About
CertReports reads the public record so vendor reviews can start from evidence
Every B2B software vendor says it is compliant. Very little of that is checkable without a call, a questionnaire and three weeks. CertReports indexes what is actually public, from registries, trust centres, auditors and legal pages, dates every fact, keeps a snapshot, and states it in a vocabulary that never overreaches.
Founder
Solomon Amos
Engineer and researcher who has spent the last decade inside regulated data: two years embedded at HMRC digital programmes, a PhD in machine learning and cybersecurity, and two products built end to end on top of government and financial APIs. CertReports comes from running vendor reviews on both sides of the table and never once finding the evidence in one place.
Founder, CertReports
Built the index end to end: nightly registry mirrors for FedRAMP, the Data Privacy Framework, the Visa registry and CSA STAR, the trust-centre capture pipeline, the snapshot ledger and the state resolver that decides what a row is allowed to say.
Founder, TapTax
Making Tax Digital software for UK sole traders, with an HMRC integration built end to end: open banking, AI transaction categorisation, and the quarterly update and final declaration pipeline.
Two years embedded at HMRC
Delivered across HMRC digital programmes, including PAYE and NPS modernisation and Borders and Trade, inside a regulated UK government estate.
PhD in machine learning
Research in machine learning and cybersecurity. Former Applied AI lecturer at the University of York.
AWS Solutions Architect Professional
Cloud and data engineering across production systems for regulated industries.
How the index works
Four rules that do not bend
Evidence, not claims
Registry rows, auditor confirmations and vendor statements are kept apart and labelled. A badge on a marketing page is a claim until a primary source confirms it.
Every row carries a date
Each state records when it was captured, from where, and a content hash of the page. Expiry comes from the evidence itself: certificate dates, report periods, registry usage end dates.
Never "non-compliant"
"No public evidence" is literally true and always comes with the explanation. Vendors can dispute any row and get a reasoned answer within two business days.
No pay-to-rank
Plans add workflow, alerts and reach. No plan changes a state, hides a row or reorders a list.
The full method is in the accuracy policy; the sources and their licences are listed on the sources page. Questions and corrections: [email protected].