neat, but how do users appeal a false positive? Do companies just trust the users or should the company retain the original information so they can manually verify?