# Get the trust document

> GET /v1/trust. The trust page as data: ICO registration, lawful basis and LIA, privacy notice, residency statement, sub-processors, retention, complaints and security.

Source: https://emailmovers.com/mydatahub/docs/reference/rest/get-trust

`GET /v1/trust`

The trust page as data: ICO registration, lawful basis and LIA, privacy notice, residency statement, sub-processors, retention, complaints and security. Mirrored at https://mydatahub.emailmovers.com/trust.json.

| Property | Value |
| --- | --- |
| Endpoint | `GET https://mydatahub.emailmovers.com/v1/trust` |
| Operation id | `getTrust` |
| Cost | Free (0 credits) |
| Access | No account, key or token needed. |
| Tag | Compliance |

> **Not yet live.** MyDataHub v2 is built and tested locally and is not yet live. The v2 hosts open at launch, date to confirm. This page describes the contract the API is tested against.

## Request

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `MyDataHub-Version` | header | string | no | The dated API version, pinned per key when left out. Non-breaking changes ship as new dates; the path major changes only for breaking changes, with a 12 month deprecation window. |

## Example request

```bash
curl "https://mydatahub.emailmovers.com/v1/trust"
```

## Responses

### 200: The trust document.

Headers: `RateLimit`, `RateLimit-Policy`.

| Member | Type | Always present | Description |
| --- | --- | --- | --- |
| `updated_at` | string (date-time) | yes |  |
| `company` | object | yes |  |
| `company.legal_name` | string | yes |  |
| `company.company_number` | string | yes |  |
| `company.trading_as` | string | yes |  |
| `ico_registration` | object | yes |  |
| `ico_registration.number` | string | yes |  |
| `ico_registration.expires_on` | string (date) | yes |  |
| `ico_registration.register_url` | string (uri) | yes |  |
| `lawful_basis` | object | yes |  |
| `lawful_basis.basis` | enum: `legitimate_interests_art6_1_f` | yes |  |
| `lawful_basis.lia_ref` | string | yes |  |
| `lawful_basis.lia_url` | string (uri) | yes |  |
| `privacy_notice` | object | yes | The Article 14 privacy notice for contacts, with its history. |
| `privacy_notice.version` | string | yes |  |
| `privacy_notice.url` | string (uri) | yes |  |
| `privacy_notice.versions` | array of `NoticeVersion` | yes | Every version of the Article 14 notice, newest first. |
| `residency` | object | yes |  |
| `residency.statement` | string | yes |  |
| `residency.version` | string | yes |  |
| `sub_processors` | object | yes |  |
| `sub_processors.version` | string | yes |  |
| `sub_processors.notice_days` | integer | yes |  |
| `sub_processors.notice_channels` | array of enum: `email`, `webhook` | yes | How customers hear of a change 30 days ahead: by email and by webhook. |
| `sub_processors.list` | array of `SubProcessor` | yes |  |
| `sub_processors.changes` | array of `SubProcessorChange` | yes | The change log, newest first. |
| `retention` | array of object | yes |  |
| `retention[].category` | string | yes |  |
| `retention[].period` | string | yes |  |
| `retention[].status` | enum: `confirmed`, `to_confirm` | yes |  |
| `complaints` | object | yes |  |
| `complaints.url` | string (uri) | yes | The complaints form. |
| `complaints.email` | string (email) or null | yes | The complaints address; null until published. |
| `complaints.acknowledgement_days` | integer | yes |  |
| `data_protection_lead` | object or null | yes | Named person and email; null until confirmed. |
| `data_protection_lead.name` | string | yes |  |
| `data_protection_lead.email` | string (email) | yes |  |
| `datasets` | array of `Dataset` | yes | Every dataset with owner, source, licence, refresh, residency, regulator, warranty and credits per record. |
| `datasets[].id` | enum: `uk_contacts`, `ie_contacts`, `global_contacts` | yes | The dataset an audience draws from. uk_contacts is live; ie_contacts and global_contacts are listed but not yet served. |
| `datasets[].name` | string | yes |  |
| `datasets[].status` | enum: `live`, `planned`, `through_our_team` | yes | live is served; planned is not yet served; through_our_team is sold through the bespoke service only. |
| `datasets[].owner` | string | yes |  |
| `datasets[].source` | string | yes |  |
| `datasets[].licence` | string | yes |  |
| `datasets[].refresh` | string | yes |  |
| `datasets[].residency` | string | yes |  |
| `datasets[].regulator` | string | yes |  |
| `datasets[].warranty` | string | yes |  |
| `datasets[].credits_per_record` | number (0 or more) | yes | 1 for owned UK and Irish data. |
| `datasets[].credits_status` | enum: `confirmed`, `proposed` | yes |  |
| `datasets[].current_version` | string or null | yes |  |
| `datasets[].versions_available` | integer (0 or more) | yes | Immutable weekly versions still queryable (the last 52). |
| `security` | object | yes |  |
| `security.certifications` | array of object | yes |  |
| `security.encryption` | object | yes | How data is encrypted, as the trust centre publishes it. |
| `security.data_flow_diagram_url` | string (uri) or null | yes | The UK data flow diagram; null until published. |
| `security.pen_test_summary_url` | string (uri) or null | yes | The latest penetration test summary; null until one is published. |
| `security.caiq_url` | string (uri) or null | yes | CAIQ v4 answers; null until published. |
| `security.status_page` | string (uri) | yes |  |
| `security.security_txt` | string (uri) | yes |  |

