For years, repository certification has been the quiet back office of open science. The update that matters most is not a fresh framework. It is the growing mismatch between how quickly a repository earns a seal and how slowly anyone notices when that seal stops meaning anything.
Trustworthy repository audit and certification is the formal process through which a digital data repository demonstrates that it can preserve research data, keep it findable, and serve its designated community over time. The main international routes are CoreTrustSeal, the German nestor Seal, and the full ISO 16363 audit; a fourth reference point, the TRUST Principles, is guidance rather than certification. CoreTrustSeal, a non-profit body based in the Netherlands, anchors its review in 16 core requirements and the Open Archival Information System reference model, known as OAIS and standardised as ISO 14721. A certificate lasts three years. Repositories submit a self-assessment, external reviewers read and discuss it, and the CoreTrustSeal Board decides. The process is considerably simpler than ISO 16363, which relies on a dense set of audit metrics.
The clearest shift in recent certification practice is the demand for evidence over language. CoreTrustSeal's 2023–2025 requirements push repositories to document a named succession plan if funding disappears, define a meaningful designated community, and show records of actual preservation actions. That shift matters. Older self-assessments often repeated policy aspirations; newer reviewers want logs, budgets, incident reports and the decisions that followed. A repository that cannot say what happens when its grant ends now has a harder time hiding that gap inside a well-written policy.
The standards behind the seals
Four reference points dominate current discussions of trustworthy repository audit and certification. CoreTrustSeal is the most widely used. Its 16 requirements cover organisational infrastructure, digital object management, technology, and the staff behind them, and each certificate is public, searchable and valid for three years. The certification remains documentation-led: reviewers do not always visit the data centre, but they question the self-assessment in detail.
The nestor Seal, based on the German standard DIN 31644, applies a national certification model with separate criteria for digital archives, libraries and research data repositories. Its footprint is smaller outside Germany, but it carries weight in German-speaking research institutions. The seal is issued after an external assessment coordinated by the nestor competence network.
ISO 16363:2012, Space data and information transfer systems - Audit and certification of trustworthy digital repositories, is the heavyweight route. It defines audit metrics rooted in the OAIS reference model and anticipates a formal external audit. Very few repositories pursue full ISO 16363 certification in practice, largely because the cost and scarcity of qualified auditors exceed the perceived benefit. The 2020 commentary describing transparency, responsibility, user focus, sustainability and technology gives repositories a design checklist, but no seal flows from it.
Photo by Team Nocoloco on Unsplash
Here's the catch
Here's the catch. A certification badge is a snapshot, not a monitoring programme. CoreTrustSeal certificates last three years, and renewal is voluntary. When a repository loses funding, changes parent institution, or merges, the old certificate may remain visible on a dead website. The directory of certified repositories shows the validity window, but authors rarely check it. Some repository homepages display expired seals without consequence, because no one enforces badge display after expiry.
Certification also says little about the data you personally deposited. A repository can pass based on a narrow designated community. If a repository defines its community as environmental modellers in northern Europe, a historian of Ottoman land records may not have the same preservation guarantee. The certificate does not create that guarantee; it records that the repository has planned for a specific community and use case.
The same issue appears with ISO 16363. The audit is deeper, but it remains a point-in-time assessment performed by an auditor whose depth and independence can vary. A public certificate tells you the audit happened; it does not publish every nonconformity or the follow-up plan. Repositories that are confident make those findings available. Repositories that are less confident do not.
Hype versus reality: a grading
The hype around certification updates usually promises more than the instrument can deliver. A grading helps separate the two.
| Claim | Hype | Reality |
|---|---|---|
| CoreTrustSeal | Final proof of trustworthiness | Three-year, peer-reviewed process check based on documented evidence |
| ISO 16363 | Strictest possible guarantee | Most rigorous route, but rare and dependent on auditor depth |
| TRUST Principles | A certifiable standard | Design principles from a 2020 commentary, not a certification exam |
The strongest operational signal is not on the badge. It is a repository's repair history: how often it tests restorations, how quickly it answers support tickets, what it publishes after an incident, and whether it follows its own recovery plan. Certification reduces silent failure. It does not remove failure.
The five principles behind the TRUST acronym - transparency, responsibility, user focus, sustainability and technology - were set out in a 2020 Scientific Data commentary. They are useful because they force a repository to be explicit. They become misleading when an institution treats them as if they had been audited.
Photo by Matilda Alloway on Unsplash
What universities and data managers should check
The recent increase in repository deposits after funder mandates has made these checks less optional. Our earlier report on the deposit surge from new mandates describes the operational pressure; certification questions now arrive in the same inbox.
A practical check takes less than an hour.
- Ask the repository for its current certificate page and validity date.
- Read the self-assessment's designated community statement and confirm that your discipline or data type is inside it.
- Ask whether there is a publicly documented succession plan.
- Ask how often the repository performs restore tests and what the last test found.
- Request the last audit findings or nonconformities, even if only in summary form.
- Verify that the repository returns data in a usable format if the service closes.
Ask whether the full ISO 16363 audit was completed by an external body; aligned with ISO 16363 is not the same as certified. German-speaking institutions may also ask about the nestor Seal and its DIN 31644 basis.
This is the same caution researchers should apply to indexing claims. As we have noted in coverage of journal indexation and quality guarantees, a badge is a starting point for scrutiny, not a substitute for it. A certification logo on a submission page proves that a review happened. It does not prove that your dataset will survive the next reorganisation.
The expiry date is the point
The most useful certification update for a working researcher is not hidden in policy language. It is the expiry date printed on the certificate. If a data repository cannot tell you its current status in five minutes, that is the finding. Certificates are public. Read them. Then read the requirement that asks for a succession plan, because most preservation failures are institutional, not technical.
The last word goes to researchers, not because they wrote the checklists, but because they are the ones whose citations and raw files are at stake. Ask for the report. If the repository will not share it, the trust problem is already visible.