This report reads the CertReports index as of 30 Sep 2026: 13,399 public evidence rows across 7,301 B2B software vendors, drawn from 10 sources. It measures drift: how much public compliance evidence lapsed, how old it is, and how coverage differs by framework and category. Every figure below is computed from stored rows, dated, and reproducible.
- 2.2%
- of evidence rows are past their date
- 301 of 13,399 rows
- 0%
- of DPF listings linked to vendors have lapsed
- 0 lapsed, 1,622 active
- 1.8%
- of the top 2,000 vendors carry a lapsed PCI DSS row
- 35 of 1,981 vendors by demand rank
Lapse rates by framework
A row lapses when its own evidence says so: a certificate expiry, a report period plus twelve months, a registry usage end date, a registry validation date plus twelve months, or a dated registry withdrawal. Active rows are verified or stated rows whose date has not passed. Registry records marked inactive that carry no date at all (3,461 rows, almost all historical Data Privacy Framework and Privacy Shield participants) are counted separately and left out of every lapse share, because they describe the list's history rather than drift in the period.
| Framework | Active rows | Lapsed rows | Lapse share | Expiring in 90 days | Inactive, undated | Sources |
|---|---|---|---|---|---|---|
| EU-US Data Privacy Framework | 1,622 | 0 | 0.0% | 352 | 3,457 | dpf |
| PCI DSS | 3,564 | 301 | 7.8% | 848 | 0 | custom, drata, vanta, visa_grsp, wolfia |
| SOC 2 | 803 | 0 | 0.0% | 0 | 2 | csa_star, custom, drata, soc3, vanta, wolfia |
| FedRAMP | 759 | 0 | 0.0% | 0 | 0 | custom, drata, fedramp, vanta, wolfia |
| CSA STAR | 513 | 0 | 0.0% | 0 | 0 | csa_star, custom, drata, vanta, wolfia |
| GDPR | 471 | 0 | 0.0% | 0 | 0 | custom, drata, vanta, wolfia |
| ISO/IEC 27001 | 466 | 0 | 0.0% | 0 | 0 | csa_star, custom, drata, vanta, wolfia |
| CCPA / CPRA | 285 | 0 | 0.0% | 0 | 0 | custom, drata, vanta, wolfia |
| HIPAA | 231 | 0 | 0.0% | 0 | 0 | custom, drata, vanta, wolfia |
| SOC 3 | 103 | 0 | 0.0% | 0 | 2 | custom, drata, soc3, vanta, wolfia |
| ISO/IEC 27701 | 98 | 0 | 0.0% | 0 | 0 | custom, drata, vanta, wolfia |
| ISO/IEC 27017 | 97 | 0 | 0.0% | 0 | 0 | custom, drata, vanta, wolfia |
| SOC 1 | 95 | 0 | 0.0% | 0 | 0 | custom, drata, vanta, wolfia |
| ISO/IEC 27018 | 89 | 0 | 0.0% | 0 | 0 | custom, drata, vanta, wolfia |
| ISO/IEC 42001 | 83 | 0 | 0.0% | 0 | 0 | drata, vanta, wolfia |
| Cyber Essentials | 70 | 0 | 0.0% | 0 | 0 | custom, drata, vanta, wolfia |
| TX-RAMP | 69 | 0 | 0.0% | 0 | 0 | drata, vanta, wolfia |
| Cyber Essentials Plus | 38 | 0 | 0.0% | 0 | 0 | drata, vanta |
| IRAP | 31 | 0 | 0.0% | 0 | 0 | drata, vanta, wolfia |
| GovRAMP | 26 | 0 | 0.0% | 0 | 0 | drata, vanta |
| BSI C5 | 22 | 0 | 0.0% | 0 | 0 | drata, wolfia |
| ISO 22301 | 22 | 0 | 0.0% | 0 | 0 | drata, vanta |
| TISAX | 21 | 0 | 0.0% | 0 | 0 | drata, vanta, wolfia |
| HITRUST | 19 | 0 | 0.0% | 0 | 0 | drata, vanta |
| ENS | 14 | 0 | 0.0% | 0 | 0 | drata, vanta |
| DORA critical ICT provider designation | 10 | 0 | 0.0% | 0 | 0 | dora_ctpp |
| ISO 9001 | 7 | 0 | 0.0% | 0 | 0 | vanta |
Lapse share is lapsed divided by active plus lapsed, as of 30 Sep 2026. Inactive, undated registry records are excluded from the share.
