# Truth Signal

> Confidence, built on evidence. Is this business legit? One page per business, with a truth score out of 100, a legitimacy confidence and every reason cited to public evidence: the company register, reviews, domain history, email security, social profiles and breaches.

Reading a report is free, for a person or an AI agent, and so is asking for a check: there is no API and no key. Opening a page nobody has asked about queues its first look, limited per caller address; the page answers 200 at once while the check runs, with `Retry-After` saying when to ask again, its head marked noindex until the report exists; past the limit the answer is 429 with `Retry-After`. A business already assessed is shown as it stands: reading its page, or searching for it at https://truthsignal.com/business?domain={domain} (the search form's address), never starts a new check.

## Reading a report

- A business's page: https://truthsignal.com/business/{domain} (for example https://truthsignal.com/business/johnlewis.com).
- The same report as JSON: https://truthsignal.com/business/{domain}.json, or send `Accept: application/json` to the page's address.
- The same report in Markdown: https://truthsignal.com/business/{domain}/report.md (only what is already assessed, like `?check=no`), or send `Accept: text/markdown` to the page's address (the waits and answers below are the same; a status answer stays JSON). Every other page answers that header with its main content as Markdown.
- A business nobody has asked about yet is checked there and then: the request waits up to 30 seconds and usually answers with the report. If it is not ready by then the answer is 202 with `{"status": "pending", "retry_after_seconds": 30}`; ask again after that many seconds.
- A read that must not start a check: add `?check=no` to the JSON address. A business already assessed answers as above; one nobody has asked about answers 404 with `{"status": "unknown"}` and nothing is queued.
- A domain with no live website is never scored: a name that does not resolve, nothing answering, or a parked domain (a domain company's holding or for-sale page) answers 404 with `{"status": "no_website"}` or `{"status": "parked"}`. A request for such a domain a day or more later looks at it afresh.
- The page's head carries the same facts as a schema.org WebPage block (JSON-LD) whose `about` names the business with the facts the report holds (legal name, company number, address, telephone, email, its profile and register pages as sameAs), and a `rel="alternate"` link to the JSON.
- The page's HTML carries the whole report before any script runs: the score line, the Summary, the Positives, Be cautious and Not found points and the ten checks with their marks; a reader that does not run JavaScript sees the same report.
- Every assessed business is listed in https://truthsignal.com/sitemap.xml.

## The fields that matter

- `truth_score`: 0 to 100, the mean of six judgements made from the evidence.
- `purchase_confidence`: the legitimacy confidence, the band of that score, LOW, MEDIUM or HIGH (shown as "Legitimacy confidence"; the key kept its old name, and it is not customer satisfaction, which is `customer_satisfaction` below); a sure warning from the public record can hold it at MEDIUM or make it LOW whatever the score.
- `warning`: null, or the warning that holds the band: its `effect` ("be cautious" or "avoid"), the `fact` as the record names it (for example "Confirmation statement overdue") with its `value`, and its `source` (companies_house, opencorporates, safe_browsing or hibp).
- `customer_satisfaction`: null when too few reviews are known, or the customers' verdict from independent reviews alone, apart from the truth score: `answer` (0 to 1), `word` (mostly satisfied, mixed, mostly dissatisfied) and `reviews`, the platforms behind it with each rating and count (only platforms with 11 reviews or more count).
- `judgement.answers`: the six judgements, each 0 to 1: business legitimacy, established history, real customer evidence, independent reputation, identity consistency, purchase safety.
- `reasons` and `concerns`: what was found for and against, each naming its source.
- `breaches`: each known data breach of the company, newest first: `title`, `date`, `accounts` affected, `data` exposed, `about` (Have I Been Pwned's own summary, plain text, or null) and `url` (its page on Have I Been Pwned). For information only: the score never reads the summary. Breach data: Have I Been Pwned, CC BY 4.0.
- `summary`: the business's title, description, rating, review count, years in business (the company register's age, null when no company was matched), `domain_age` (the domain's age from its registration record), address and contact details, as found; `based` and `serves`, country codes for where it is based and which countries it serves, read from its own pages and the register (the signs are the last four rows of the Company details check in `points.registry`), null when unknown.
- `page`: what the page says in words, worked out once on the server: the check rows (`rows`: group, name, title, icon, finding, mark) and their `tally`, the held-band line (`held`), the Customer satisfaction rows (`satisfaction`), each opened row's found lines (`found`), the `sections` in plain words and, for a claimed business that provided details, `provided`: the sentences of the Summary's Provided by the business paragraph (the kinds it gave, never their values, then what Truth Signal confirmed). The page draws these and words nothing itself; the Markdown and the page's structured data read the same.
- `answer`: one sentence answering "is it legit?" in the reader's words, from the report's own figures: the score, the band (held, with the warning, when a sure warning holds it), how many checks came back clear, to be cautious about, not found or for information, the legitimacy confidence and the customers' word from the reviews (`customer_satisfaction`'s, or "not enough reviews to say"), so the qualifier travels with the answer; the first line of the page's Summary and of the Markdown. Null before the business is scored.
- `summary_text`: the report's summary as one plain-English paragraph, the same one the page shows.
- `context`: the fixed paragraph under every Summary: what a high and a low score mean (strong evidence of an established, legitimate business, not a promise that it is safe to buy from or that every purchase goes well; thin or concerning evidence, not that it is unsafe or a scam).
- `sections`: the page's Positives, Be cautious and Not found, in that order, each `[title, tone, points]` with every point's `text` and `source`.
- `missing`: the checks that could not be completed this time (a provider that did not answer, for example), so a gap is never read as a finding against the business.
- `claimed`: whether someone who controls the domain has claimed this business's page, by adding a DNS record we checked once; `claimed_at`, when (else null). It means control of the website, not who owns the company.
- `given_by_business` (only on a claimed page that has some): details the business that claimed the page gave us itself (phone, email only once Truth Signal has confirmed it with a link sent to it (email_confirmed_at), contact_page, company_number, registered_country, countries as ISO codes, socials, socials_confirmed naming the ones Truth Signal confirmed as the business's own; returns_days, return_postage, delivery_days in working days, payments, vat_number, founded). Not checked by Truth Signal, except a confirmed email, which Truth Signal checked and Jev reads as evidence; say the rest as the business's own words.
- `evidence`: which sources were checked, when, whether each read succeeded (`ok`), and its error if not.
- `citation`: how to cite the report (below).

