Analysis
The state of public compliance evidence in 2026: what 3,000 vendors actually publish
CertReports Research · 18 Sep 2026 · 12 min read
attestation
PCI DSS evidence across 3,303 vendors
PCI DSS evidence that a buyer can verify is a registry listing or an attestation of compliance. CertReports mirrors the Visa Global Registry of Service Providers, counting only rows validated as PCI DSS with a validation date, and records the assessor and the date the validation runs through.
- Verified rows
- 3,171
- Vendor-stated
- 132
- Expired
- 179
- Last verified
- 1 Nov 2026
Duffel
Logistics and supply chain
The complete toolkit to sell travel.
Activehours
Finance and accounting
EarnIn is an app that gives you access to the pay you've earned - when you want
Easol
E-commerce
Shopify for experiences
Feroot Security
Compliance and GRC
AI-powered Compliance Platform for PCI 4, CCPA, HIPAA, CIPA, 50+ laws
Fintoc
Developer tools
Account-to-Account payments in Mexico and Chile.
Deed
HR and HRIS
Making it easy for employees to donate and volunteer with good causes.
Method Financial
Payments
Financial connectivity API for consumer liabilities
Modern Treasury
Finance and accounting
Payment operations tools for money movement.
Quartzy
E-commerce
Marketplace for life science supplies.
RS
Rycor Solutions
rycor.net
Sharebite
Benefits and insurance
The #1 corporate meal benefits and group ordering platform for modern
TapTap Send
Payments
Send money to Africa, Asia and Latin America in
teamironwood
Payments
Building flexible merchant services programs with financial institutions and strategic partners driven by our core values of integrity
Tesorio
Finance and accounting
Tesorio is the cash flow performance platform that helps finance…
Auth0
Identity and access
Secure users, AI agents, and more with Auth0, an easy-to-implement, scalable, and adaptable authentication and authorization
Registry traps
Most Visa registry rows are Third Party Agent or ISO registrations, not PCI DSS validations. Those are excluded. The Mastercard SDP compliant service provider list is the second registry-grade source.
Level 1 service providers
Registries list Level 1 service providers with a QSA-signed ROC or AOC. Smaller merchants and service providers self-assess and do not appear.
Guides on PCI DSS
All articlesAnalysis
Three quarters of the Visa registry is not a PCI DSS validation
CertReports Research · 17 Sep 2026 · 10 min read
Explainers
Where PCI DSS evidence actually lives: the Visa and Mastercard registries
CertReports Research · 3 Sep 2026 · 10 min read