01BUYER
You post the part.
Your request is signed and timestamped before any seller sees it, so what you asked for is on the record from the start.
Signed request
Go Find Part Limited · gofindpart.com · security@gofindpart.com
Trust · Chain of custody Every order, on the record
| File ref | GFP-TRUST-26.10 |
| Revision | 26.10 |
| Claims reviewed | 2 October 2026 |
| Next review due | 2 January 2027 |
| Live page | gofindpart.com/trust/ |
Every order,
on the record.
Verified sellers. Held payment. Signed evidence.
GoFindPart is the supplier of record on every order: we contract with the buyer, the seller contracts with us, and the platform holds the money, the documents and the evidence in between. This page is how that protects each side — what is checked before a seller can quote, what happens to your payment, what you hold at the end, and what we do when something goes wrong.
To buyers: your money is held until you accept the delivery, GoFindPart is the one supplier on your invoice, the evidence is yours to verify, and a person decides a dispute. To sellers: you are paid your full quote on a schedule you can see, requests reach you on merit, and a dispute is heard on the evidence from both sides.
Every control on this page runs in the platform today. Planned work is marked as planned, and the things we do not claim are listed at the end. The technical controls underneath it all are on the security page.
Claims last reviewed · 2 October 2026 · Rev. 26.10
Card data on our servers None Cards go into fields hosted by Stripe, never into ours.
Dispute window 48 h From confirmed delivery. The seller's payout is frozen while a dispute is open.
Order evidence Signed Request, quote and acceptance, each verifiable at its own link.
Primary data UK Database, files and application servers in London.
§ INDEX · PROTECTIONS 01–07 JUMP TO SECTION
§ 01 · CHAIN OF CUSTODY · ONE ORDER
Seven steps. Each one held.
An order on GoFindPart is a sequence of recorded handovers. At each step one party acts, the platform records it, and something is locked before the next step can start. This is the whole chain, from the first request to the seller's payout.
02SELLERS
Verified sellers quote.
Only sellers who have passed identity, company and staff checks can quote. Each quote is signed by the seller, and the seller's rating sits beside it.
Signed quote
03BUYER
You accept and pay.
Your card goes into fields hosted by Stripe. Your acceptance countersigns the quote, and the money is held by the platform, not paid to the seller.
Payment held
04SELLER
The seller dispatches or hands over.
A collection is confirmed by scanning a QR code at the handover. Where the seller certifies the part, the certificate of conformance is issued at this point.
QR handover
05PLATFORM
The part arrives.
Delivery is confirmed on the order, and your 48-hour window to raise a problem opens from that confirmation.
Delivery confirmed
06BUYER
You accept, or you dispute.
Accept the delivery, or open a dispute with evidence. If you do nothing, the order accepts itself after 48 hours. A dispute freezes the seller's payout until it is resolved.
Dispute window
07PLATFORM
The seller is paid.
Payout releases on the schedule set by the seller's tier, only after acceptance. The seller receives their full quote; our margin never comes out of it.
Released on schedule
ONE SUPPLIER OF RECORD · ONE INVOICE · ONE RETURNS PROCESS EVERY STEP TIMESTAMPED ON THE ORDER
§ 02 · PROTECTIONS · 01–07
The whole schedule.
Seven groups of protections, grouped by what they protect. Each one is a behaviour the platform has today, checked against the repositories and the canon on the review date above. Account security — passkeys, two-factor, sessions, step-up — is itemised on the security page rather than repeated here.
§ 01
Verified sellers
LIVE- Identity before the first quoteA seller proves their identity with a government document through Stripe Identity, and the name on it is bound to the account. A mismatch goes to a person for review.
- Company and tax checksThe business's Companies House record is checked, and a VAT-registered seller's VAT number is checked with HMRC.
- Authorised by a personA member of our team authorises every seller before their first quote. Passing the automated checks alone does not open the quote door.
