What we verify
- Registered identity. The legal entity, registration number, and jurisdiction must be supported by official registration documents and matched to the relevant government registry. If we cannot substantiate the record, we do not approve the application.
- At least six months registered. Six calendar months must have elapsed since the legal registration date. This checks registration age, not six months of continuous trading or the age of the website.
- Current registration. The official record must show an active registration where that status is available.
- Authorized representative. The applicant must establish authority through registration records or supporting evidence of appointment or authorization.
- Website connection. A domain TXT challenge confirms website control. We also review the connection between the trading name, website, and registered entity.
- Contact information. The business must provide a working, identifiable contact channel associated with its website.
How a decision is made
Applications are reviewed by an authorized reviewer. Uploading a document or paying a fee cannot approve an application. Reviewers record the source, checks, date and decision. We may request more information or decline an application when evidence is insufficient.
What appears publicly
The business profile shows selected registration facts, verification status, verification date, expiry date and significant status changes. Registration numbers, uploaded documents, account details and private review notes are not published.
Country labels
Verified Business badges may include “Registered in the United States” or “Registered in Canada” when an authorized reviewer confirms that country from registration evidence and the official registry. These are included variants of the same verification, using the same requirements and live record. Country labels do not establish domestic ownership, local manufacturing, or that all operations take place in that country. An unconfirmed country retains the standard badge. Expiry or withdrawal removes the country verification claim along with the badge status.
Renewal and withdrawal
Verification expires one year after approval. A business must provide current evidence for renewal. Material changes to legal identity, website ownership or registration status require a new review. Verification can be withdrawn if requirements cease to be met or evidence is materially false.
Live badges use the current record and cease to claim verification when the record expires or is withdrawn. Copied images may be out of date; always open the badge link and check the domain and dates.
Reviews are a separate signal
Customer reviews describe individual experiences. Community reviews are labeled as purchase-unverified unless a separate substantiated purchase check has occurred. Verification does not improve a review score. Business owners cannot review their own business or pay to remove legitimate criticism.
Related businesses
Where a business shares ownership with LumaTrust, that relationship is disclosed on its public profile. The same requirements apply. Verification of a related business must not be described as an independent third-party endorsement.
Limits of verification
The badge confirms the checks above at the time of review. It does not guarantee a purchase, certify product quality, establish financial solvency, or provide a security audit, insurance, regulatory approval or buyer protection.
Start your applicationAdditional badge standards
All additional badge assessments listed below are included in the $149/year Business plan when approved. Each requires its own evidence, reviewer decision, public scope and expiry. Standard version 2026-09-credentials-v3.
Identity Verified
Required evidence. Current government-issued identity evidence, authority to represent the business, and an authoritative verification source.
Reassessment. Rechecked annually or when the identity or representative changes.
What it does not mean. Confirms the reviewed representative’s identity and business connection. It is not a background check or a guarantee of conduct.
Secure Business
Required evidence. A current security assessment naming the website, systems and controls reviewed, with evidence from the assessor or authoritative source.
Reassessment. Rechecked annually or sooner when the assessment expires or the reviewed systems materially change.
What it does not mean. Records a defined security review. It is not a promise that a system is vulnerability-free or that an incident cannot occur.
Privacy Protected
Required evidence. The current public privacy notice, data-handling scope and supporting control evidence for the named website and business.
Reassessment. Rechecked annually or when material data practices change.
What it does not mean. Records the reviewed privacy scope and evidence. It is not a government endorsement or a guarantee against misuse or breach.
Trusted Seller
Required evidence. A complete recent 90-day record with at least 10 genuine transactions and at least 90% meeting the published satisfactory-outcome criteria.
Reassessment. Reassessed every 90 days. The evidence period must end within seven days of review.
What it does not mean. Describes the reviewed period and outcome measure. It does not guarantee a future purchase or establish product quality.
Top Rated Business
Required evidence. A complete recent 90-day period with at least 10 eligible ratings and an average of at least 4.5 out of 5.
Reassessment. Reassessed every 90 days. The evidence period must end within 30 days of review.
What it does not mean. Confirms the recorded rating for the reviewed source and period. It does not authenticate every purchase or predict future experiences.
Women-Owned Business
Required evidence. Current ownership and control evidence under the named program criteria, matched to the verified business.
Reassessment. Rechecked annually and whenever ownership or control changes.
What it does not mean. This is a Lumatrust evidence review, not a government or supplier-diversity certification unless the named source independently provides one.
Minority-Owned Business
Required evidence. Current ownership and control evidence under the named program criteria, matched to the verified business.
Reassessment. Rechecked annually and whenever ownership or control changes.
What it does not mean. This is a Lumatrust evidence review, not a government or supplier-diversity certification unless the named source independently provides one.
HIPAA Compliance Review
Required evidence. A current risk assessment and supporting policies, safeguards and remediation evidence for the named systems, locations and activities.
Reassessment. Rechecked annually or when the reviewed scope or evidence materially changes.
What it does not mean. HHS does not certify HIPAA compliance. This badge records a Lumatrust review of defined evidence and does not remove continuing legal obligations.
HITRUST Certification Review
Required evidence. The current certificate, assessed system, certification level, issuing record and validity dates.
Reassessment. Rechecked annually or when the underlying certification expires, whichever comes first.
What it does not mean. Lumatrust does not issue HITRUST certifications, and this is not an official HITRUST certification mark.
Registration-country badges
Certified US Business and Certified Canadian Business are registration-country versions of Verified Business rather than separate credentials. The appropriate version is issued automatically when the reviewer confirms the registration country from the official record. It does not establish domestic ownership, local manufacturing or that every operation occurs in that country.
Review, publication and renewal
An authorized reviewer must confirm the business identity, evidence source, scope and dates. Documents, source URLs and private notes are not published. Only approved scope, issuer, review date and expiry are public. Payment and automated document analysis cannot award these badges.
Every additional badge requires current business verification and an active Business plan. It stops claiming verification at evidence expiry, badge expiry or withdrawal, or when the underlying business verification stops being current. Submitting reassessment pauses the previous claim until approval. Report material changes promptly.
Apply for an additional badge