# How collectors are certified

> Certified by Atlantic Agentic Labs, on a date, against a version of the vendor's API, for six months at most.

Every collector is certified by **Atlantic Agentic Labs**: on a date, against a named version of the vendor’s API, by a method that says how. The record is kept with the collector’s code, in `certification.yaml`, newest first, and shown on its page in the [catalogue](/collectors/catalogue/). Nothing on it is typed by hand: the status is worked out from the entries.

## The methods

| Method               | What was run                                                                             | Certifies?                   |
| -------------------- | ---------------------------------------------------------------------------------------- | ---------------------------- |
| `sandbox`            | A real run against the vendor’s sandbox or developer account                             | Yes                          |
| `client-environment` | A real run in a client’s deployment, with that client’s consent. The client is not named | Yes                          |
| `fixtures`           | The collector’s tests, against recorded or synthetic responses (not client data)         | No: **Built, not certified** |

A collector with only `fixtures` entries is built and tested, and shown as **Built, not certified**. Nothing is recorded as `sandbox` without a real run.

## What each entry records

| Field              | What it says                                                                       |
| ------------------ | ---------------------------------------------------------------------------------- |
| Certified on       | The date of the run                                                                |
| Collector version  | The version of the collector that was run                                          |
| Engine version     | The engine it ran on                                                               |
| Vendor API version | The system and the version of its API, for example “RSS 2.0, Atom 1.0 (RFC 4287)”  |
| Certified by       | Atlantic Agentic Labs, and the certifying engineer’s role (not a person’s address) |
| Method             | `sandbox`, `client-environment` or `fixtures`                                      |
| Evidence           | What was run and its CI pipeline, recorded in the collector’s certification record |
| Expires on         | Six months after the date, or earlier (below)                                      |

## Six months, or earlier

A certification lasts **six months** from its date. It ends **earlier** if the vendor publishes a new API version that the collector does not list: the entry’s expiry is brought forward to that date. It also stops applying when the collector’s version changes: a new version is certified afresh.

An expired collector still runs; it is shown as **Expired** until it is certified again.

## The statuses

| Status               | When                                                                                                            |
| -------------------- | --------------------------------------------------------------------------------------------------------------- |
| Certified            | The newest entry is `sandbox` or `client-environment`, for the collector’s current version, and has not expired |
| Expired              | It was certified, and that entry has expired or is for an older version                                         |
| Built, not certified | It has only `fixtures` entries                                                                                  |
| Needs onboarding     | It needs a partner agreement with the vendor, or a client’s environment, before it can be built or certified    |
| Coming               | Not built yet. No date is promised                                                                              |

Certification says the collector reads that vendor’s API as documented, read-only where it says so, on that date. It is not a certification of the vendor, and it does not make your use of the vendor’s data audit-ready on its own: see [Data sovereignty](/data-sovereignty/).

Source: https://docs.atlanticagenticlabs.com/collectors/certification/