Author
Index and methodology
Notes from the team that runs the nightly registry syncs, the snapshot pipeline and the state resolver. Every figure quoted is reproducible from the index on the date given.
We read the public record for three thousand B2B software vendors. How much is verifiable, how much is a badge, which frameworks are most often out of date, and what buyers should do about it.
CertReports Research · 18 Sep 2026 · 12 min read
The Visa Global Registry of Service Providers lists thousands of Third Party Agents with no validation date. Treat every row as PCI compliant and you mislabel most of it. How we read it, with the counts.
CertReports Research · 17 Sep 2026 · 10 min read
The IAF transition deadline passed nearly a year ago. Certificates still citing the 2013 edition are expired for accredited purposes, and the index still finds them on trust centres. Why, and what to ask.
CertReports Research · 16 Sep 2026 · 9 min read
How to read the FedRAMP Marketplace after the Consolidated Rules for 2026: the new Certified label, certification classes, what happened to Ready and In Process, and what 20x changes.
CertReports Research · 5 Sep 2026 · 10 min read
There is no PCI SSC list of compliant companies. Public PCI DSS evidence lives on the Visa Global Registry and the Mastercard SDP list. How each works, the twelve-month clock, and what an AOC must say.
CertReports Research · 3 Sep 2026 · 10 min read
How Buyer Team webhooks are signed and retried, how to read vendor states through the public JSON API, rate limits by plan, and worked examples for verifying a delivery.
CertReports Research · 28 Aug 2026 · 9 min read