- PCI DSS3017.8%
The top 2,000 vendors
The 2,000 highest-demand vendors in the catalogue (1,981 active) are the ones most reviews touch. This table asks a narrower question than the one above: how many of them carry at least one lapsed row per framework.
| Framework | Top-2,000 vendors with a row | With a lapsed row | Share of the top 2,000 |
|---|---|---|---|
| EU-US Data Privacy Framework | 1,019 | 0 | 0.0% |
| PCI DSS | 296 | 35 | 1.8% |
| SOC 2 | 273 | 0 | 0.0% |
| FedRAMP | 246 | 0 | 0.0% |
| CSA STAR | 219 | 0 | 0.0% |
| ISO/IEC 27001 | 204 | 0 | 0.0% |
| GDPR | 186 | 0 | 0.0% |
| CCPA / CPRA | 135 | 0 | 0.0% |
| HIPAA | 106 | 0 | 0.0% |
| ISO/IEC 27017 | 59 | 0 | 0.0% |
| ISO/IEC 27018 | 56 | 0 | 0.0% |
| ISO/IEC 27701 | 54 | 0 | 0.0% |
| SOC 3 | 53 | 0 | 0.0% |
| ISO/IEC 42001 | 48 | 0 | 0.0% |
| SOC 1 | 43 | 0 | 0.0% |
| Cyber Essentials | 37 | 0 | 0.0% |
| TX-RAMP | 36 | 0 | 0.0% |
| Cyber Essentials Plus | 21 | 0 | 0.0% |
| IRAP | 20 | 0 | 0.0% |
| BSI C5 | 16 | 0 | 0.0% |
| GovRAMP | 16 | 0 | 0.0% |
| TISAX | 14 | 0 | 0.0% |
| ENS | 11 | 0 | 0.0% |
| HITRUST | 10 | 0 | 0.0% |
| ISO 22301 | 8 | 0 | 0.0% |
| DORA critical ICT provider designation | 6 | 0 | 0.0% |
| ISO 9001 | 5 | 0 | 0.0% |
| ISMAP | 3 | 0 | 0.0% |
| HDS | 2 | 0 | 0.0% |
| NHS DSPT | 2 | 0 | 0.0% |
Evidence age
Days between the capture date of each row and 30 Sep 2026. Registries are re-read nightly, so registry rows stay young; vendor-stated rows age until the page is captured again.
| Framework | Rows | Median age (days) | 90th percentile (days) |
|---|---|---|---|
| EU-US Data Privacy Framework | 5,079 | 1 | 1 |
| PCI DSS | 3,803 | 1 | 13 |
| FedRAMP | 711 | 0 | 0 |
| SOC 2 | 623 | 9 | 9 |
| CSA STAR | 467 | 1 | 1 |
| GDPR | 358 | 9 | 9 |
| ISO/IEC 27001 | 343 | 9 | 9 |
| CCPA / CPRA | 191 | 9 | 9 |
| HIPAA | 165 | 9 | 9 |
| SOC 1 | 60 | 9 | 9 |
| ISO/IEC 27701 | 56 | 9 | 9 |
| ISO/IEC 27017 | 48 | 9 | 9 |
| ISO/IEC 42001 | 47 | 9 | 9 |
| ISO/IEC 27018 | 43 | 9 | 9 |
| Cyber Essentials | 40 | 9 | 9 |
| TX-RAMP | 34 | 9 | 9 |
| SOC 3 | 33 | 9 | 9 |
| Cyber Essentials Plus | 19 | 9 | 9 |
| ISO 22301 | 13 | 9 | 9 |
| IRAP | 13 | 9 | 9 |
| GovRAMP | 10 | 9 | 9 |
| DORA critical ICT provider designation | 10 | 1 | 1 |
HIPAA BAA coverage by category
Share of indexable vendors in each category with a public business associate agreement offer. There is no HIPAA certification; the offer is the public artefact.
| Category | Indexable vendors | With a public BAA offer | Coverage |
|---|---|---|---|
| Developer tools | 218 | 23 | 10.6% |
| AI tools | 93 | 23 | 24.7% |
| Data platforms | 65 | 13 | 20.0% |
| Analytics | 265 | 10 | 3.8% |
| Compliance and GRC | 165 | 9 | 5.5% |
| Security | 161 | 8 | 5.0% |
| Healthcare | 89 | 8 | 9.0% |
| Communications and CPaaS | 40 | 8 | 20.0% |
| AI infrastructure | 32 | 8 | 25.0% |
| Customer support | 102 | 7 | 6.9% |
| Cloud and hosting | 142 | 6 | 4.2% |
| Project management | 48 | 6 | 12.5% |
| AI assistants | 25 | 6 | 24.0% |
| No-code and automation | 110 | 5 | 4.5% |
| Identity and access | 74 | 5 | 6.8% |
FedRAMP status mix
Statuses as published in the Marketplace data file at the last sync, plus vendor-stated rows from trust centres. Under the Consolidated Rules for 2026 the official label is "FedRAMP Certified"; rows carry the text the file published.