#### Example response

```json
{
  "updated_at": "2026-09-26T09:00:00Z",
  "company": {
    "legal_name": "Emailmovers Limited",
    "company_number": "05046417",
    "trading_as": "Emailmovers Ltd"
  },
  "ico_registration": {
    "number": "Z9714386",
    "expires_on": "2026-12-18",
    "register_url": "https://ico.org.uk/ESDWebPages/Entry/Z9714386"
  },
  "lawful_basis": {
    "basis": "legitimate_interests_art6_1_f",
    "lia_ref": "EM-LIA-2026-03",
    "lia_url": "https://emailmovers.com/trust/lia"
  },
  "privacy_notice": {
    "version": "2026-02",
    "url": "https://emailmovers.com/trust/privacy-notice",
    "versions": [
      {
        "version": "2026-02",
        "published_at": "2026-02-05",
        "url": "https://emailmovers.com/trust/privacy-notice/2026-02"
      }
    ]
  },
  "residency": {
    "statement": "Data is held in the UK (Google Cloud London). Email addresses are verified in the EU by Millionverifier, with some verification traffic passing through US providers under standard contractual clauses. Telephone numbers are checked by Telnyx in the United States under the UK Extension to the Data Privacy Framework. Every telephone number is screened against the TPS and CTPS each night through a licensed screening service based in the UK, which processes the numbers in the UK. Payments are processed by Stripe.",
    "version": "2026-10"
  },
  "sub_processors": {
    "version": "2026-10",
    "notice_days": 30,
    "notice_channels": ["email", "webhook"],
    "list": [
      {
        "name": "Millionverifier",
        "purpose": "Email verification",
        "location": "EU (Hungary), some US network traffic",
        "transfer_mechanism": "Standard contractual clauses",
        "added_at": "2026-09-01"
      },
      {
        "name": "Telnyx",
        "purpose": "Telephone line type checks",
        "location": "United States",
        "transfer_mechanism": "UK Extension to the Data Privacy Framework",
        "added_at": "2026-09-01"
      },
      {
        "name": "A licensed TPS and CTPS screening service",
        "purpose": "TPS and CTPS screening of every telephone number each night",
        "location": "United Kingdom",
        "transfer_mechanism": "No transfer outside the UK",
        "added_at": "2026-10-18"
      }
    ],
    "changes": [
      {
        "date": "2026-09-01",
        "name": "Telnyx",
        "change": "added",
        "summary": "Telephone line type and carrier checks at ingest and every 180 days."
      },
      {
        "date": "2026-10-18",
        "name": "A licensed TPS and CTPS screening service",
        "change": "added",
        "summary": "Every telephone number screened against the TPS and CTPS each night, in the UK."
      }
    ]
  },
  "retention": [
    {
      "category": "Audit logs",
      "period": "Licence term plus 12 months",
      "status": "to_confirm"
    }
  ],
  "complaints": {
    "url": "https://emailmovers.com/trust/complaints",
    "email": null,
    "acknowledgement_days": 30
  },
  "data_protection_lead": null,
  "datasets": [
    {
      "id": "uk_contacts",
      "name": "UK contacts",
      "status": "live",
      "owner": "Emailmovers Ltd",
      "source": "Emailmovers research; Companies House (OGL v3.0); ONSPD (OGL v3.0)",
      "licence": "12 month multi-use licence; resale prohibited",
      "refresh": "Immutable weekly build every Monday; same-day suppression overlay",
      "residency": "Held in the UK (Google Cloud London)",
      "regulator": "ICO",
      "warranty": "Replacement when hard bounces exceed 10 percent of an order",
      "credits_per_record": 1,
      "credits_status": "confirmed",
      "current_version": "2026-W39",
      "versions_available": 52
    }
  ],
  "security": {
    "certifications": [
      {
        "name": "Cyber Essentials",
        "status": "target",
        "date": "2026-10"
      },
      {
        "name": "Cyber Essentials Plus",
        "status": "target",
        "date": "2027-01"
      }
    ],
    "encryption": {
      "at_rest": "AES-256",
      "in_transit_minimum": "TLS 1.2",
      "key_rotation": "KMS managed key rotation"
    },
    "data_flow_diagram_url": null,
    "pen_test_summary_url": null,
    "caiq_url": null,
    "status_page": "https://status.emailmovers.com",
    "security_txt": "https://mydatahub.emailmovers.com/.well-known/security.txt"
  }
}
```

## Errors

Every error is a problem object with a `code` and a `next_step`. Every response carries the `RateLimit` and `RateLimit-Policy` headers; see [Rate limits](https://emailmovers.com/mydatahub/docs/rate-limits.md).

| Status | Problem codes | When |
| --- | --- | --- |
| 400 | [`invalid-request`](https://emailmovers.com/mydatahub/docs/errors/invalid-request.md), [`idempotency-key-required`](https://emailmovers.com/mydatahub/docs/errors/idempotency-key-required.md), [`unsupported-version`](https://emailmovers.com/mydatahub/docs/errors/unsupported-version.md) | The request could not be read, or an Idempotency-Key is missing. |
| 429 | [`rate-limited`](https://emailmovers.com/mydatahub/docs/errors/rate-limited.md) | Too many requests. Wait for Retry-After. |
| Any other failure | [`internal-error`](https://emailmovers.com/mydatahub/docs/errors/internal-error.md), [`service-unavailable`](https://emailmovers.com/mydatahub/docs/errors/service-unavailable.md), [`tps-screen-expired`](https://emailmovers.com/mydatahub/docs/errors/tps-screen-expired.md) | Something failed on our side (500 internal-error) or the service is briefly unavailable (503 service-unavailable, with Retry-After). Nothing was charged; retry with the same Idempotency-Key. A count, sample, quote or order with telephone in play is also refused with 503 tps-screen-expired, with no Retry-After, while the dataset version's TPS and CTPS screen is more than 28 days old. |