Who runs this registry, and how disputes are settled
⚖️ Conflict of interest — stated plainly
PENS is operated by spotcommglobal, which is also a listed vendor on this registry. Entries relating to the operator follow identical rules and are reviewed by the independent Advisory Board. Operator staff recuse themselves from decisions concerning their own entries.
1. Independent Advisory Board
The Advisory Board reviews disputed classifications and rules on whether a record should stand, be amended or be withdrawn. Its members are named publicly. A ruling is published on the record in question and in the corrections log.
Advisory Board appointments are in progress and will be published here before the registry begins publishing incident records.
2. Recusal rule
Staff of the registry operator take no part in classification, review or publication decisions concerning the operator's own records. Those decisions are made by the Advisory Board. Every recusal is written to the audit log.
3. Right of reply
No record naming a party is published until that party has been given 72 hours' notice and an opportunity to respond. Responses are published unedited, on the same page, at equal prominence. Where no response is received, that fact is recorded rather than left blank, and the record is updated immediately if a response arrives later.
4. Evidence standard
| Tier | Requirement | Affects score |
|---|---|---|
| 🟢 Verified | Machine data (monitoring logs, PCAP, switch logs) plus two independent human sources. | Yes |
| 🟡 Reported | Confirmed by the organizer or official broadcast; no machine data attached. | Yes |
| ⚪ Unconfirmed | Community reports only. Displayed for transparency; excluded from all scoring. | No |
5. Corrections
Any factual error is corrected within 48 hours of being substantiated. Every material correction is published in the public corrections log stating what changed and why. Records are amended, never silently deleted.
6. Dispute resolution
- The named party submits a written challenge with supporting evidence.
- The record is marked Disputed — under Advisory Board review and remains published with that notice attached.
- The Board reviews and rules within 14 days.
- The ruling is published on the record and in the corrections log. If the record was wrong, it is amended and any affected score recalculates automatically.
7. Named entities only
The registry names companies, venues and service providers. It does not name individual employees, contractors or volunteers in any incident record.
8. Tamper-evident record keeping
Every create, update and delete is written to an append-only audit log in which each entry stores a SHA-256 hash of the previous entry plus its own content. Any retroactive alteration breaks the chain and is detectable. The chain can be verified on demand.
9. Open data
The registry publishes machine-readable exports so that anyone can independently verify aggregate claims rather than taking them on trust. See open data and API.
10. What this registry does not do
- It does not rank vendors by opinion, only by published formula.
- It does not characterise conduct. It records durations, causes and responses.
- It does not recommend or discourage the hiring of any vendor.
- It does not publish unverified allegations as fact.