How Stack Check works

What we watch, how we decide what to show, and the rules we follow when we write about a named supplier.

Who runs it

Praxis Platform Ltd runs Stack Check, separately from Praxis's products. Praxis also sells software to vet practices, so its own products are held to the same rules here, and nothing on this site promotes Praxis. Where Praxis sells in the same area as a supplier, a message naming that supplier is approved by someone with no Praxis sales role.

What we watch

• Suppliers' public status pages: outages, incidents and planned work, in the supplier's own words.
• Suppliers' security notices.
• The CVE List, the public register of security flaws, and CISA's list of flaws known to be used by attackers.

The earliest events on this site come from our research build of public sources made on 24 Oct 2026, which covers the two months before it. Regular checking of each source is being added.

How an event is tied to a product

When the supplier's page or the record names a product, we show the event on that product's page. When a status page covers several products and names none of them, we say the event is from that supplier's status page, and we do not say it affects any one product.

What we need before we name a supplier

• E1. The supplier said it, or a regulator or court record says it. We quote it and link to it.
• E2. An official register says it: a CVE record, CISA's list of exploited flaws or the NCSC. We quote it and link to it.
• E3. Press reports. We do not name the supplier on this alone. We contact the supplier privately the same day and say nothing until the supplier or an official record confirms.
• E4. Our own inference, social media or claims on criminal sites. We do not name the supplier on this alone. We contact the supplier privately the same day and say nothing until the supplier or an official record confirms.

Two people check every message that names a supplier before it goes out, during UK working hours. Outside them, reviewed messages wait, and we say so on this site.

What we never do

• Scan, test or log in to a practice's systems or a supplier's.
• Publish scores, rankings, comparisons between suppliers, or counts of security flaws. A count of published flaws says how often fixes are announced, not how safe a product is.
• Add advice of our own to a supplier's statement. We pass on the supplier's own recommended steps, attributed.
• Sell a practice's list of systems, or show it to Praxis's sales team.

Corrections

If a page here is wrong about your product, tell us and we will correct it. Suppliers will be able to verify a security contact and post statements into a thread.