What our verified shape label means
When you see the verified shape label on a listing, it means our scanner measured the shape of that dataset in the seller's environment, at the stated point in time, and the published result carries cryptographic proof that it arrived unaltered. Not the seller's claims about the data. A measurement, from a tool the seller cannot quietly edit.
How it works
The seller installs our scanner and it runs where the data lives. It sends us only the signed shape report. The raw data stays in the seller's environment, we do not receive it. That is by design. A marketplace that holds everyone's data is a marketplace nobody should trust.
The scanner reads the dataset and produces a report of its shape at that moment. Row counts, with the counting method stated on the report. Column names and types. The share of missing values in each column. An estimate of how many distinct values each column holds, with its margin stated. How values are distributed by size and length.
The report is signed with a private key created on the seller's machine at install. Only its public half is shared with us, so our servers can check the signature. On receipt we verify the signature and independently recompute the report's fingerprint from its contents. If the signed measurements were altered after signing, the report is rejected. The same privacy and consistency checks the scanner applies before sending, our servers apply again on receipt. Both sides have to agree.
The privacy floor
Some statistics can quietly reveal individual records. A column where only two values are missing says something about two specific rows. So the statistics that could do this, missing-value rates, distinct-value estimates, and distribution buckets, have a floor. If one would reflect fewer underlying values than the floor allows, it is withheld and the report shows a privacy label in its place. Structural facts like row counts and column names are not statistics about individuals, so when a report includes them, this privacy floor does not hide them. The floor is enforced twice, once by the scanner before anything is sent and once by our servers, using the same arithmetic. A report that tries to carry a number the floor forbids does not get verified.
What the label is not
It is a snapshot, not a promise about the future. The data can change after the timestamp, and the label always shows you when the measurement was taken. Read the Terms.
It is not an opinion on whether the data is good, accurate, or right for your use. It tells you what is there, not whether you should want it.
And it is not based on us reading the data. We verify shape, at arm's length, with cryptographic proof. What the data says remains between you and the seller.
Why we built it this way
Buying data usually means trusting a stranger's spreadsheet about their own product. We think you should be able to see what a dataset actually looks like before you pay, measured by a tool the seller cannot quietly edit, published by a marketplace that does not hold the data. The seller chooses what the scanner points at, the label tells you honestly what was there when it looked. That is the whole idea.