Explainers
What Is HDS? Health Data Hosting vs Other Meanings Explained
HDS usually means France's health data hosting certification, not a medical term or a Philippines platform name. Here's the real scope.
Solomon Amos · 25 Oct 2026 · 9 min read
Public evidence, re-checked nightly
Your vendors say they are compliant. The public record decides.
CertReports is the evidence layer for vendor security reviews: SOC 2, ISO 27001, HIPAA, GDPR, FedRAMP and PCI DSS for every B2B software vendor, each state dated, sourced and snapshotted, before you email sales.
- Dated on capture
- Linked to the source
- Snapshot behind every row
- VerifiedConfirmed in an official or scheme-operator registry.
- Vendor-statedThe vendor states it on its own domain or hosted trust centre, with a capture snapshot.
- ExpiredA previously verified or stated attestation passed its expiry or period end without renewal evidence.
- No public evidenceNothing found across all sources at the last check. It does not mean the vendor lacks the attestation; it means no public evidence exists yet.
Evidence checkLive from the index
google.com
Registries
Trust centre
Auditors
Legal pages
SOC 2
FedRAMP
PCI DSS
CSA STAR
Dated, sourced, snapshottedOpen Google
Every figure is live from the index and re-checked nightly
- 8,235
- Vendors indexed
- 16,310
- Dated evidence rows
- 321
- Auditors and assessors
- 20,994
- State changes recorded
with a public evidence page
each with a source and a snapshot
linked to the rows they signed
renewals, lapses and new evidence
Is your vendor review evidence-ready?
Only CertReports records what the public record actually says about every vendor, with a date and a source on every row
Verify before you buy
Registry rows, auditor confirmations and vendor statements, kept apart and labelled. A badge on a marketing page is a claim until a primary source confirms it.
Compare with confidence
Put any vendors side by side on the full framework list, mark them pass or gap against your own policy, and export the table with every source link.
Stay current
Certificates lapse, listings expire, reports age. Follow a vendor and hear the day a state changes, by email, webhook or the JSON API.
The evidence gap
Claims are everywhere. Evidence is scattered, undated and easy to fake.
Badges on marketing pages, PDFs in data rooms, listings on six registries and certificates that quietly lapse. Every review restarts from zero, and every answer arrives by email, weeks later.
The questions are always the same. The public record can answer most of them today, if someone reads it, dates it and keeps it current.
Today
Weeks of email
Answers undated, unsourced
CertReports
One search
Every answer dated and sourced
Trust centre: Report type, period end and auditor, read from the trust centre and dated on capture.
The evidence layer
CertReports’ evidence layer connects every claim to its public source
- 01
CertReports reads the public record
Registries, trust centres, auditor confirmations and legal pages, in the open, nightly.
- 02
for every vendor in your stack
Eleven thousand B2B software vendors, six thousand with a public evidence page today.
- 03
captures a dated snapshot of each source
Content hash, capture time and a Wayback citation behind every row.
- 04
and resolves one state per framework
Verified, vendor-stated, expired or no public evidence. Never "non-compliant".
One question every review starts with
Is this vendor’s evidence real, and is it current?
CertReports is the layer between the questions your reviewers ask and the public record that answers them.
Registries
FedRAMP, DPF, Visa, CSA STAR
Trust centres
Vanta, Drata, SafeBase, own pages
Auditors and CBs
CPA firms, certification bodies, 3PAOs
Legal pages
DPA, BAA, subprocessors, security.txt
The answer carries
Report period, auditor, capture date
- One dated state per framework
- Alerts the day a state changes
- Shortlists marked pass or gap
- The same rows over JSON and webhooks
From claim to row
Every claim becomes a dated row
Badges+PDFs+Registry listings+Legal pages
- 16,310
- dated evidence rows
- 8,235
- vendors with a public evidence page
- 321
- auditors and assessors linked
- 34
- frameworks and registries tracked
- 26 Oct 2026D5CashFirst indexed by CertReports
- 26 Oct 2026pvsPCI DSS auditor changed
- 26 Oct 2026Fastboy PaymentsPCI DSS auditor changed
- 26 Oct 2026LOTTE FINANCE VIETNAMPCI DSS auditor changed
- 26 Oct 2026Lieberman CompaniesPCI DSS auditor changed
- 26 Oct 2026monday.comEU-US Data Privacy Framework state changed
- 26 Oct 2026EXACT TRANSACTIONS CANADAPCI DSS auditor changed
- 26 Oct 2026Flo2CashPCI DSS auditor changed
- 26 Oct 2026KlivvrPCI DSS state changed
- 26 Oct 2026Vita WalletFirst indexed by CertReports
- 26 Oct 2026SunshipPCI DSS renewed
- 26 Oct 2026Alipse SystemsFirst indexed by CertReports
By framework
The right question for each framework
Popular checks
What buyers look up most
The vendors people search for most, with a direct link to each dated answer.
