, evidence depth, the grade of each evidence area, the reason codes, the scoring policy used and how long the score is current.
- Status changes: when a token is suspended, revoked or replaced, or when you withdraw this permission.
Everything is signed by Attestia, so a registry can store and pass it on but cannot change it.
3. What is never published
Documents you provided, the evidence behind the checks, analyst notes, the names and contact details of your signatory and contact persons, billing information and anything else not listed in section 2.
4. Which registries
Attestia sends to Trust Registries operated within the GSMA Open Verifiable Communications framework, or recognised by a regulator or Trust Anchor in your country. The registries Attestia currently submits to are listed on the Attestia trust information page. A registry outside the data residency area of your Attestia account receives your score and status only, never your token.
Each registry operates under its own rules. It may keep what it receives and make it available to relying parties for the purpose of verifying communications. Attestia is responsible for what it sends; the registry operator is responsible for how it stores and uses it.
5. Keeping it current
While publication is allowed, Attestia sends every new token, every score change and every suspension or revocation as it happens, and checks daily that each registry holds the current versions.
6. Withdrawing permission
Your enterprise admin can withdraw permission at any time in the Attestia portal, on the Token & score tab. Attestia then stops sending anything new, cancels what is waiting to be sent, and tells every registry that received your data that you withdrew permission so it can remove your token and score. A registry may keep a record of past submissions where its rules or the law require it, for example for audit.
You can allow publication again at any time; Attestia then sends your current token and score.
7. Personal data
The published information is about your business. Where it includes personal data, for example the name of a sole trader, Attestia processes it as described in the privacy notice, to provide the verification service you asked for.
8. Changes to these terms
If these terms change, Attestia publishes a new version on this page and asks your enterprise admin to accept it in the portal. Until then, publication continues under the version you accepted. You can withdraw permission instead of accepting a new version.