Anonymous verification — no account required
Verify a Trust Passport or MRCC
Public verify API — LIVE Q3 2026
When you verify a Trust Passport or MRCC, you confirm cryptographic signature validity and the readiness attestation issued by NexCyber at the time of assessment.
What verification tells you
| Field | What it means |
|---|
| Company / Product | Name and version of the assessed product |
| Regulation scope | Which EU regulations are covered (CRA / NIS2 / DORA / AI Act / RED) |
| Trust Level | L0–L5 — readiness maturity achieved at issuance |
| Issued date / Valid until | MRCC issuance and expiry dates |
| Signature status | Valid — cryptographic integrity confirmed · Invalid — document may have been altered |
Verification takes under 30 seconds. No login. No data stored.
Who uses Verify
- Procurement teams — confirm supplier compliance before contract award
- Marketplace operators — check vendor Trust Passport during onboarding
- Legal / compliance reviewers — validate regulatory posture claims in RFP responses
- Auditors — reference MRCC during due diligence
About the cryptographic signature
NexCyber MRCCs are signed with a dual-algorithm signature over a SHA-256 manifest hash:
- Ed25519 (RFC 8032) — elliptic curve digital signature (current standard)
- ML-DSA-65 (NIST FIPS 204) — post-quantum lattice signature
- SHA-256 manifest hash — content integrity binding
All three must be valid for verification to pass. Verification confirms the cryptographic integrity of the document and the readiness attestation issued by NexCyber at the time of assessment. If any document field is altered after issuance, the signature check fails.
Important notice. Verification confirms cryptographic integrity and the readiness attestation issued by NexCyber at the time of assessment. It does not constitute a declaration of conformity under any EU regulation, a notified body assessment, official regulatory certification, or a guarantee of compliance at the time of your review. For regulatory compliance decisions, consult the applicable market surveillance authority.