- FedRAMP Authorized533
- FedRAMP Ready70
- Agency In Process48
- Vendor states FedRAMP Moderate on its trust centre37
- Vendor states FedRAMP High on its trust centre21
- Vendor states FedRAMP on its trust centre14
- FedRAMP In Process13
- Vendor states FedRAMP Rev. 5 on its trust centre7
Data Privacy Framework usage end
- 1,622
- Active DPF listings linked to vendors
- 0
- Past their usage end date
- 0.0% of active plus lapsed
- 352
- Usage end dates in the next 90 days
- 3,457
- Inactive listings with no usage end date
- historical participants, excluded from the lapse share
Drift index
The drift index is the number of rows that lapsed or were removed in a month per 1,000 active rows. It is the time series behind the change log; the first observed month is September 2026, when the index went live, so the series is short and will lengthen with each report.
| Month | Added | Renewed | Lapsed | Removed | Other events | Drift per 1,000 active rows |
|---|---|---|---|---|---|---|
| 2026-09 | 2561 | 371 | 50 | 53 | 10581 | 10.7 |
- 2026-0913,616
Events in the period
| Event type | Count |
|---|---|
| vendor indexed | 6,912 |
| subprocessor added | 2,754 |
| attestation added | 2,561 |
| auditor changed | 551 |
| attestation renewed | 371 |
| dpa changed | 192 |
| trust center moved | 78 |
| attestation removed | 53 |
| attestation expired | 50 |
| state changed | 48 |
| ai training policy changed | 26 |
| subprocessor removed | 13 |
| baa availability changed | 7 |
Trust reports behind the numbers
No high-demand vendor's evidence lapsed in September 2026. These are the highest-demand vendors with evidence due to lapse within 90 days of 30 Sep 2026. Each card is read live from the index, so it shows any renewal captured after the report was generated; the caption keeps the fact the report counted.
Intercom · Trust report
Customer support · Public evidence as of 2 Nov 2026
Framework overview
CertReports state for each framework with public evidence: 1 verified, 10 vendor-stated.
DPFVerifiedValid to 14 Nov 2026
HIPAAVendor-statedBadge only, BAA not captured
SOC 2Vendor-statedTrust centre · 30 Sep 2026
GDPRVendor-statedTrust centre · 30 Sep 2026
ISO 27001Vendor-statedTrust centre · 30 Sep 2026
CSA STARVendor-statedTrust centre · 30 Sep 2026
ISO 27701Vendor-statedTrust centre · 30 Sep 2026- ISO 42001Vendor-statedTrust centre · 30 Sep 2026
ISO 27018Vendor-statedTrust centre · 30 Sep 2026
2Documents and agreements
Legal and review documents Intercom publishes or offers, as of 30 Sep 2026.
- Subprocessor list · Public
- Privacy policy · Public
1Security practices
Public statements from Intercom, shown as statements, not attestations, as of 30 Sep 2026.
- Penetration testing · annual
14Subprocessors
Named on Intercom's public subprocessor list, last seen 30 Sep 2026.
Ably
Amazon Web Services, Inc.
Anthropic, PBC- CACartesia AI, Inc.
Cloudflare, Inc.
Eleven Labs, Inc.
Google
Mailgun Technologies, LLC- and 6 more on the evidence page
Tenable · Trust report
Security · Public evidence as of 2 Nov 2026
Framework overview
CertReports state for each framework with public evidence: 2 verified, 1 expired.
Blink · Trust report
Collaboration · Public evidence as of 2 Nov 2026
Framework overview
CertReports state for each framework with public evidence: 1 verified, 5 vendor-stated.
3Documents and agreements
Legal and review documents Blink publishes or offers, as of 30 Sep 2026.
- Subprocessor list · Public
- Privacy policy · Public
- Public trust centre documents · Blink ISO 27001 certificate 2026; Cyber Essentials PLUS Certificate; DSPT Certificate; Blink ISO 27001 certificate 2025; Blink ICO Registration Certificate
1Security practices
Public statements from Blink, shown as statements, not attestations, as of 30 Sep 2026.
- Penetration testing · annual
9Subprocessors
Named on Blink's public subprocessor list, last seen 30 Sep 2026.
- Amazon Web Services
- APApple
- APAppsFlyer
Hubspot- Intercom
- MIMicrosoft
- MIMixpanel
- SESentry
- TWTwilio
Method and sources
- Registry rows: FedRAMP Marketplace data file, Data Privacy Framework participant list, Visa Global Registry of Service Providers, CSA STAR registry, mirrored nightly.
- Vendor-stated rows: trust centres and security pages captured with a content hash and capture date.
- Lapse: expiry date, period end plus twelve months, usage end date, validation date plus twelve months, or withdrawal.
- Top 2,000: vendors ranked by demand in the CertReports catalogue.
- Drift index: (lapsed + removed) in the month divided by active rows at generation, per 1,000.
- Generated 1 Oct 2026. Figures for a closed month are frozen when the month ends; the current month is refreshed daily.
Cite this report
CertReports, Compliance drift report, September 2026. https://certreports.com/reports/2026-09. Figures as of 30 Sep 2026.