Trust
How the index is ordered.
Organic lists are newest published first, or name, or review count — you pick. Paid plan does not move a company up that list.
Promoted is a separate shelf, gold left rail, labeled. Maximum three per category on the paid product. Home shelf is the same inventory.
Reviews can be retracted by the author. The company may respond. The company cannot delete. We do not sell review placement.
Rotten potatoes is a community nomination list. Same retract rules. Not for sale.
Vendor participation. Free listings appear in company profiles and directory browsing. Company and product comparisons, alternatives and requirement-based shortlists feature vendors on Verified and Featured plans. These tools are free for buyers to use.
Matches and comparisons use listed capabilities, shared market focus and supporting evidence. Within the participating vendor pool, a higher-priced plan does not improve capability coverage or similarity. Participation is not an endorsement; sponsored placements are labeled separately.
Featured promotion. An active paid Featured subscription includes one reviewed message, rotating across the homepage, up to three relevant categories and matching alternatives pages. It shares the message slot with Click Ads; placement frequency and results are not guaranteed. Included visits have no extra click charge. Owners can pause their promotion and request setup help from their dashboard. Featured listings may also have complimentary launch visibility, disclosed on the page.
Identity and listing plans
Verified and Featured are listing plans, including complimentary plans assigned by the directory. They describe available features, not proof of identity.
An “Identity reviewed” badge requires a separate, evidence-backed check connecting the company name to its official website through a public source. The profile shows that source, the check date and the expiry date. Automated checks are labeled and require the company name on the listed official website; inaccessible pages, cross-domain redirects and inconclusive names require follow-up. A completed check alone does not grant a badge. Reviews expire after one year; changing the name or website domain requires a recheck. An editor can revoke a review. Public pages update after the next successful catalog refresh.
Free companies can be reviewed. Payment does not grant or renew this badge. A claimed profile means an account manages it; it does not substitute for identity evidence. Identity review is not a security audit, product certification, financial assessment or recommendation, and says nothing about whether a product meets a specific requirement.
Credential evidence and scope
Certification filters use current, scoped public evidence. A bare tag or a well-known company name does not qualify. Each record identifies the covered organization, service or team, a source, a check date and any expiry published by that source. We stop using evidence after 180 days without a new documentation check, or sooner when a stated expiry passes. A name or website-domain change requires a recheck.
Company certifications, service authorizations, attestations and staff qualifications are different claims. A staff credential does not certify the company; a report or authorization may cover only one service, legal entity or period. An omitted expiry means the source does not state one, not that the credential lasts forever. Read the source and request the relevant certificate or report before relying on it.
Missing evidence means “not documented here,” not “uncertified.” Listing payment does not establish a credential. Documentation checks are not independent certification audits.
Counts on this site are the published seed plus whatever an admin has published. We do not round up for marketing.
Independent rankings on /rankings are public GitHub org stats (repositories, open issues, stars). Paid plan does not move a row. Mega-orgs that are not the security product team are omitted. These are not quality scores.