How we review
Three stages. The first runs automatically in seconds; a human does the second and third. Only tools that pass all three carry the badge.
Stage 0 – automated, instant
| HTTP reachability and status code |
| TLS certificate validity |
| Redirects to a parked or unrelated domain |
| Domain age and registrar via RDAP |
| Security check against known malicious sites |
| Duplicate check against existing listings |
| Presence of a legal notice (imprint) and privacy policy |
Stage 1 – editorial, by hand
| We create an account and use the tool |
| We check whether the core promise actually works, e.g. that a usable deck comes out of a prompt or document |
| Three screenshots from the running app |
| Prices checked against the pricing page and recorded with a date |
| Operator identified via legal notice and company registry |
| Ownership verification checked |
Stage 2 – privacy check
| Data processing agreement (DPA) available and accessible? |
| Server location disclosed? |
| Sub-processors listed publicly? |
| Is customer data used for training by default – and on which plans can you opt out? |
| EU representative appointed under Art. 27 GDPR? |
| Standard Contractual Clauses (SCCs) for transfers outside the EU? |
| Deletion periods documented? |
| Independent certification (ISO 27001, SOC 2)? |
Ownership verification
So nobody can list or change someone else's tool, any one of these three methods is enough:
| Method | What to do |
|---|---|
| DNS TXT | Add a TXT record aipptxmaker-verify=<token> to your domain. We read it via DNS-over-HTTPS. |
| Reply from a mailbox on the tool's domain. | |
| Backlink | Link to your submission link from a page on your website. |
Reminders after 3 and 7 days, canceled after 14 days. For paid tiers, a canceled submission is refunded.
The states a submission goes through
You see the same state in the vendor area that we see internally.
| State | Meaning |
|---|---|
| Draft | Received, not yet passed on. |
| Automatically rejected | Failed the automated pre-check. No payment taken; one free second attempt is possible. |
| Payment pending | Waiting for payment of the selected tier. |
| Ownership verification pending | Waiting for ownership verification. |
| In review | With the editorial team. |
| Changes required | We need something from you; the details are in the email. |
| Approved | Review complete, publication pending. |
| Published | Live. Re-review in 180 days. |
| Expired | Featured placement has ended. The verified listing itself stays. |
| Removed | Removed from the directory, with a reason and seven days' notice. |
Four levels, four meanings
| Level | What's behind it | What it doesn't include |
|---|---|---|
| Listed | Added by us from public sources: name, URL, category, short description. | Everything else. |
| Established | In addition: established in the market; its existence and relevance are beyond question. | Rating, GDPR check, documented prices. |
| Documents reviewed | We read the published documents (DPA, privacy policy, sub-processor list, legal notice, pricing page) and recorded every answer with source and date. That makes up the full GDPR check. | No rating. Nobody has used the tool. |
| ✓ Verified | In addition: a human created an account, used the tool, took screenshots, and rated it on six criteria. Only this level carries the badge. | – |
Why the third level exists at all: you can read a data processing agreement, but you can't read ease of use. Lumping both together would mean either holding back a GDPR check we can deliver, or claiming a rating we haven't backed up. So we keep them separate.
What the badge is not
It is not a certification, not a security audit, and not legal advice. It means a human used this tool on this date and recorded what they found. We don't claim more than that; see our Disclaimer.