Blog
Analysis of what thousands of vendors publish, explainers on the frameworks and registries, and how to run a review on public evidence alone.
We read the public record for three thousand B2B software vendors. Here is how much is verifiable, how much is a badge, and which frameworks are most often out of date.
CertReports Research · 18 Sep 2026 · 7 min read
The Visa Global Registry of Service Providers lists thousands of Third Party Agents with no validation date. Treat every row as PCI compliant and you mislabel most of it.
CertReports Research · 17 Sep 2026 · 6 min read
The IAF transition deadline passed nearly a year ago. Certificates still citing the 2013 edition are expired for accredited purposes, and the index still finds them on trust centres.
CertReports Research · 16 Sep 2026 · 5 min read
SOC 2 is an attestation report with an opinion, a period and an auditor. Nobody issues a certificate. Here is what the phrase hides and the four facts to ask for instead.
Solomon Amos · 15 Sep 2026 · 5 min read
Type I says the controls were designed properly on one date. Type II says they operated over a period, with sampled evidence and listed exceptions. Which one you should accept and when.
Solomon Amos · 14 Sep 2026 · 6 min read
A bridge letter covers the gap between a SOC report period end and the next report. It is a management statement, not an audit. Here is what it must contain and where it stops.
Solomon Amos · 12 Sep 2026 · 4 min read
Vanta, Drata and SafeBase trust centres all look alike. Here is what each section actually proves, which badges are claims, and how to get the facts out without requesting access.
Solomon Amos · 10 Sep 2026 · 6 min read
The General Court dismissed the challenge to the EU-US DPF in September 2025 and an appeal is pending. Practical steps for vendor reviews that rely on DPF listings.
Solomon Amos · 8 Sep 2026 · 5 min read
