Get started
Reading certifications
A certification record says where a claim comes from. It is never our assessment of whether a company is compliant.
Status
| Value | Meaning |
|---|---|
registry_verified | An official registry lists the company, matched by the exact website in the registry's own record. Today: the FedRAMP Marketplace. |
self_declared | The company's own website states it. statement is its sentence, quoted as written. Two separate models must each agree that the page says the company itself holds the standard, not that it helps customers with it, is working toward it or relies on a provider that holds it. |
unverified | A registry listed the company before and does not now. This does not mean the claim is false. |
expired | The registry lists the certification as expired. |
Which standards have a public registry
| Standard | What we can check |
|---|---|
| SOC 2 | No public registry. Only the company's statement; the report itself is shared by the company, usually under NDA. |
| HIPAA | No official certification or registry. Only the company's statement of compliance. |
| ISO 27001 | The company's statement. We do not check an accreditation registry yet. |
| PCI DSS | The company's statement. We do not check a card network registry yet. |
| FedRAMP | The official FedRAMP Marketplace data, read every week. |
Type and level
variant, such as Type II or Level 1, is only set when the statement itself writes it. It is never inferred, and stays empty when the page says a later type is still in progress.
What was checked
coverage lists the company pages we read and the registries we matched, each with a date. A standard missing from the result was not found in those sources. That does not mean the company lacks it.
A statement that disappears
When two reads of a changed page no longer state a standard, we withdraw the record and raise a certification_claim_withdrawn event. A withdrawn statement is never shown as a claim.
Technologies and vendors
A certification belongs to a company. For a technology, we show the certifications of the company behind its website, only when that website is one we wrote by hand or confirmed by the company's name. scope_note says whose certification it is: a company's report may not cover every product it sells. When we cannot tie a technology to a company, holder is null, which says nothing about its vendor.