- Insurance certificatesSellers upload their public liability and product liability insurance certificates. Cover and expiry are checked, and a seller's cover is shown to buyers.
- Sanctions screeningSellers are screened against the UK Sanctions List at onboarding and again nightly. A match blocks payouts until a person has cleared it.
- Payout identitySellers are paid to a Stripe Connect account that has passed Stripe's own know-your-customer checks, so money can only reach the verified business.
CONTROLS · 06 REF · SELLER-VERIFICATION
§ 02
Payment protection
LIVE- Card details never reach usCards are entered into fields hosted by Stripe, a PCI-DSS Level 1 processor. GoFindPart's servers never receive a card number.
- Held, then releasedYour payment is held by the platform while the order is in flight and released to the seller only after you accept the delivery or the acceptance window closes.
- One supplier of recordGoFindPart is the supplier on your invoice for every order, however many sellers fulfil behind it: one invoice, one returns process, one support line.
- Invoice verificationEvery GFP-issued invoice carries a code and a QR link that confirm the issuer, the invoice number, the total and the bank account to pay — a check against invoice-redirection fraud.
- Frozen on disputeA dispute stops the seller's payout the moment it is opened, until it is resolved.
- Platform kill switchesPayments, payouts and releases can each be halted platform-wide by our team if something looks wrong, while the rest of the platform keeps running.
CONTROLS · 06 REF · PAYMENT-HOLD
§ 03
Documents & evidence
LIVE- Signed request, quote and acceptanceThe buyer signs the request, the seller signs the quote and the buyer countersigns the acceptance. Each signature can be verified by anyone holding its link.
- Sealed documentsEvery official PDF we issue — invoices, confirmation certificates, receipts — carries a digital seal. A document that cannot be sealed is not issued.
- Certificate of conformanceWhere a seller certifies a part at dispatch or handover, GoFindPart issues a certificate of conformance to the buyer with the order. Our team can withdraw a certificate that turns out to be wrong.
- Compliance documents found for youDeclarations of conformity, RoHS and REACH statements, safety data sheets and ATEX documents found for a part are attached to the request, with the country of origin where it is known.
- A tamper-evident staff trailEvery action our staff take on an order or an account is written to an append-only, hash-chained log that is checked nightly and anchored monthly.
CONTROLS · 05 REF · EVIDENCE
§ 04
Delivery & handover
LIVE- Defined stages, both sidesEvery order moves through named stages, and both parties see the same stage at the same time.
- QR-verified collectionA buyer collecting in person confirms the handover by scanning the seller's QR code. One scan, recorded once.
- Collection time agreed, not assumedFor a collection, the seller proposes a time and the buyer confirms or counters it, so nobody arrives at a closed door.
- Hand the order to a colleagueA buyer can hand the tracking and receiving of an order to someone else by email. The handover is recorded on the order.
- Alternatives are disclosedIf a seller offers an alternative to the part you asked for, it is marked as an alternative on the quote and you choose it knowingly. Nothing is swapped silently.
- Auto-acceptanceIf you take no action within 48 hours of a confirmed delivery, the order accepts itself and the payout schedule starts.
CONTROLS · 06 REF · HANDOVER
§ 05
Disputes & returns
LIVE- The dispute windowOpen a dispute within 48 hours of delivery, with photographs and documents as evidence.
- A person reviews itA member of our team reviews the evidence from both sides. Our target is a decision within 48 hours of the dispute being opened.
- Outcomes follow the evidenceFull refund, partial refund or no refund — decided on what the evidence shows, and recorded on the order.
- ReturnsA buyer can start a return within 48 hours of delivery. A faulty-goods return is never held up by the seller; for other returns the seller has 3 business days to answer, and silence counts as acceptance.
- Refunds to the lineA refund is calculated line by line from the invoice, so a part-return refunds exactly the lines returned.
CONTROLS · 05 REF · DISPUTES
§ 06
Seller performance
LIVE- Six tiers, earnedPremier, Preferred, Standard, New Seller, Limited and Paused. A tier is recalculated every hour from the seller's own recent record.
