Methodology · v1.2 · updated 7 September 2026

Every line has a source. This is how each one is produced.

A SafeToPay report compares what a website says with what public registers record, and shows both. This page sets out exactly what we read, how we compare it, how a verdict and a Record strength score are decided, and where the method stops. It is written for the person who received a report and wants to know how it was made — including business owners.

In one sentence

We identify the legal entity behind a website, read its public record, extract the claims the website makes about itself, put the two side by side, and give you a verdict with the evidence attached — and with the time each source was read.

What a report is not. It is not an opinion, a rating, a scam list or a recommendation. Every line is either a fact from a named public source or a comparison between two such facts. A business can add context to a report; it cannot change a fact, a date or a verdict.

The four steps

  1. 1

    Identify the legal entity

    We look for a company number on the website first. If there isn’t one, we use the VAT number, the postcodes on the site, the legal names the website itself mentions, the name on the business’s Google listing and the domain registrant, and search Companies House for a match. A match is accepted only on a close name, or a plausible name confirmed by the exact postcode shown on the site. If no match reaches that threshold, the report says No UK company identified. We never guess.

  2. 2

    Read the official record

    With the company identified, we pull its Companies House profile, filing history, Gazette and insolvency notices, officers and their other appointments, the disqualified directors register, persons with significant control, charges and the latest accounts; check the VAT number with HMRC; read the domain’s registration record from Nominet (or RDAP for non-UK domains); look up the site’s history in the Internet Archive; read the domain’s email security records from DNS; and look for reviews on the public platforms. Each source is listed below, with what we take from it.

  3. 3

    Read the website

    We fetch the home page, about, contact, services and terms pages, and extract the statements a business makes about itself: years trading, staff numbers, “our own workshop” or factory, number of projects completed, trade scheme logos, guarantees and insurance, contact details and the type of map link. An AI model is used for one task only — to find those statements and quote them verbatim with the page they came from. It does not compare, score or decide anything; a rule-based extractor runs alongside it as a fallback.

  4. 4

    Compare, decide, explain

    Each claim is tested against the register using the fixed rules below and weighted as hard or soft. The facts and discrepancies decide the verdict and the Record strength score, select the deposit guidance for the trade and pick the three questions. The summary is assembled from those facts; nothing in it is written freehand. The score, the guidance and the read time of every source are stored with the report, so a report never changes retroactively when the rules change.

Sources

What we read, what we take from it, and what happens if the source does not answer. The report’s footer lists every source with a link and the time it was read.

SourceWhat we takeFreshnessIf unavailable
Companies House
Open Government Licence v3
Legal name, number, status, type, incorporation date, previous names, registered address and how many companies share it, SIC codes, accounts type and due dates, confirmation statement, Gazette notices (voluntary and compulsory strike-off), winding-up petitions and insolvency cases, officers and their other appointments, the disqualified directors register, persons with significant control, charges with lender and date, changes in the last 90 days, and the latest accounts in iXBRL — current year and prior-year comparativesUpdated within 24 h of a filingReport marked incomplete; verdict capped at amber
HMRC VAT checkerWhether the VAT number on the site is on the register, and the name it is registered toLiveRow shows “Could not be checked”
Nominet / RDAPDomain creation date, registrant name and type, registrar, whether the domain was re-registered after lapsingLiveDomain age shown as “Not published”
Internet ArchiveFirst capture of the site, number of distinct months captured, most recent captureDepends on capture frequencyRow shows “Could not be checked”; treated neutrally
DNSWhether the domain receives email, through which provider, and whether SPF and DMARC policies existLiveRow not shown
Google Business ProfileReview count, rating, listed address and whether it matches the website or the register, dates of the sampled reviewsLive; Google returns a sample of five reviews, so “oldest review” is indicativeRow shows “Could not be checked”; no penalty applied
Trustpilot, Houzz, CheckatradeReview counts where the platform allows automated reads or the website links to its own profileLive; Trustpilot currently blocks automated readsRow shows which platform blocked the check; no penalty applied
Google Ads Transparency Center (full report)The legal name and country of registration of the advertiser whose adverts send people to the website, how many adverts, since whenLiveRow not shown
The website itselfClaims, contact details, scheme logos, tracking tags, template leaks, image characteristicsAt the time of the checkReport marked incomplete; verdict capped at amber

Trade-scheme registers (Gas Safe, NICEIC, FENSA, TrustMark, MCS), the Meta Ad Library and copied-content checks are not yet live. The report shows nothing for them rather than a placeholder.

Claim comparisons

These are the tests we run between the website and the register. A discrepancy is only recorded where both sides are known; a missing fact is never treated as a contradiction. Each discrepancy is weighted hard — the register contradicts the website and no innocent explanation is likely — or soft — “worth asking”, because a genuine firm can explain it in a sentence.