Evidence, not claims
Registry rows, auditor confirmations and vendor statements are kept apart and labelled. A badge on a marketing page is a claim until a primary source confirms it.
Dated and re-checked
Every row shows when it was captured and expires on its own terms: certificate expiry, report period, registry usage-end date.
Snapshot-backed
Click through from any state to the captured page, its content hash and a Wayback Machine citation.
Never "non-compliant"
CertReports states what is public. "No public evidence" is literally true and always comes with the explanation, plus a dispute link with a two-business-day SLA.
Most evidence, freshest
Vendors with registry-verified rows
Cloud and hosting
Google LLC is a global technology
Microsoft
Cloud and hosting
Microsoft Azure is a cloud computing platform for building, deploying and managing applications through a global network of Microsoft and
Amazon
DevOps and observability
Amazon Web Services provides a highly reliable, scalable, low-cost infrastructure platform in the cloud that powers hundreds of thousands
IBM
Cloud and hosting
For more than a century, IBM has been a global technology innovator, leading advances in AI, automation and hybrid cloud solutions that
Oracle
Cloud and hosting
Oracle Corporation is an American multinational technology company headquartered in Austin, Texas
Accenture
Business services
Accenture is a Global professional services company providing a range of Strategy & Consulting, Song, Technology and Operations services
Confluent
Data platforms
Founded by the team that built Apache Kafka®, Confluent builds a streaming platform that enables companies to easily access data as
iManage
Legal tech
iManage was founded in 1995 and initially merged with Interwoven in
Expiring in the next 30 days
All expiring- 27 Oct 2026InsightlyEU-US Data Privacy Framework expires
- 28 Oct 2026frontstreamEU-US Data Privacy Framework expires
- 28 Oct 2026NetScout SystemsEU-US Data Privacy Framework expires
- 29 Oct 2026DaonEU-US Data Privacy Framework expires
- 29 Oct 2026Project AffinityEU-US Data Privacy Framework expires
- 29 Oct 2026MeetYuEU-US Data Privacy Framework expires
Latest changes
Full change log- 26 Oct 2026D5CashFirst indexed by CertReports
- 26 Oct 2026pvsPCI DSS auditor changed
- 26 Oct 2026Fastboy PaymentsPCI DSS auditor changed
- 26 Oct 2026LOTTE FINANCE VIETNAMPCI DSS auditor changed
- 26 Oct 2026Lieberman CompaniesPCI DSS auditor changed
- 26 Oct 2026monday.comEU-US Data Privacy Framework state changed
Monthly drift report
The public record, October 2026
What lapsed, renewed and appeared across the index, computed from dated rows as of 26 Oct 2026.
- 15,529
- evidence rows tracked
- 8.4%
- of PCI DSS rows have lapsed
- 1,957
- rows expire in the next 90 days
8,019 verified against a registry or auditor
503 lapsed, 1,594 more due within 90 days
certificates, registry listings and usage-end dates
Regulations
What each regulation asks of your vendors
GDPR, DORA, NIS2, HIPAA, PCI DSS and the EU AI Act all reach your suppliers. Each provision is cited to the official text and mapped to the vendor evidence that may support it.
- Regulation (EU) 2016/679GDPRArticle 28(1)Article 28(3)Article 28(2) and (4)Use processors that provide sufficient guarantees, Put processing under a written contract, Know and control sub-processors and more.
- Regulation (EU) 2022/2554DORAArticle 28(4)Article 28(5)Article 30(2)(b)Due diligence before contracting, Appropriate information security standards, Locations of services and data and more.
