The Nullware Standard0 trackers on this page
Membership · how reviews work

What happens, step by step.

A standard review takes two to four weeks from a complete application. Small businesses that are already clean take about one. The person who reviews you never makes the decision.

Take the self-checkApply to join
01Eight steps

Eight steps

From a five-minute self-check to a certificate that runs for 12 months.

01Self-checkFive minutes online. You see what to change before you apply.
02ApplyYour scope, your tools and a declaration signed by a director.
03ScansWe scan your site with and without consent, from more than one country.
04EvidenceScreenshots of your ad account and tool settings. Never passwords.
05CallAn hour with a reviewer. Grey areas are easier said out loud.
06RecommendationThe reviewer writes it down, clause by clause.
07DecisionMade by a different person. Certified, or not yet with a list of changes.
08CertifiedListed for 12 months, scanned weekly, then reviewed again.
Fast lane
About one week
For businesses with fewer than 50 staff, a clean first scan and no ad-account integrations. You send your scope, declaration, data map and privacy notice. No call unless something needs a question.
Scans
Every week, not once a year
Open-source scanners (Blacklight and Webbkoll) run on our own servers, on application and then weekly. With and without consent, from the UK and the EU, at random times. A failed scan opens a case. It never removes anyone by itself.
02Evidence

What we ask for

Evidence is screenshots or a screen-share. We never ask for passwords. Everything is deleted 90 days after the decision, except the declaration and the decision itself.

Item
What we need
Tier
Declaration
Signed by a director, naming your scope
Verified
Scope
Legal entity and company number; brands; domains; apps; countries; agencies and contractors
Verified
Data map
Every recipient of customer data: what it gets, why, its role, its country
Verified
Tools
Two lists: ad and tracking tools, and the systems you run the business on
Verified
Google Ads
Conversion actions; enhanced conversions setting; Customer Match lists, which must be empty
Verified
Meta
Events Manager showing no pixel or dataset receiving events; custom audiences, which must be empty
Verified
TikTok, LinkedIn, Microsoft
The same as Meta, for any account you hold
Verified
Shopify
Shopify Audiences off; data sharing off in the channel apps
Verified
Email and CRM
Audience syncs off; tracking settings
Verified
Contracts
Three processor contracts, chosen by the reviewer from your data map
Verified
Agents
Your written instruction to each agency or contractor
Verified
Privacy notice
The current version
Verified
AI
AI providers and account types; your staff AI-use policy
Verified
Pledge
The signed pledge; your retention schedule; screenshots of your cancellation flow
Pledged
Terms
Signed membership terms, including the audit right
Both
03Statuses

Five statuses, no surprises

Failed applications are never published. Every other status is, for a fixed time.

Status
Meaning
On the register
For how long
Certified
Meets the Standard version shown, until the date shown.
Yes
Until expiry
Lapsed
Missed the annual review. Happens automatically.
Yes, no reason given
12 months
Left
Left by choice. No stigma.
Yes
12 months
Suspended
A serious concern is being looked into. The badge comes down meanwhile.
Yes, no reason until decided
Until the case closes
Removed
A breach found after notice, a chance to fix it and an appeal.
Yes, with the clause and one line of reason, plus the member’s reply if they want it
24 months
04Due process

Before anything is published

Every removal passes these seven steps. The member hears from us first, always.

01
Triage
Within five working days. A report goes forward only if it is specific and checkable.
02
Notice
The member gets the evidence and the clause numbers.
03
Cure
30 days to fix it. A deliberate or hidden breach of the core rule gets no cure period.
04
Reply
The member answers in writing before anything is decided.
05
Decision
Made by someone other than the person who looked into it.
06
Appeal
Within 14 days, heard by someone who took no part in the decision.
07
Publication
Only once the appeal window has closed or the appeal is decided.
05

Reporting a concern

Anyone can report
With or without proof. Checking is our job. You hear the outcome, not the details.
Staff and agencies
A confidential channel for employees and agency staff. They are the only people who can see uploads made from a server.
Protected both ways
We never tell a member who reported them. Reports made to harm a competitor are closed, and the reporter can’t report again.

Report a concern: hello@nullwareproject.org, or the link on any member’s record.

Know where you stand before you apply.

About five minutes, only the questions that apply to you, and a list of anything to change.

Take the self-checkApply to join