{"id":"gcs","title":"GC Supplier rulebook","version":"0.3","criteria":[{"id":"GCS-1","text":"The supplier holds a valid Gaia-X Compliance credential for its LegalPerson (Gaia-X criterion PA1.1), from a clearing house this registry lists as a trust anchor.","level":"SC","title":"Gaia-X participant compliance","method":"inherited","source":"gaiax-compliance","required":true},{"id":"GCS-2","text":"The supplier is a federal corporation that Corporations Canada lists as active, as notarized in its registration-number credential, and its registered name is the legal name it declares.","title":"Federal corporation is active, under the declared name","method":"certification","source":"registration-number","country":"CA","required":true,"name_match":true},{"id":"GCS-3","text":"Customer data of Government of Canada services the supplier provides is stored and processed in Canada.","title":"Canadian data residency","method":"declaration","required":true},{"id":"GCS-4","text":"The supplier holds a current ISO/IEC 27001 certificate, or an equivalent the registry accepts, attested by an accredited certification body.","title":"Security baseline","method":"certification","source":"credential","required":false,"accepted_types":["ISO27001Certificate"],"accepted_issuers":[]},{"id":"GCS-5","text":"The supplier accepts the GC Supplier Registry terms: keep its credentials current, report changes, and accept suspension while a report about it is investigated.","title":"Accepts the GC Supplier terms","method":"declaration","required":true}],"description":"What a supplier must show to be admitted to the GC Supplier Trust Registry. Written the way the Gaia-X Compliance Document is: numbered criteria, each with an assessment method.","registry":"did:web:gc-suppliers.trust-registry.dev.trustdid.ca","published_at":"2026-10-07T21:19:24.956836+00:00"}