- Directive (EU) 2022/2555NIS2Article 21(2)(d)Article 21(3)Article 21(2)(c)Supply chain security, Supplier vulnerabilities and secure development, Supplier continuity.
- 45 CFR Parts 160 and 164HIPAA45 CFR 164.308(b)(1) and 164.314(a)45 CFR 164.314(a)(2)(i)45 CFR 164.410Business associate agreement, Safeguards the business associate operates, Breach notification by the business associate.
- Regulation (EU) 2024/1689EU AI ActArticle 26(1) and Article 13Article 53(1)(b)Article 25(4)Use high-risk systems as the provider instructs, Documentation from general-purpose model providers, Written terms with suppliers in the AI value chain.
- PCI DSS v4.0.1, Requirement 12.8PCI DSSRequirement 12.8.3Requirement 12.8.4Due diligence before engaging a provider, Monitor PCI DSS status at least every 12 months.
Check my stack Free for up to 20 vendors, no account needed.
Getting compliant yourself?
Compliance automation platforms, priced and compared
12 platforms, with published list prices, what buyers actually paid, and what each one states about frameworks, audits and pentests.
VantaCompliance and risk automation$20,000median paid
DrataCompliance automation with AI agents$25,000median paid
SecureframeAutomation backed by in-house experts$20,000median paid
SprintoAutonomous trust platform$15,000median paid
Scrut AutomationAutomated evidence, controls and questionnaires$7,250median paid
Comp AIOpen-source compliance automation$5,000list from
From the blog
Notes from the index
Analysis of what vendors publish, explainers on each framework, and how to run a review on public evidence alone.
Explainers
What Is BSI C5? Germany's Cloud Criteria Catalogue Explained
BSI C5 is Germany's cloud security criteria catalogue. Learn what it actually proves, which country it applies to, and how to spot a real Type 2 report.
Solomon Amos · 24 Oct 2026 · 9 min read
Explainers
ISO 27001 Annex A: What Buyers Should Actually Ask For
ISO 27001 Annex A lists 93 controls across four themes. Here is what a vendor's Statement of Applicability discloses, and what to request instead.
Solomon Amos · 23 Oct 2026 · 9 min read
Questions
What buyers ask first
What is CertReports?
CertReports is a public index of B2B software vendors' compliance evidence: SOC 2, ISO 27001, HIPAA and BAA, GDPR and DPA, FedRAMP, PCI DSS and more. It covers 8,235 vendors with 16,310 evidence rows and 321 auditors and certification bodies. Every row carries a date, a source and a snapshot.
How do I check whether a vendor has a SOC 2 report?
Search the vendor, open its SOC 2 page and read the state: verified by an auditor, stated by the vendor, expired, or no public evidence. The page shows the report type, period and auditor where published, and how to request the report, which is usually shared under NDA.
Is SOC 2 a certification?
No. SOC 2 is an attestation report issued by a licensed CPA firm for a stated period, Type I at a point in time or Type II over three to twelve months. Nobody is certified; ask for the latest report and its period.
What does "No public evidence" mean?
That nothing public was found at the last check: no registry listing, trust-centre entry, certificate or vendor statement. It is not a finding that the vendor lacks the control, and every vendor can add evidence or dispute a state.
Where does the data come from?
Official registries (FedRAMP, CSA STAR, the Data Privacy Framework list, Visa’s PCI registry), auditor and certification-body records, vendor trust centres and vendor security pages. Registry and auditor rows are labelled verified; vendor statements are labelled as such.
How often is the index updated?
Registries sync daily, trust centres and vendor pages are re-captured on a rolling schedule, and every change is logged with its date on the change log. A monthly drift report summarises what lapsed, renewed and appeared.
How much does SOC 2 compliance software cost?
In Vendr's purchase data, the median buyer paid between $7,250 and $41,400 a year for the platforms CertReports compares, before the audit fee unless the platform bundles it. The compliance platforms comparison lists each platform's published prices with sources.
Is CertReports free?
Searching vendors and reading every evidence page is free, as are bulk checks of up to 20 vendors and watching up to three. Paid plans add larger bulk checks, CSV and PDF exports, shared shortlists and webhooks.
Check the public record before you email sales
8,235 vendors with a public evidence page. Every state dated, sourced and snapshotted. Free to search.