How 0-Doubt works

No. Browsing categories, vendors, products, and the neutral questionnaires is open to everyone. You only need to sign in for buyer projects, saving items, revealing to vendors, scoring, or the vendor/analyst/reseller/admin workspaces.

Yes — press Ctrl/⌘ + K anywhere in the app (or click the “Quick jump” button in the header) to open the command palette: start typing a vendor, category, or product name and jump straight there. Press Esc to close it.

Use the Sign in button (top right) with your work email and password, or “Continue with Google” where it's enabled. Don't have an account yet? Create a buyer account — browsing stays open to everyone either way. Forgot your password? Use the password reset link on the sign-in page.

Inside a buyer project: build your shortlist, assemble an RFP from the neutral category baseline plus your own questions, then in Score & rank weight each criterion (1–5) and score each shortlisted vendor (0–5). A weighted total ranks them live. When you're ready, record a decision — the winner plus your rationale — and print a redacted evaluation summary. All of this is private to you: vendors never see your scores or decision, and it never affects public rankings.

Yes — /compare?vendors=id1,id2 (up to 4 vendors) is a public, no-login page: products by category, certifications, security posture, pricing/status-page/GitHub/ domain-age signals, and neutral vendor-sourced strengths and gaps, with a CSV export. It's a lighter-weight, publicly linkable view — the private buyer scoring workflow above is for a real weighted evaluation with a recorded decision. Reach it from a category page's compare picker, a vendor's “Alternatives” page, or your saved-vendors list.

The bell shows in-app activity that involves you — for example, a vendor is notified when a buyer reveals to their team, or when an analyst independently verifies one of their listings. Open Notifications to read them (click to mark read, or “mark all read”), and use the preferences there to turn any type on or off.

Not until you choose to reveal. Your identity is verified (by your work email domain) but undisclosed — we call it private, not anonymous. Reveals are per-vendor and you can withdraw any reveal at any time from your reveal dashboard.

No. Recommendation and comparison logic is structurally firewalled from any monetization. No vendor payment touches what you see when you browse, compare, or score.

A vendor label means the claim is self-reported by the vendor about their own product — useful, but not independently checked. Analyst-verified means a domain-verified, authorized analyst for that category reviewed it — the strongest external-credibility signal on the platform. Higher trust ≠ better product.

Analysts are scoped to specific categories, and that scope is hard-enforced server-side — an analyst cannot verify or edit content outside the categories they're authorized for. Attempts to do so are rejected and audit-logged. 0-Doubt also never stores or surfaces analyst-firm rankings (e.g. quadrant/wave positions).

Buyer-uploaded documents are private by default. Sharing is strictly opt-in, per recipient, and any NDA e-signature runs through a third-party e-sign provider — 0-Doubt never builds its own signature system.

AI-baseline content is auto-generated from public vendor materials to give every category a neutral starting point. It carries the lowest trust rank and a freshness indicator, and it is clearly labeled as unverified. Treat it as a starting point, then look for vendor, reseller, or analyst verification.

Yes — a read-only JSON API at /api/public/v1, covering the same OPEN-tier facts anyone can already see by browsing (vendors, products, categories, HQ country, certifications, security posture, CVE counts), plus the full RFI/RFP questionnaire library (baseline questions, answer keys, references). Never anything behind a login, like buyer projects, reveals, or documents.

As of 2026-08-06, every endpoint requires a Premium API subscription and a personal bearer token — see your account to subscribe and generate one, and /developer for the full interactive (Swagger/OpenAPI) reference. The vendor-catalog endpoints listed below were free and unauthenticated before this date; they're still served without a token (with Deprecation/Sunset response headers) until 2026-10-05, after which they 401 like every other endpoint. The questionnaire endpoints are new and have never been free.

• GET /api/public/v1/vendors?page=1&category={slug}&country={hqCountry}&certNames={comma-separated}&hasPricing={1}&hasStatusPage={1}&hasGithub={1}&domainEstablished={1}&dnssec={1}&caa={1}&trustCenter={1}&hstsPreload={1} — paginated catalog, optionally filtered by category, HQ country, one or more required certifications (a vendor must hold every certification listed, not just one — for “must have SOC 2 Type II and ISO 27001”-style screening), whether the vendor publishes real pricing rather than “contact us”-only, whether they publish a public status page, whether they run a real public GitHub organization, whether their domain has been registered for 10+ years, whether their domain has DNSSEC or CAA enabled, whether they publish a live trust-center compliance portal (Vanta/Drata/SafeBase/etc), and/or whether their domain is on the browser- vendor-maintained HSTS preload list.
• GET /api/public/v1/vendors/{id} — one vendor's full public profile: products, categories, certifications, security header score, whether they publish pricing, whether they publish a status page (and its URL), whether they run a public GitHub org (and its handle), their domain's registration date, whether their domain has DNSSEC or CAA enabled, whether they publish a live trust-center compliance portal (and its URL/platform), and their SEC ticker if publicly traded.
• GET /api/public/v1/categories, GET /api/public/v1/countries, and GET /api/public/v1/certifications — the real values to use for the category/country/certNames filters above, each with a vendor count.
• GET /api/public/v1/trust-insights — the same 4 catalog-wide, cross-referenced statistics shown on /trust (e.g. how domain age, public-GitHub presence, and self-reported security hygiene each relate to real-world CVE/incident outcomes), as machine-readable JSON — aggregate-only, no per-vendor identity, computed live.
• GET /api/public/v1/questionnaires and GET /api/public/v1/questionnaires/{categorySlug} — every RFI/RFP category's question counts, and (for one category) the full baseline questions, answer keys, source references, and anonymized crowdsourced criteria — the same content as /questionnaire.

Rate-limited to 300 requests/minute per token (60/min for unauthenticated grace-period calls to the catalog endpoints). Ordering is always by name — never a paid-placement sort, the same neutrality rule as browsing on the site itself.

Every vendor's own website is automatically re-checked on a rolling basis — at least once every 7 days, and immediately when a vendor is first added. Background workers fetch each site respectfully (honoring robots.txt and rate limits) and only re-read pages that actually changed, then refresh the AI-baseline content and its freshness timestamp. Crucially, this automatic refresh never overwrites anything a vendor, reseller, or analyst has verified — human-checked claims always win. So the neutral starting point stays reasonably current on its own, while verified content changes only when a real person updates it.