Trust & Attestations

A clean pentest is worth more when you can prove it. When a scan comes back with no Critical, High, or Medium-severity findings, NexusVoid issues a verifiable VAPT Attestation, and lets you publish it as a public trust page and an embeddable security badge for your website.

It is the fastest way to answer "is your product secure?" for customers, partners, and auditors, without emailing PDFs.

What Gets Issued

When a completed scan is clean, we automatically create an attestation containing:

• Your organization or domain
• The result: 0 Critical, 0 High, 0 Medium
• The scope and targets that were assessed
• The standards followed (OWASP Web/API Top 10, MITRE ATT&CK, CWE / CVSS v3.1)
• The assessment date and validity window
• A unique Verification ID (for example NV-ATT-...)

Attestations are per-domain: when you re-scan the same domain, the existing attestation updates in place, so any badge or trust link you have already shared keeps working and simply reflects your latest result.

What Counts as "Clean"

The clean gate looks only at findings that still require action:

• Open findings of Critical, High, or Medium severity block an attestation.
• Resolved findings (fixed and verified on re-scan) do not count.
• Accepted-risk / by-design items do not count; they are documented separately with your justification.
• Low and Informational findings do not block an attestation.

So the path to an attestation is simple: fix the issues that matter, mark the intentional ones as accepted risk, and re-scan.

Publish Your Trust Page

From Dashboard → Trust & Badges, each issued attestation has a Make public toggle. Publishing gives you:

• A public trust page at https://vapt.nexusvoidai.com/trust/<your-slug>, a clean, shareable page showing your verified result, scope, assessment coverage, and the compliance frameworks your report maps to.
• An embeddable badge, a lightweight SVG served at https://vapt.nexusvoidai.com/api/trust/badge/<your-slug>.svg.

Attestations are private by default. Nothing is publicly visible until you choose to publish.

Embed the Badge on Your Site

In Dashboard → Trust & Badges, copy the ready-made snippet and paste it into your site's footer, security page, or marketing pages:

<a href="https://vapt.nexusvoidai.com/trust/your-slug">
  <img src="https://vapt.nexusvoidai.com/api/trust/badge/your-slug.svg"
       alt="Security Verified by NexusVoid" height="44">
</a>

The badge reads "Security Verified - NexusVoid - 0 Crit/High/Med" and links back to your trust page.

Verify Authenticity

Every attestation is independently verifiable via its Verification ID at:

https://vapt.nexusvoidai.com/trust/verify/<verification-id>

This returns the attested facts, namely the organization, result, scope, dates, and issuer, so a third party can confirm a badge or certificate is genuine and was issued by NexusVoid.

Download the Certificate

A branded, one-page VAPT Attestation Certificate is available from the dashboard (Trust & Badges, and on the scan's detail page). It is suitable for sharing directly with a customer or attaching to a security questionnaire. For private attestations, only the account owner can download it.

Why It Matters

• Shorten security reviews by handing prospects a link instead of a back-and-forth questionnaire.
• Build buyer confidence, since a verifiable badge signals a real, recent assessment.
• Keep it current, because re-scanning after each release updates your published proof automatically.

Running a full compliance program, not just a pentest? Aegis provides a complete GRC trust center with frameworks, evidence, and questionnaire automation. A VAPT attestation is a great signal to feature alongside it.

Related

• Getting Started to run the scan that issues your attestation.
• Capabilities for what the assessment covers and how findings are validated.
• Aegis to turn your VAPT into full SOC 2 / ISO 27001 audit evidence.