An insurer, a client or an assessor may ask how you watch your domains. From the Solo plan (or on the Free plan, for one domain and 30 days, with a one-off report), Perimetry Cloud issues an attestation: a dated, two-page PDF of what the monitoring saw over a period, with an address and a QR code where anyone can check that it is genuine and still valid.

Issue an attestation

Open the page of a proved domain and find Attestation for an insurer or an assessor.
Choose the period: the last 30, 90 or 180 days, or the last 12 months, within the history your plan keeps.
Name who it is for, if you wish (an insurer, your board, a client); it is printed on it.
Choose its language: English, French or German.
Press Issue the attestation. It appears in the Issued list, with its PDF and its verification page.

Owners, admins and members can issue attestations; viewers cannot. A workspace can issue up to twenty a day.

What it states

For the chosen period:

how the ownership of the domain is proved, and since when;
since when and how often the domain is audited, the number of audits and the longest time without one;
the score at the time of issue, its average, lowest and highest values, and its trend;
the open findings by severity, and the critical and high ones with the date they first appeared;
the findings fixed during the period, and the median time to fix by severity;
the accepted risks;
e-mail protection (SPF and the DMARC policy), availability, and the date until which the domain is paid;
for each of the ten NIS2 Article 21(2) measures: nothing found from the outside, open findings, or not assessable from the outside.

It is an outside view of what is exposed: not a certification, not a penetration test and not proof of compliance, and it says so.

How it is checked

The content is frozen when the attestation is issued, with its SHA-256 digest printed on the PDF. Its verification page (the address and the QR code on the PDF) says whether it is:

genuine and valid, with its full content;
expired: attestations are valid for 90 days, after which a recent one should be asked for;
revoked by its issuer, with the reason if one was given;
withdrawn: the account that asked for it was closed or suspended.

Anyone can compare the copy they were given with the content and the digest shown there. The page is not indexed by search engines.

Revoke an attestation

Owners and admins can revoke an attestation from the Issued list, with an optional reason. Its verification page then says so, and its PDF is no longer served. Attestations are included in the export of your workspace’s data.