## Connect it as a tool (MCP)

https://truthsignal.com/mcp speaks the Model Context Protocol over its Streamable HTTP transport, with no sign-in: add that address to ChatGPT, Claude or any assistant that takes a connector, and the assistant calls Truth Signal directly. Three tools: `check_business` takes a business's domain and answers the report's JSON with its `citation` block (a business nobody has asked about is checked there and then, as above; not ready in time is `{"status": "pending", "retry_after_seconds": 30}`); `search` and `fetch` are the two-tool shape some assistants ask for: `search` finds the report for the business named in a question, `fetch` reads it as Markdown. The same first look, limits and licence as the JSON.

## How the score is made

- The six questions (`judgement.answers`) are each answered 0 to 1 by a decision model from the evidence table alone: the facts our own checks read from public records, data services and the business's own pages (which pages it has, a phone it publishes, an email at its domain it confirmed to us); no model reads a page to judge it. The truth score is their mean, out of 100. `judgement.reason` is null when the model answered and names the failure when it could not; the model's name is not published.
- The bands: HIGH from 70, MEDIUM from 40, LOW below.
- The warning: only a measured fact can hold the band, one of: malware or phishing threat status; company status; company status detail; insolvency history; accounts overdue; confirmation statement overdue; registered office in dispute; known data breaches found; filing history consistent. When one is present the model is asked what a careful buyer should be told, "be cautious" or "avoid", and its answer holds the band only when it is at least 60% sure: "be cautious" holds HIGH at MEDIUM, "avoid" makes it LOW. A rating, however poor, is never a warning: complaints are not fraud.
- Customer satisfaction is judged from the review platforms alone, each weighed by the number of reviews behind it, so a small low-rated platform does not outweigh a large one. A platform with fewer than 11 reviews sends nothing.
- A `null` value on any row means not found or could not be read, never absent, and it never counts either way (a DKIM key is looked for under ten common selectors, so an unusual selector reads as null; a phone or email the pages do not state reads as null). A record we searched for and did not find is unknown too. What counts against a business is only what was measured: a company status, an overdue filing, a malware flag, a poor rating at scale.
- Eighteen sources behind ten checks: `evidence` and `collection` list every read, including the homepage read that feeds the website check, the Wikipedia read that joins the Internet Archive under how long it has been online and the Better Business Bureau read that joins Company details for a business based in or serving the US or Canada.
- Coverage: Companies House is the company register searched for every business, and OpenCorporates (other countries' registers) after it only where its key is configured. A business on a .uk address is searched at Companies House and shown when no company matches; a business on any other address is searched there too, but a miss is unknown, never held against it; a business known to be based outside the UK reads N/A on the Companies House and ICO registration rows inside Company details, whose own line then says where it is based and which countries it serves. Traffic is real Chrome users' visits (the Chrome UX Report) and Cloudflare Radar's popularity ranking, shown for information and never sent to the judgement.

## Limits and what we keep

- First looks: 20 per caller address per clock hour; ordinary reads have their own short burst limit; past either the answer is 429 with `Retry-After`. The address is kept as a hash for a day, then deleted.
- What we keep: the domain you ask about becomes a public page, with the public evidence about that business; nothing about the caller is kept beyond the hashed address above. Cloudflare, which serves the site, counts visits without cookies; we see totals, never individuals. Privacy and terms: https://truthsignal.com/privacy.

## Citing

The data is licensed CC BY 4.0: use it freely, and name Truth Signal as the source with a link to the report page. Every JSON answer carries a `citation` block with `source`, `url`, `assessed_at`, `licence` and a ready `cite_as` line of this shape: "Truth Signal, {name}: truth score {score} out of 100, legitimacy confidence {band}, assessed {date}, https://truthsignal.com/business/{domain}".

## More

- How the score is made: https://truthsignal.com/about
- How to know if a shopping site is legit: https://truthsignal.com/guides/how-to-know-if-a-shopping-site-is-legit
- How to tell if someone is scamming you online: https://truthsignal.com/guides/how-to-tell-if-someone-is-scamming-you-online
- Privacy and terms: https://truthsignal.com/privacy