For providers
A card that prints what your record here prints — the security score in its ring, the usability score in its own beside it, the band, the day it was assessed — and links back to the record, so a reader of your site can check the numbers against ours. Four sizes, two layouts, two themes. Pick the record, copy the snippet.
Paste this where the card should go
<a href="https://hushfleet.com/reviews/proton-vpn">
<img src="https://hushfleet.com/widget/proton-vpn.svg?theme=dark&v=3e1a6f03954f"
width="600" height="200"
alt="Proton VPN scores 70 out of 100 on security (acceptable), usability 78, assessed by HushFleet on 13 September 2026">
</a>No script, no cookie, no request beyond the one image. The address carries the record’s own hash, so the card is cached for a year and changes address when the record changes. The link is to the record, not to a redirect, and we set no attribute on it — how you mark a link on your site is yours to decide.
What the card always shows
A card exists so that a number on your site can be checked against the number on ours. Each size down drops something — the address, the usability ring, the name — and none of them drops these.
Out of 100, inside the ring the site prints every score in, and the band the model’s own thresholds put it in. The word is read off the number, so the two cannot disagree.
The record’s as of date. A downloaded file keeps the date it was drawn with; the hosted image moves with the record.
Printed on the full card, and carried by the link around every size. That is the verification: a reader clicks and sees the same figure, with the evidence under it.
The name, as the brand page draws it, and the mark over it — one seal, at every size, down to the chip. The card is drawn by us, in our colours, and the ring is the brand’s own sunset ramp; a recoloured or cropped copy is not the card.
Any provider in the register may show its own card, on its own site or in its own material, without asking. The permission covers the card as drawn: the hosted image, or an unaltered download of it.
It does not cover cropping the band or the date off, changing a colour, redrawing the mark, or composing a card of your own from our numbers. It does not cover showing another provider’s card. And it ends when the record does: a record that leaves the register answers with a retirement notice at the same address, and the hosted card prints record retired in place of the score from that day.
The number on the card is the number on the record, and the record moves for the reasons the methodology gives and no other. Showing the card does not reach it; neither does anything else a provider could arrange with us, because there is no lever to reach for. A provider that disagrees with a figure has the reply form, and the reply is published under the record.
The snippet embeds the hosted image, which is what we recommend: it is cached hard, it needs no script, and it changes when the record does. A downloaded SVG or PNG is the same drawing frozen on the day you took it — fine for a press release, which is dated anyway, and wrong for a page that will be read next year, where the as of line is the only thing telling a reader it is stale.
Every size is one shape: the security ring at one end of the card, our seal — the mark, and the name under it — at the other, and the record centred between them. Which end the seal takes is the layout: scores first puts the security ring on the left, mark first puts the seal there; the drawing is otherwise the same. What stands in the middle is what the size has room for. The full card (600×200) carries everything — the record’s name and band, the usability ring beside them, the date and the address along the foot. Compact (420×140) keeps all of that and drops the printed address. Strip (300×100) drops the usability ring and the record’s name as well — on your own site, the name is the page it sits on — and keeps the band as a pill over the date. Chip (200×64) is the security ring, the band as a word over the date, and the seal, and nothing else.
There is no size below the chip. A badge the height of a build status has room for a number and not for its band or its date, and a number alone is the one form of the score this site does not publish.