Trust & Transparency

Citatio's product is trust in data. This page explains, in full detail, what we guarantee, how we prove it cryptographically, and how you can check us independently. The formulas behind every number are documented on the Methodology & KPIs page.

Our principles

Cryptographic attestations

Since August 2026, everything we publish is cryptographically tamper-evident. Three kinds of commitments are created and signed with Citatio's Ed25519 key:

Every night, all new commitments are combined into a Merkle tree and the tree's root is written to Sigstore Rekor, a public, append-only transparency log operated independently of Citatio. Once a root is in the log, neither we nor anyone else can silently rewrite the records beneath it: any alteration breaks the signature and the inclusion proof.

What this guarantees, and what it does not

Guaranteed: every displayed quote is exactly what Citatio recorded at the source, unchanged since it was committed and anchored. Every statistic is computed from a fixed, committed set of observations. Published pages have not been silently edited after the fact.

Not claimed: a signature from Citatio does not mean the source platform endorses the review, and it cannot prove who originally wrote it. Only the source platform could attest that, which is why every quote links to the original where you can read it in context. For reviews collected before August 2026, the crawl date inside the record is asserted from our database rather than independently anchored; from August 2026 onward, observations are anchored the same night they are made.

Verify it yourself

  1. Fetch our public key from /.well-known/citatio-signing.json.
  2. Open a quote's proof page (linked as "verify" wherever proofs are surfaced). It shows the canonical record, its SHA-256 hash, the Ed25519 signature, the Merkle path and the anchored root, and it re-runs the checks live on every request.
  3. Recompute independently: hash the canonical record, verify the signature against the public key, fold the hash through the Merkle path (sorted-pair SHA-256) and compare the result to the root recorded in the Rekor public log. No Citatio infrastructure is needed for this step.

Our guarantee

If you find a quote on this site that does not match its original source, a statistic that cannot be reproduced from the committed inputs under the published methodology, or a page altered after publication without a new version and date, report it to hello@citatio.ai. We investigate every report, correct errors visibly (corrections produce a new committed dataset version, never a silent edit), and publish the outcome.

Independence

Citatio is operated by Gipfel Marketing AG, Schwyz, Switzerland. Some companies covered on this site are our customers. Customer status changes what a company can see (their own dashboards and full-text tools), never what the public pages say: the same collection rules, formulas, floors and award gates apply to customers and non-customers alike, and the attestation system above makes that checkable from outside.