Analysis
The state of public compliance evidence in 2026: what 3,000 vendors actually publish
CertReports Research · 18 Sep 2026 · 12 min read
attestation
PCI DSS evidence across 134 vendors
PCI DSS evidence that a buyer can verify is a registry listing or an attestation of compliance. CertReports mirrors the Visa Global Registry of Service Providers, counting only rows validated as PCI DSS with a validation date, and records the assessor and the date the validation runs through.
- Verified rows
- 3,081
- Vendor-stated
- 134
- Expired
- 267
- Last verified
- 2 Nov 2026
Vanta
Compliance and GRC
Vanta—the proven leader in automated compliance helping startups…
CrowdStrike
Security
CrowdStrike Falcon is the only solution to unify next-gen AV, endpoint protection and response, managed hunting, IT hygiene and threat
Datadog
DevOps and observability
Datadog is a monitoring service for hybrid cloud applications, assisting organizations in improving agility, increasing efficiency, and
Okta
Identity and access
Okta is an Identity-as-a-Service (IDaaS) platform that provides a comprehensive suite of services focused on managing and securing user
Snowflake
Data platforms
Snowflake is a data platform built for the
Cyera
Security
The Cyera Data Security system allows organizations to discover data categories and ensure that they are protected according to
GitLab
Developer tools
A complete DevOps platform delivered as a single application.
Netskope
Security
Netskope™, the leading cloud access security broker (CASB), helps enterprises find, understand and secure sanctioned and unsanctioned cloud
Acquia
Business services
Acquia, Inc. (Acquia) is a privately held, open-source digital experience company that supports customers using the free and open-source content managemen...
CircleCI
Developer tools
CircleCI provides a CI/CD cloud environment for software engineers to test their code and deploy
Boomi
Cloud and hosting
Boomi is the leading cloud-based integration platform as a service (iPaaS) that enables businesses to connect applications, data, and
Medallia
Education
Medallia is an American customer and employee experience management company based in Tysons, Virginia
Sprinklr
Customer support
Sprinklr is a provider of enterprise software solutions that help organizations unify customer-facing functions across digital
WalkMe
Productivity
WalkMe provides a platform for on-boarding and simplifying of user experience in web based
Revinate
Travel and hospitality
We power 950 million+ guest profiles and $17.2 billion in direct revenue for over 12,500 hotels
DataBank
Cloud and hosting
DataBank’s Managed Cloud transforms our Standard Cloud (IaaS) service into a comprehensively managed Platform-as-a-Service (PaaS)
Lightspeed POS
E-commerce
Lightspeed Commerce is a point-of-sale and e-commerce software provider based in Montreal, Quebec, Canada
Simetrik
Finance and accounting
No code enterprise SaaS for financial control automation.
Contentful
Developer tools
Contentful is a German-American headless content management system (CMS), founded in 2013 in Berlin, Germany, by Sascha Konietzke and Paolo
OpenAI
AI infrastructure
OpenAI is an AI research and deployment
Wiz
Security
Wiz is on a mission to transform cloud security for customers – which include 40% of the Fortune 100 – by empowering them to embrace a new
Dropbox
Cloud storage
Backup and share files in the cloud.
Fivetran
Data platforms
The leader in automated data movement
BeyondTrust
Identity and access
BeyondTrust Corporation is an American company that develops privileged access management (PAM) and vulnerability management software
Registry traps
Most Visa registry rows are Third Party Agent or ISO registrations, not PCI DSS validations. Those are excluded. The Mastercard SDP compliant service provider list is the second registry-grade source.
Level 1 service providers
Registries list Level 1 service providers with a QSA-signed ROC or AOC. Smaller merchants and service providers self-assess and do not appear.
Guides on PCI DSS
All articlesAnalysis
Three quarters of the Visa registry is not a PCI DSS validation
CertReports Research · 17 Sep 2026 · 10 min read
Explainers
Where PCI DSS evidence actually lives: the Visa and Mastercard registries
CertReports Research · 3 Sep 2026 · 10 min read