APEX · conduct
The standard
Every holder signs this before the credential is issued. It is not a values statement — each line below is something we will investigate and act on.
Findings that were never proven, screenshots that do not correspond to the system tested, altered timestamps, or a proof of concept the holder cannot reproduce. Presenting model output as verified work belongs here too.
Acting outside an agreed scope, testing systems nobody authorized, retaining access after an engagement ended, or anything that would be a criminal act absent the client’s permission.
Misstating what was tested, what was found, what was fixed, or what the credential itself means. Claiming coverage that did not happen is the most common form and the hardest for a client to detect unaided.
Selling an engagement on the basis of the holder’s involvement and then handing the work to somebody unqualified, or quoting one scope and delivering a materially thinner one.
Putting client code, credentials, findings or screenshots into an unapproved or public model or service, retaining material past what was agreed, or exposing one client’s data to another.
Presenting a lapsed, suspended or revoked credential as active, claiming a Security Arsenal partnership or endorsement that does not exist, or implying the certification covers work it does not.
What a substantiated breach costs
A substantiated integrity breach — fabricated evidence, unauthorized testing, deceiving a client about what was done — ends the credential. Not a warning and not a suspension pending a conversation. The whole value of the certification is that it means something, and it stops meaning anything the moment a holder can fail this and keep it.
Due process
Anyone who engaged the holder professionally can file. We ask for the credential number, what happened and anything you can share as evidence — redacted is fine, and you should not send us material you are not permitted to send.
You get a reference number and a private link to track the case. The holder is not told who reported them while the facts are still being established.
The program office establishes what can be evidenced, not what was alleged. Where the claim concerns the work itself, we look at the artifacts — the same standard the exam applies to a finding.
They are shown the substance of the complaint and given a genuine opportunity to respond before any decision. A credential is somebody’s livelihood; taking one on an unexamined accusation would be its own kind of misconduct.
Substantiated, unsubstantiated, or substantiated in part. You are told the outcome. If the credential’s public status changes, that change is visible to anyone who verifies it from that moment on.
Why the holder gets to answer
Holders may work for firms that compete with us directly. A complaint that could remove a competitor’s engineer on nothing more than an assertion would be trivially abusable, so no report changes a credential’s status by itself, the holder always gets to answer, and reports made in bad faith are themselves a conduct matter.
Report
This goes to the program office, not to a queue. Do not send us anything you are contractually barred from sharing — a description of what happened is enough for us to start.
Why this exists
The people who hold this put in the years, and they keep putting them in. The standard is only worth what it costs to lose — so it has to be losable, and the person paying for the work has to be able to say so.