A method is only useful if a reader can repeat it. Ours is deliberately ordinary: public documents, public registers, public warning lists, in a fixed order, recorded whether the result is interesting or not.
Step one: read what the brand says
We collect the brand's own description of itself from its public pages and quote it as exactly that, a seller describing a product. We do not soften it and we do not amplify it. If a promotional page contains no performance claim, we say so, because inventing a claim in order to knock it down is as dishonest as repeating one uncritically.
Step two: find a name
Five places, always in the same order: the terms of use, the privacy notice, the contact page, the site footer, and the registration screen. At least two of those documents exist specifically to identify a responsible party, so their silence is meaningful rather than accidental. What we want is a legal name, a registration number, a registered address and, in the privacy notice, a named data controller.
Step three: take the name to the register
With a company name we search the national company register of the stated country: does the entity exist, is it active, when was it registered, what is its status. Without a name there is nothing to search, and we record that the register step had no input rather than pretending we ran it.
Step four: take the entity to the supervisor
An authorisation belongs to a company, not to a website, and it covers specific activities. So we look for the entity in the relevant supervisor's public database and check that the permission actually covers the service being advertised. A firm authorised for something unrelated is not authorised for this. We also search the public warning lists that many supervisors maintain.
Step five: look at the name itself
Because brands in this sector are disposable and companies are not, we describe how a name is constructed and whether the same construction appears elsewhere in our catalogue. This is an observation about naming, not a claim about ownership. We state explicitly, in every brief where the question arises, that no public record we found links the brands.
What raises a verdict
The default verdict is unknown, and it stays there unless evidence moves it. A verdict of high or critical requires a specific published warning or enforcement notice, naming the brand or the entity, that we have read and can point a reader to. A suspicion, a pattern, or a poorly written terms page does not clear that bar. Equally, we do not write ok for a brand simply because nothing bad was found: an absence of warnings is not a licence.
Limits we admit
This is desk research. We do not open accounts, deposit money, or test withdrawals, so we cannot report on how a platform behaves once it has a customer. Registers and databases vary in quality and completeness between countries, some are not searchable by trading name, and a company may be registered somewhere we did not think to look. Our findings describe what a reasonably diligent reader could establish from public sources on the date shown, which is why every brief carries that date and is rewritten when evidence arrives.