Black Llama Privacy-Ready badge
Privacy-Ready.Dated, scoped and checkable.
A badge is only worth the page it links to. One clean month earns Bronze; each consecutive clean month adds a tier, up to Platinum. Every badge names its date and scope, links to a public verify page, and lapses on its own if the scans stop.
First clean month
Two consecutive months
Three consecutive months
Four consecutive months
Privacy-Ready badges describe automated code scans for the stated period and scope. Not an audit, attestation or SOC 2 report; SOC 2 reports come only from licensed CPA firms.
The rules
Exactly what earns a tier, and what resets it.
No judgement calls and no points. A month is clean or it is not.
Bronze
One clean monthEvery scan in the month finishes with no open critical or serious findings, and the core policies (security, access control, incident response, change management) are on file and reviewed within 12 months.
You get
Badge, verification page, badge number, findings report grouped by privacy risk (with SOC 2 and ISO 27001 mapping as context).
Silver
Two consecutive clean monthsA second clean month directly after the first. Regressions are caught by the next scan and fixed inside the window.
You get
Silver plaque art, an updated live badge, and a longer evidence history on your verification page.
Gold
Three consecutive clean monthsA full quarter of unbroken, provenance-stamped scans. Each month’s engine stamp and rules hash are on record.
You get
Gold plaque art and a quarter of evidence an auditor can sample from.
Platinum
Four consecutive clean monthsFour months without a break, the longest streak Sentinel recognizes.
You get
The auditor evidence binder, and a physical Platinum plaque for the office wall.
Consecutive means consecutive
- Silver needs two clean months back to back; Gold three; Platinum four.
- Tiers stop at Platinum. After that you hold it by staying clean.
- A one-time Bronze Scan badge is valid for 3 months, then needs a new scan.
What resets the streak
- A month that closes with an open critical finding.
- You keep the tier you can still prove; the climb restarts from there.
- Badges you already earned stay valid for their validity period.
Platinum
What Platinum unlocks.
For your auditor
The evidence binder
Four consecutive months of stamped scan evidence, mapped to SOC 2 Trust Services criteria and ISO 27001 Annex A controls as context, packaged for a CPA firm to sample from when you start your SOC 2 audit.
- Each month’s engine stamp and rules hash
- Findings opened, fixed and verified, with dates
- Automated versus manual coverage, stated plainly
For your wall
The plaque
A physical Platinum plaque cast from the same plaque art as the badge, with your badge number engraved on it. The binder is evidence; the plaque is a reminder of the four months it took.
- Engraved with your BL-XXXX-XXXX number
- Ships with Platinum on the Path plan
The badge number
Every badge has a serial number you can check.
Type it into /verify and you get the public record: organization, tier, the period it covers, when it expires and the rules hash the scans used. Lowercase and missing dashes are fine. No code, findings or people are ever shown.
Embed it
Put the live badge on your site.
The badge image is generated from your current standing, so it updates on its own and shows a grey “not held” tile if you lapse. It must link to your verification page.
<a href="https://YOUR-DOMAIN/verify/<slug>">
<img src="https://YOUR-DOMAIN/badge/<slug>.svg"
alt="Black Llama Privacy-Ready badge" width="120">
</a>Replace <slug> with your organization slug. For example /badge/acme.svg linking to /verify/acme.
Usage rules
How to show it honestly.
These protect you and the people reading your site. A badge used to imply more than it means can be revoked.
The sentence you may use
Black Llama Privacy-Ready · <Tier> · scanned <YYYY-MM-DD> · scope: <repo>. An automated code scan found no leaks of the types Sentinel checks in this period. Not an audit, attestation or SOC 2 report.
Fill in the tier, the scan date and the scope exactly as they appear on your verify page. Don’t add to it.
Do
- Show the live badge image from /badge/<slug>.svg, linked to /verify/<slug>.
- Use the permitted sentence above, word for word, with your tier, date and scope filled in.
- Say “Black Llama Privacy-Ready badge, Gold” and show the period it covers.
- Say no leaks of the types Sentinel checks were found in the stated period.
- Say it helps you prepare for SOC 2.
- Include the badge in security questionnaires and sales decks alongside the verification link.
Don’t
- Call it a SOC 2 report, a SOC 2 audit, an ISO 27001 award or “compliance”.
- Crop, recolor, restyle or re-render the badge, or use the Black Llama mark without the badge.
- Display a tier you do not currently hold, or an expired badge.
- Use the AICPA SOC logo, ISO logos or any accreditation mark next to it.
- Say “audited”, “verified by auditors”, “leak-proof”, “100% secure” or “guaranteed private”.
- Call it GDPR, CCPA or HIPAA compliance.
Questions
About badges.
What counts as a clean month?
Every scan in the calendar month ends with no open critical or serious findings, and the core policy documents are on file. Warnings do not block a month; they are listed with fixes.
What resets my streak?
A month that closes with an open critical finding. You keep the tier you can still prove, and the climb restarts from there. Badges you earned stay valid for their validity period.
How do I read the badge number?
BL, then eight characters in two groups of four. They are random, carry a check character so typos are caught, and are never reused. Type one into /verify and you get the public record.
Can I put the badge on my site without linking it?
No. The badge must link to its verification page, show its tier and period, and never be described as SOC 2, ISO 27001 or an audit result.