Website saysRegister showsWeight
“N years” trading, established, foundedCompany incorporated fewer than N years agoHard when the company is under 3 years old and the claim is at least double its age. Soft when the domain or archive is 2+ years older than the company (it may have traded before incorporating), when the company is 10+ years old, or when domain history could not be read.
Staff of 5 or moreLatest accounts report 2 employees or fewerHard when 10+ are claimed; otherwise soft
Own workshop, factory, manufacture, handmadeNo manufacturing SIC code (16, 25, 31, 32) registeredSoft — SIC codes are self-declared and often generic
100+ projects completedCompany under 3 years oldHard
VAT number shownNot on HMRC’s register, or registered to a different nameHard — a VAT number either belongs to this company or it does not
Company number shownNumber matches / does not match the identified companyConfirmation or hard discrepancy

The free report shows the first discrepancy in full. The full report shows all of them, each with the website’s wording and the register’s fact side by side.

Record strength: the points behind every verdict

Every report carries a Record strength score from 0 to 100. It is not a rating of the business; it measures how much verifiable public record exists and how consistent it is. The points are fixed and shown in the report, so you can see exactly why a company landed where it did.

ItemPointsSource
UK company identified behind the website+25Companies House
Company age: 10+ years / 3+ years / 1+ year+20 / +12 / +5Companies House
Accounts filed on time+10Companies House
Public reviews: 100+ / 30+ / 5+ / any+15 / +12 / +6 / +2Google Business Profile
Domain age: 10+ years / 3+ / 1+ / under a year+10 / +8 / +4 / +1Domain registry
No hard discrepancy between website and register+10Website vs Companies House / HMRC
Postcode and landline shown on the website+5Website
Net assets of £5,000 or more in the latest accounts+5Companies House (iXBRL)
Each “worth asking” (soft) point−2Website vs register
Registered office shared with 50+ companies, no trading address on the website−10Companies House + website
Registered office shared with 50+ companies, trading address shown and confirmed by Google−5Companies House + website + Google
Mobile phone only−5Website
Material change on the register in the last 90 days (director appointed or left, name change, office moved, owner change)−5Companies House filing history
Confirmation statement overdue−5Companies House
Net liabilities in the latest accounts−15Companies House (iXBRL)
Current assets cover less than 90% of what falls due within a year−5Companies House (iXBRL)
Net assets more than halved year on year−5Companies House (iXBRL, prior-year comparatives)

Administrative filings — a director’s details corrected, an owner’s details updated, an address tidy-up within the same postcode, share paperwork — are listed in the report but cost no points. A liquidity ratio between 0.9 and 1.0 is shown as “tight but positive” without a deduction: small-company accounts move by that much on the timing of a single invoice.

How the verdict is decided

The rules are evaluated in order: red first, then amber, then green. If none applies, the result is amber. A rule can only fire on evidence that was actually retrieved — a source that did not answer can never turn a report red.

Red — warning signs on the register. Any one of:
  • Company status other than “active”
  • Accounts overdue at Companies House
  • A strike-off notice in the Gazette — the company’s own application or the registrar’s
  • A winding-up petition filed against the company
  • An insolvency process in progress (administration, liquidation, voluntary arrangement)
  • A current director on the disqualified directors register
  • A current director with two or more companies dissolved or liquidated in the last five years
  • A copied or template website, or a look-alike of another checked brand, behind a company under three years old
Red — cannot be verified yet. All of:
  • No UK company matches the website, and Companies House answered
  • The domain is under a year old
  • No reviews on any platform
  • No address on the website

This is not an accusation — a sole trader with a new website lands here too. It means there is nothing to check until they give a company number and an address.

Amber — verify before paying. Two or more of:
  • Company incorporated less than 12 months ago
  • No UK company identified (without the conditions for red)
  • Companies House could not be queried, or the website could not be read
  • Registered office shared with 50+ companies and no trading address on the website
  • At least one hard discrepancy
  • No Google reviews
  • Mobile phone number only
  • More than 60% of gallery images are renders or graphics rather than photographs
  • Adverts paid for by a different legal entity
  • Net liabilities in the latest accounts
  • Confirmation statement overdue

Amber is split by score: A few points to check (score 50 or more) and Little to verify yet (below 50).

Green — consistent public record. All of:
  • UK company identified and Companies House answered
  • Incorporated 3 years ago or more
  • Accounts and confirmation statement not overdue
  • No hard discrepancies and no net liabilities
  • Registered office not a mass-registration address — or a trading address shown and confirmed by Google
  • 5 or more Google reviews
  • Record strength 70 or more, and either an established review history (30+ reviews, or 5+ with the oldest at least a year old) or a score of 75 or more

Green does not mean perfect. It means the public record is consistent and nothing on the website contradicts it. A genuine, long-established firm can still be late or over budget. What it is unlikely to be is fictional.