- What the score readsResponse speed and response rate, acceptance rate, buyer ratings, account health and delivery reliability. A tier cannot be bought.
- Premier takes a track recordPremier needs a sustained record and confirmation by our team. A short score spike can never reach it, and a revoked Premier waits 30 days before it can return.
- Requests reach the best sellers firstRequests go out in waves by tier, so a buyer's request reaches the sellers most likely to deliver before it reaches the rest.
- Penalties with an expiryUnreliable behaviour costs a seller score for a defined period, then expires.
- Ratings after acceptance, kept privateA buyer rates delivery speed, part quality and communication after accepting an order. A seller's rating is shown beside their quote; the individual ratings behind it are private to the parties, and there are no public reviews to game.
CONTROLS · 06 REF · SELLER-TIERS
§ 07
Privacy & data
LIVE- UK-hosted primary dataAccount and order data lives in London: the database, the file storage and the application servers. The providers that sit outside the UK are listed, with their transfer mechanism, in our sub-processor register.
- Your data, on requestExport everything we hold about you from your account settings, or ask us to erase it. Consent is recorded per purpose, and withdrawing it is one switch.
- Retention with an end dateOrders, payments and invoices are kept for 7 years because tax law requires it; session history goes after 90 days; a deleted account is anonymised after 30 days. The sweeps run every night.
- Legal holds, not quiet deletionWhere a dispute, a complaint or a legal duty needs data kept, a legal hold stops the sweep for that record only, and it expires on a date.
- Nothing sensitive in the logsSecrets, tokens and personal data are redacted before a log line is written.
CONTROLS · 05 REF · PRIVACY
§ 03 · TRANSPARENCY · WHAT WE DO NOT CLAIM
Where the line is.
A trust page is only worth reading if it also says what is not true yet. These are the things you might assume from a page like this, and the honest position on each.
Not claimed
STATED PLAINLY- § 01 No certification, no completed auditGoFindPart is not SOC 2 or ISO 27001 certified, and no independent audit or penetration test has been completed. The roadmap to both is on the security page.
- § 02 PCI-DSS Level 1 describes Stripe, not usThe attestation is Stripe's. Our own PCI self-assessment is on the roadmap, and card data never touches our systems in the meantime.
- § 03 No public reviewsRatings are private to the parties and feed a seller's score. There is no public review wall, so there is none to inflate.
- § 04 No promise of live trackingWhere a courier shares tracking we pass it on. We do not promise live tracking on every delivery.
Targets, said as targets
OPERATIONAL- → 01 The dispute decisionThe 48-hour decision is a target our team works to, not a measured guarantee.
- → 02 Delivery windowsA delivery window is the option a courier quotes at checkout, not a guarantee of arrival.
- → 03 Insurance coverA seller's certificates are checked for cover and expiry. Our team can waive a certificate slot for a seller, and a buyer is shown only the cover a seller actually holds.
- → 04 This page itselfEvery claim on this page has a row in our claims register with its evidence, and the build fails when a claim and its row disagree. The review date in the hero is when that was last walked.
§ 04 · STILL HAVE QUESTIONS
Ask us anything.
A question about a protection on this page, a procurement review, a supplier onboarding check — we answer all of it, and a security question goes straight to the security desk.
Attestation
This document is the trust page at gofindpart.com/trust/ as published on the review date above. Every claim in it has a row in GoFindPart's claims register naming its evidence, and the site's build fails when a claim and its row disagree.
Questions, vendor questionnaires and security-documentation requests: security@gofindpart.com. A vulnerability report to the same address is acknowledged within 48 hours.
Claims reviewed2 October 2026Rev. 26.10
GoFindPart · Trust · Chain of custody · Rev. 26.10 Claims reviewed 2 October 2026 · Printed from gofindpart.com/trust/ · The live page prevails