Require an attestation you can verify yourself
You are assessing a supplier, an investment target or a bidder. What comes back is a hand-filled questionnaire nothing lets you cross-check. A StructureClerk attestation is verified at the source, free, with no account, and without going back through them.
What an attestation establishes: and what it does not
What it establishes
- That the document genuinely comes from StructureClerk and has not been altered since issuance.
- Its exact scope: what was assessed, and what was not.
- What the organization declared and, separately, what StructureClerk observed itself.
- Its issuance date and its validity date.
- Whether it has been revoked by its issuer since.
What it does not establish
- It is not a certification: no one has accredited us to issue one.
- It is not an audit: the questionnaire part is self-declared, completed by the organization itself.
- It is not legal advice, and it declares no compliance in law.
- The automated observation reads public pages only: it says nothing about internal systems.
Two things of a different nature, never mixed
Most vendor questionnaires treat what a company says about itself and what a third party observed as if they were the same. A StructureClerk attestation separates the two, and says so on the document.
Declared by the organization
The questionnaire answers, under a public methodology. The attestation states how many questions were answered out of how many, what was set aside and why, and whether the assessment was cut short. It is self-declared, and the document says so.
Observed by StructureClerk
An automated reading of the site's public pages, on a given date: how many pages were read, how many factual findings were recorded. Nobody typed them in. When there was no observation, the attestation says so instead of staying silent.
Two records, two questions
Point attestation
Answers "what did this organization assess, and what did it declare, on that date?" It carries a declared scope, an optional automated observation, and a validity date.
Continuous record
Answers "was this organization actually observed over the period, and what happened?" It counts observations, regressions and time to remediation, and cites the latest chain anchor. Nothing in it is declared.
It is refused, with the reasons, when the period has too few observations or a gap that is too long. A record of continuity is never issued over a hole.
The clause to paste into your documents
One line in a tender, a vendor questionnaire or a list of conditions precedent. It is written to be enforceable without involving us: you are asking for a verifiable document, not a contract with us.
The bidder shall provide a StructureClerk compliance attestation, publicly verifiable without an account at structureclerk.ca/verify, issued within the 12 months preceding the submission date. The attestation shall state its scope: the domains assessed, the share of the questionnaire actually answered, and any findings observed by StructureClerk on the bidder's public website, where applicable.
A starting formulation, to be adapted to your practice and reviewed by your legal advisers. StructureClerk does not provide legal advice.
Buyer questions
Does a StructureClerk attestation replace an ISO 27001 or SOC 2 certification?+
No, and it does not try to. A certification commits an accredited body that has audited the company; a StructureClerk attestation establishes what was assessed, when, and by what means, declaration or observation. Its value lies where a certification does not yet exist: with a smaller supplier, early in a relationship, or on subjects no certification covers.
How do I verify an attestation a supplier sent me?+
Enter its identifier at structureclerk.ca/verify. Verification is free and requires no account: that is deliberate, because proof whose access depends on the interested party is not proof. You will see the result, the exact scope, the validity date, and whether the document has been altered or revoked.
What is the difference between declared scope and observed scope?+
Declared scope comes from the organization's own answers to a questionnaire, under a public methodology, self-declared, with the value and limits that implies. Observed scope comes from an automated reading of its public website pages by StructureClerk: pages read, factual findings recorded, on a given date. Both appear on the attestation, in two separate blocks, and are never merged into a single statement.
My supplier has no attestation. What now?+
Send them structureclerk.ca/scan. The assessment is free with no credit card, and they can issue the attestation themselves at the end. You install nothing and pay nothing on your side, and you never enter the commercial relationship between them and us.