1. Verify you control sonatype.com
2. Add or correct evidence
You can submit without verifying; verified claims are reviewed first. SOC 3 reports, certificates, auditor letters and bridge letters are accepted. Restricted-use SOC 2 reports are refused.