Blog
What the index shows across thousands of vendors, with the numbers.
GovRAMP and FedRAMP are run by different bodies for different buyers. A listing in one has no public evidence in the other. Here is how to tell them apart.
Solomon Amos · 18 Oct 2026 · 9 min read
GDPR reaches US vendors that sell into the EU or track EU residents. Here is how to check DPF status and EU representative evidence, not assertions.
Solomon Amos · 2 Oct 2026 · 9 min read
Which vendors publish ISO/IEC 42001 evidence, what the AI management system certificate actually scopes, and what to ask before you rely on it.
Solomon Amos · 25 Sep 2026 · 9 min read
We read the public record for three thousand B2B software vendors. How much is verifiable, how much is a badge, which frameworks are most often out of date, and what buyers should do about it.
CertReports Research · 18 Sep 2026 · 12 min read
The Visa Global Registry of Service Providers lists thousands of Third Party Agents with no validation date. Treat every row as PCI compliant and you mislabel most of it. How we read it, with the counts.
CertReports Research · 17 Sep 2026 · 10 min read
The IAF transition deadline passed nearly a year ago. Certificates still citing the 2013 edition are expired for accredited purposes, and the index still finds them on trust centres. Why, and what to ask.
CertReports Research · 16 Sep 2026 · 9 min read