Deposit guidance

Since v1.1 the report no longer derives a single “safe deposit” figure from the balance sheet. Instead it gives guidance in four parts, because what protects a deposit is how you pay, not how much the company owns.

  • The normal deposit for this trade — bespoke staircases and joinery 30–50%, kitchens 25–50%, windows and doors 25–50%, building work 5–20%, installations 10–30%, vehicles a reservation fee. A firm asking for much more than its trade’s norm is asking a question you should ask back.
  • What the balance sheet says — none filed, unknown, net liabilities, micro, modest or solid — and what that means for money paid by bank transfer if the company failed.
  • Staged payments — a schedule to propose for that trade, with what is delivered before each stage.
  • How to pay — credit card first (Section 75 of the Consumer Credit Act 1974 covers the whole purchase between £100 and £30,000 when at least £100 is paid by credit card), then debit card, then a card payment link, and bank transfer last.

The three questions

The full report includes three questions to send to the business before paying. They are selected from a fixed list according to the strongest signals in the report — for example, a workshop point triggers “Where is the workshop and can I visit it?”; no identified company triggers “Which legal entity will the contract and invoice be in?”. A genuine firm answers each in a sentence. A firm that changes the subject has told you something.

What the full report adds and why

Some checks run only when a report is unlocked, either because they draw on a paid data source with a monthly quota or because they are only meaningful once the company is identified: the Google Ads advertiser (legal name and country behind the adverts that send people to the website), director histories and other appointments, owners, charges with the lender’s name and date, the two-year trend in the accounts and short-term liquidity, all discrepancies, deposit guidance and the questions. A red verdict is always shown in full for free. Businesses that verify their listing make their full report public for everyone.

What we cannot see

  • Sole traders and partnerships without a limited company have no Companies House record. The report will say so; it is not a mark against them.
  • Companies outside the UK — we identify them where the site says so, but do not read foreign registers.
  • Very recent filings — Companies House updates within 24 hours; a check run in that window may miss a filing.
  • County court judgments — the Register of Judgments is a paid search per company and is not included.
  • Blocked sources — some review platforms and some websites refuse automated reads. The report names the source and applies no penalty.
  • Quality of work — nothing in a public register tells you whether a firm is good at its job. Reviews help; the register does not.

The rules for businesses

A business can

  • Request a correction of any fact or date, with evidence
  • Ask for a re-check after filing accounts or changing details
  • Verify its listing, display the free badge and make its full report public

A business cannot

  • Change a verdict or remove a fact that comes from a public register
  • Pay for a colour, a ranking or a badge
  • Have a report withdrawn because it is unfavourable

Corrections are answered within 48 hours. Where a source is wrong, we correct the report and re-run the check; where a source is right, the line stays. Request a correction.

Data protection

Reports contain information about companies and their officers taken from public registers, published under their respective licences. Directors’ dates of birth are shown as month and year only, as Companies House publishes them. We do not collect information about consumers who run checks beyond what is needed to deliver a report they have paid for. See our privacy notice.

Changelog

  • v1.2 · 2026-09-07Companies House read in depth: winding-up petitions and insolvency cases, disqualified directors, voluntary vs compulsory strike-off, charges with lender and date, changes in the last 90 days (material vs administrative), confirmation statement overdue, company status. Accounts trend from prior-year comparatives and short-term liquidity (deduction below 0.9). VAT number checked against HMRC’s registered name, not just validity. Serviced-office registered address halves its deduction when the website shows a trading address confirmed by Google. Email security (SPF / DMARC) read from DNS. Google Ads advertiser and country in the full report; “no advertiser found” removed from the red conditions. Every report now stores its score, guidance and the time each source was read, so a report never changes retroactively. Rows for checks not yet live are no longer shown.
  • v1.1 · 2026-09-05Record strength score (0–100) with published points. Amber split into “A few points to check” and “Little to verify yet”. Discrepancies weighted hard / soft. Single “safe deposit” figure replaced by deposit guidance: normal range for the trade, balance-sheet context, staged payments and payment-method advice. Fourth red condition “Cannot be verified yet”. Free report shown as Preliminary; red always shown in full for free. AI used only to extract the website’s claims verbatim; comparison and verdict remain rule-based.
  • v1.0 · 2026-09-04First published methodology: verdict rules, claim comparisons and balance-sheet safe deposit formula.

See it applied to a real company

Free, no sign-up, about a minute.

Enter a website address, e.g. aurelia-kitchens.co.uk

Scroll to Top