Trust Badges
Bronze, Silver, and Gold Trust Badges are visible signals tied to live verification in the Public Business Trust Registry. Trust should be verifiable.
Bronze is Baseline Readiness. Silver is Evidence-Verified Implementation. Gold is Ongoing Verified Readiness.
Know → Show → Maintain
Baseline Readiness
Bronze is Baseline Readiness: the starting Trust Badge after the credentialing pathway and Legacy Core review.
The business completed Legacy Core's baseline credential requirements, passed review, and is listed in the Public Business Trust Registry. Bronze does not claim that every control has been technically verified.
Evidence-Verified Implementation
Silver is Evidence-Verified Implementation: documented implementation reviewed under the applicable Legacy Core credential standard.
Silver is earned when documented implementation evidence has been reviewed. Silver cannot be earned through self-attestation. Alliance Partners may support evidence. Qualified external reviewers may evaluate evidence when appointed. Legacy Core retains the credential decision.
Ongoing Verified Readiness
Gold is Ongoing Verified Readiness: continued cybersecurity readiness demonstrated over time under the applicable Legacy Core credential standard.
Gold is the highest published Trust Badge tier. It recognizes continued readiness demonstrated over time. Gold cannot be earned through self-attestation.
Why it matters
Customers, lenders, insurers, and partners may ask for proof, not promises. A Legacy Core Trust Badge links to live verification in the Public Business Trust Registry. That record can help demonstrate documented readiness. It does not guarantee a contract, coverage, or compliance.
Customer and client questions
Customers may ask how you protect their data. A live registry record is something they can check.
Insurance conversations
Brokers and carriers can ask about cybersecurity practices. A credential can help demonstrate documented readiness. It does not guarantee coverage or lower premiums.
Vendor and partner reviews
Partners may ask for a record they can check before sharing work or data.
Contracts and opportunities
A security question can show up in a proposal or intake form. The credential provides a record they can check. It does not guarantee a contract.
What it means and what it does not
A reviewed credential, not a marketing claim. Human-reviewed readiness with live verification in the registry.
The Trust Badge means
Bronze: Baseline Readiness
Complete the credentialing pathway, meet Bronze requirements, and pass Legacy Core review. The free Trust Audit does not issue this badge.
Silver: Evidence-Verified Implementation
Requires documented implementation and review. Alliance Partners may help. Legacy Core retains the credential decision. Cannot be self-declared or purchased as an upgrade.
Gold: Ongoing Verified Readiness
Recognizes continued readiness over time. Requires evidence and review. Cannot be self-declared or purchased as an upgrade.
The Trust Badge does not mean
Not a government credential
Legacy Core is a private credentialing authority, not a regulator. The badge is not a license, permit, or government endorsement.
Not a guarantee of any outcome
The badge demonstrates commitment to readiness; it does not promise the absence of risk or any particular incident outcome.
Not transferable
The credential belongs to the credentialed business. It cannot be assigned to subsidiaries, affiliates, or successor entities without re-credentialing.
Not managed cybersecurity
Legacy Core is a credentialing authority. It does not sell MSP, MSSP, or monitoring services. Implementation stays with providers the business chooses.
Not issued by a purchase
Buying software, monitoring, or an Alliance Partner package does not issue a Trust Badge. Legacy Core reviews whether credential requirements have been met.
Bronze. Silver. Gold.
Bronze is the starting credential after pathway and review. Silver and Gold are earned outcomes. Silver and Gold cannot be earned through self-attestation.
Know → Show → Maintain
Baseline Readiness
Know it. Document it. Own it.
Bronze is Baseline Readiness: the starting Trust Badge after the credentialing pathway and Legacy Core review.
Start here
↓
Credentialing pathway
Enter the credentialing pathway, complete the required credentialing areas, and undergo Legacy Core review. A Trust Badge is issued only after approval.
Evidence-Verified Implementation
Show it.
Silver is Evidence-Verified Implementation: documented implementation reviewed under the applicable Legacy Core credential standard.
Cannot be earned through self-attestation
↓
Alliance Partner-supported pathway
Alliance Partners may help implement cybersecurity improvements and submit evidence-backed attestations. A partner reviewing work it implemented is not an independent review. Payment or partner membership does not guarantee approval. Legacy Core determines whether Silver has been earned.
External review, when appointed
Qualified external reviewers may evaluate evidence within their competence when appointed for that scope. Those relationships are being established. Self-attestation is never accepted.
Ongoing Verified Readiness
Maintain it.
Gold is Ongoing Verified Readiness: continued cybersecurity readiness demonstrated over time under the applicable Legacy Core credential standard.
Cannot be earned through self-attestation
Alliance Partner-supported pathway
Alliance Partners may help implement additional protections and submit evidence-backed attestations. A partner reviewing work it implemented is not an independent review. Payment or partner membership does not guarantee approval. Legacy Core determines whether Gold has been earned.
External review, when appointed
Qualified external reviewers may evaluate evidence within their competence when appointed for that scope. Those relationships are being established. Self-attestation is never accepted.
Display guidance
Wherever the badge appears, it must link to your verification URL. That live link is what makes the credential trustworthy.
Do
Do not
Verification link behavior
Every credential has a verification URL at /verify/<credential-ID>. The page returns one of three public-facing states in real time: Verified, Expired, or Not Found.
See a verification pageMisuse and revocation
Reports of badge misuse (display after expiration, display of a tier the business has not earned, modified artwork, or impersonation of a credentialed business) are investigated by Legacy Core. Confirmed misuse results in credential revocation. Public verification then returns Expired so reviewers see an accurate status.
Report suspected misuse: verify@legacycore.com
That the business has progressed through Legacy Core’s structured credentialing pathway at the displayed tier and is listed in the Public Business Trust Registry. Legacy Core Trust Badges are visible signals of progress with live verification, not a claim of legal compliance.
Silver and Gold cannot be earned through self-attestation. Alliance Partners may help implement improvements and submit supporting evidence. A partner reviewing work it implemented is not an independent review. Qualified external reviewers may evaluate evidence when appointed. Those relationships are being established. Buying implementation work does not issue the badge. Staying listed on the registry is $199/year or $19/month.
No. Legacy Core does not require businesses to purchase cybersecurity implementation services or a specific security product to earn a credential. You may work with qualified providers of your choice. Legacy Core determines whether the credential requirements have been met.
Every credentialed business receives a verification URL of the form /verify/[credential-ID]. Wrap the badge image in a link pointing to that URL. The page returns one of three public-facing states: Verified, Expired, or Not Found.
Suspected misuse can be reported to verify@legacycore.com. Legacy Core investigates each report, contacts the business, and may revoke the credential where misuse is confirmed. A revoked credential is not shown as a live verified listing.
No. The badge must be removed from all displays when the credential expires, lapses, or is revoked. Continued display is a misuse and can result in revocation.
Protect what you built. Display your Trust Badge and link it to the Public Business Trust Registry.