ESCODI-QRO-001 V1.1 | Digital Trust Validation Standard

Document Control

Field	Value
Standard Code	ESCODI-QRO-001
Version	1.1 (In-Force)
Status	In Force
Developer	QRO. VERIFICADO

1. Introduction

The ESCODI standard establishes the official, unified methodology for evaluating the digital trust of websites and digital platforms. This normative framework is developed and applied by QRO. VERIFICADO, ensuring that evaluations are based on technical, public, functional, and documentary evidence.

2. Object

Define the minimum operational, technical, security, and legal criteria required to obtain the Digital Trust Seal issued by QRO. VERIFICADO.

3. Scope

This standard is applicable to all websites, interactive portals, and software platforms (SaaS) representing organizations, companies, or independent professionals established or conducting commercial operations in the state of Querétaro.

4. Guiding Principles

The application and audit of this standard are governed by six fundamental principles:

⚖️ Legitimacy

The existence of the business entity and the solicitor identity must be verifiable, ensuring authentic representation.

👁️ Transparency

Clear, visible, and accessible information regarding commercial ownership, contact channels, and operating policies.

🛡️ Proportionality

Required validation actions and documentation must be strictly proportional to the target criterion risk.

📂 Data Minimization

Only the strictly necessary data required to evaluate standard criteria is requested, avoiding excess collection.

🔗 Traceability

Every state change and validation action must generate an immutable, public, and verifiable record.

📈 Continuous Improvement

Criteria evolve dynamically according to new cybersecurity challenges, standards, and regional laws.

5. Evidence Methodology

To ensure proportionality and protect solicitor privacy, auditors must gather evidence following a strict hierarchy of preference. Documentary evidence must only be requested when preceding layers are insufficient:

Technical evidence: Direct automated query of web assets, security headers, and domain parameters.
Public evidence: Verification through registers, official portals, Google Business, maps, or municipal commercial directories.
Functional evidence: Inspection of the active website channels (testing forms, anti-bot behavior, response rates).
Documentary evidence: Administrative records requested only when the technical, public, and functional validations leave reasonable doubts.

6. Documentary Policy

The documentary collection during the validation process is classified into three levels:

Mandatory: Official valid identification (INE or Passport) of the legal representative or independent professional.
Preferred: Official corporate email matching the evaluated domain.
Conditional: Proof of address, corporate charter, or power of attorney, requested solely under unresolved operational inconsistencies.

7. Base Evaluation Criteria

These criteria must be evaluated for all corporate and transactional websites:

ST-001 SSL Certificate and HTTPS Navigation

▼

Criticality	🔴 Critical
Objective	Ensure all data transferred between the user browser and the web server is encrypted.
Validation Method	1. Technical: Automated validation of TLS 1.2/1.3 port 443 handshake and forced redirection from HTTP to HTTPS.
Acceptable Evidence	Valid SSL/TLS certificate issued by a recognized root authority.

ID-001 Identity of the Solicitor

▼

Criticality	🔴 Critical
Objective	Accredit who requests the validation and their legal or operational link to the business.
Validation Method	1. Documentary: Verification of official valid identification (INE/Passport).

ID-002 Physical Location Verification

▼

Criticality	🔴 Critical
Objective	Verify that the business maintains real operations from a physical and localizable address.

CT-001 Verifiable Contact Methods

▼

Criticality	🔴 Critical
Objective	Ensure customers can easily establish contact through real and active channels.

CT-002 Bot Protection

▼

Criticality	🟡 Major
Objective	Protect web forms against spam and malicious automation using non-invasive captchas.

LG-001 Privacy Notice

▼

Criticality	🔴 Critical
Objective	Comply with Mexican law (LFPDPPP) by explicitly declaring data handling practices.

LG-002 Terms and Conditions

▼

Criticality	🟡 Major
Objective	Establish rules, rights, and limits of service use between the site and its visitors.

8. Complementary E-Commerce Module

These criteria are mandatory for transactional online stores:

EC-001 – Price Clarity: Prices clearly shown in Mexican Pesos (MXN) with shipping costs detailed.
EC-002 – Identifiable Payment Methods: Integration of secure payment processors (Stripe, PayPal) with SSL encryption.
EC-003 – Cancellation Policies: Accessible rules regarding how to cancel an order and transaction refund rules.
EC-004 – Return Policies: Clear instructions on how to return products, periods, and costs.
EC-005 – After-Sales Support: Dedicated help channels to trace shipments, files, or tickets.

9. Evaluation Results and Seal Statuses

The administrative results of the evaluation correspond to three classes:

Approved: The site solvented 100% of critical criteria and the Seal is active.
Approved with Observations: Minor observations pending corrective actions within an ordinary time frame.
Not Approved: Uncorrected critical observations.

10. Institutional Integration

ESCODI-QRO-001 V1.1 is fully integrated with the technical architecture of QRO. VERIFICADO. Every criterion evaluates technical layers of the **AVM-QRO V1.0** model, conforms to data integrity under **MDI-QRO-001 V1.0**, and satisfies safety rules of the **EIS-QRO-001 V1.0** scheme.

11. Correspondence Matrix

ESCODI	AVM-QRO	EIS-QRO	Core (PHP / DB)
ST-001	Cryptographic Layer	TLS/SSL Encryption	`seg_ssl` / `seg_seguro`
ID-001	Contextual Layer	Solicitor Representation	`op_local`
ID-002	Contextual Layer	Physical Existence	`op_direccion`
CT-001	Access Control Layer	Communication Integrity	`con_contacto`
CT-002	Access Control Layer	Spam / Bot Filtering	`con_atencion`
LG-001	Auditing Layer	LFPDPPP Data Protection	`leg_privacidad`
LG-002	Auditing Layer	Terms of Service	`leg_terminos`

12. Documentary Dependencies

Any modification in the standard or system components forces a traceability review following this structural tree:

                ESCODI-QRO-001 V1.1 (Estándar Rector)

                ├── AVM-QRO (Modelo Multicapa)

                ├── MDI-QRO (Modelo de Datos e Integridad)

                ├── EIS-QRO (Esquema de Ciberseguridad)

                ├── Core de Eventos (Event Motor v2.2.1)

                ├── Políticas y Reglamentos Públicos (PRV, GOV, Sello)

                └── Manuales Operativos (Auditor / Titular)

13. Standard Version History

Version	Status	Description
ESCODI-QRO-001 V1.1	✓ Active	Digital Trust Evaluation Standard.

Technical Standard V1.1 (In-Force Version)