How to ask your vendors for a JidoSeal certificate
Your vendors' AI tools (Claude, ChatGPT, Cursor, GitHub Copilot, Gemini and others) work from folders of documents: instructions, runbooks, notes. A JidoSeal certificate says how well one of those folders is kept. Think of it as SOC 2 for your vendors' agent docs, as an analogy only: it is a different thing from SOC 2 and is not issued by the same people.
What the certificate says
The vendor picks a folder and scans it. Every file is graded on the fields it carries. Bronze means every file has a type. Silver adds a title, a description, a timestamp and an owner. Gold adds a lifecycle status, a review policy and the dates of the last and next review. A person at JidoSeal signs off each certificate, and the public page shows the grade, the score and a fingerprint of the folder. It lasts one year.
What it does not say: that the content is correct, that the vendor is secure, or that the vendor is compliant with anything. It says the documents their AI tools read are labelled, owned and kept up to date to the grade shown, on the date shown.
A clause for your RFP
Copy it, set the grade, and delete what you do not need.
Vendor shall provide, with its response and at each annual renewal, a current JidoSeal certificate at grade [Bronze | Silver | Gold] or higher for the folder of documentation, runbooks and instructions that its AI tools (for example Claude, ChatGPT, Cursor, GitHub Copilot or Gemini) use when working on Customer's account. The certificate shall be unexpired and shall be verifiable by Customer on the public verification page at jidoseal.com, which shows the grade, the score, the issue date and the folder's fingerprint. Vendor shall identify which folder the certificate covers and shall notify Customer if it lapses.
For a security questionnaire, the short form is one line: “Do you hold a current JidoSeal certificate for the documents your AI tools use? Provide the verification link.”
How to check the certificate you are shown
- Ask for the link, not the picture. A certificate has a public verification page at jidoseal.com/verify/ followed by its ID. A badge screenshot proves nothing, so ask for the link or the ID.
- Type the address yourself. Open jidoseal.com in your own browser and go to the verification page from there, or search the public registry. Do not follow a link inside a PDF you cannot check.
- Read four things on the page. The page should say Genuine (not expired, revoked or refunded), show the organization name you are contracting with, show the grade you asked for, and show a valid-through date that has not passed.
- Ask which folder it covers. The page shows the grade, the score, the dates and a fingerprint of the folder, and never the files. So ask the vendor to say which folder of AI-facing documents the fingerprint belongs to, and to say again when it changes.
A certificate is point-in-time, like an inspection grade: it shows the folder on the day it was issued. Ask for a fresh one at each renewal.
If your vendor asks how to get one
They pick a folder and scan it, free, in their browser, their terminal or an AI tool such as Claude Code, Cursor, GitHub Copilot, Codex or Gemini CLI. Their files stay on their machine. The scan and the fixes cost nothing; the certificate is the only paid part, and it is optional. Point them to the free Self-Check and, when they are ready, to pricing.
JidoSeal is an independent certifier. It is not affiliated with, sponsored by or endorsed by Google, ISO or any other standards body.