← Regulera

Trust Charter

A marketplace is only worth using if it isn't quietly working for one side. This document is how we make that checkable rather than something you have to take on faith.

Version1.0
PublishedJuly 2026
StatusPermanent
ChangesLogged publicly
01

Why this exists

Every marketplace claims to be neutral. Very few publish anything that would let you catch them if they weren't. The difference between a claim and a commitment is whether someone else can hold you to it.

Regulatory assurance makes this sharper than most categories. If a buyer picks the wrong assessor, the cost isn't a bad purchase - it's a failed audit, a missed deadline, or a report that doesn't hold up when someone senior reads it. And the parties best placed to advise on that choice are usually the parties billing for the work.

So we've written down the things we will not do, in enough detail that breaking them would be visible. This charter is permanent. It is versioned, and every change is logged below with the date and the reason.

02

The five commitments

These are the whole charter. Everything after this section is the detail behind them.

01

Regulera performs no assessments.

We are not an auditor, a QSA, a certification body, or a testing firm, and we will not become one. We do not white-label assessment work, subcontract it, or take a delivery role in any engagement arranged here. If that ever changes, this platform stops being a neutral market and we would have to say so on this page first.

02

No placement can be purchased.

There are no sponsored listings, no promoted results, no paid ranking, and no way to pay for visibility - now or later. A provider cannot buy its way into a match it isn't accredited for, and cannot buy a better position among providers that are. This is the commitment we expect to be tested on hardest, because it is the one most marketplaces eventually break.

03

Vetting criteria are published in full.

You can read exactly what a provider had to prove before appearing here, in section four. We would rather you judged the standard than trusted a badge. If you think the standard is too low, that is a useful thing for you to be able to tell us.

04

Our commercial model is disclosed to both sides.

Buyers and providers read the same explanation of how Regulera is paid, on the same page, in the same words. Neither side gets a version tailored to make it more comfortable.

05

Conflicts are declared where they arise.

Any relationship that could reasonably influence a match is stated on the profile where it applies - not buried in a policy document you would have to go looking for. Disclosure appears at the point of decision or it isn't disclosure.

03

Vetting criteria

Every provider must satisfy all of the following before it appears on Regulera. We verify with the issuing body directly. We do not accept a logo on a website, a PDF certificate, or a claim made during onboarding.

RequirementHow we verify it
Legal identity
Registered entity, jurisdiction of incorporation, and trading history confirmed against the relevant companies register.
Current accreditation
Confirmed with the issuing body - the PCI Security Standards Council, the accreditation body behind a certification body, the relevant national authority. We check that it is current, not merely once held.
Scope of authority
Which frameworks, which assessment types, and which regions the accreditation actually covers. A provider is only matched inside that scope.
Named qualified personnel
The individuals who would lead engagements, and their personal certifications, verified separately from the firm's. Firm-level accreditation with no qualified staff is not sufficient.
Professional indemnity
Current cover appropriate to the engagement sizes the provider intends to take, evidenced by certificate.
Standing with the accrediting body
No current suspension, revocation, or open disciplinary action. Re-checked on every re-verification.
Independence declaration
Ownership, group structure, and any affiliations that could affect independence - including relationships with Regulera itself.
Delivered engagements
Evidence of completed work in the frameworks the provider is applying to serve, with client references we contact directly.

Re-verification

Every provider is re-verified annually, and immediately whenever an accreditation changes, lapses, or comes under review. A provider whose accreditation lapses is removed from matching that day, not at the next review cycle.

Grounds for removal

A provider is removed for loss or suspension of accreditation, misrepresentation of scope or credentials, undisclosed conflicts, or a pattern of substantiated complaints about engagements arranged through Regulera. Removals are not negotiable and cannot be appealed commercially.

05

Conflict policy

A conflict is any relationship that could reasonably make someone doubt that a match was made on merit. The test we apply is not whether a relationship did influence an outcome, but whether a reasonable person would want to know about it.

Structural

Regulera performs no assessments, so the largest conflict in this category - recommending a provider while competing with them - does not exist here. Regulera holds no ownership interest in any listed provider. If that ever changes, the holding is declared on that provider's profile and on this page, and the provider receives no advantage of any kind.

Personal

Anyone working at Regulera is prohibited from accepting fees, gifts, hospitality of material value, equity, or referral commissions from a listed provider. Prior employment or a personal relationship with a listed provider must be declared internally, and that person is removed from any decision affecting the provider.

Disclosure at the point of decision

Where a conflict exists, it appears on the provider profile you are looking at, in plain language, at the moment you would use it - not in a register you would have to seek out. A disclosure you have to go looking for is not a disclosure.

Raising one

If you believe a match, ranking, or listing has been influenced by something undisclosed, tell us. We will respond with what we found and what we changed, and if a change to this charter follows, it appears in the log below.

06

Changes to this charter

This charter is versioned. Every change is published here with the date, what changed, and why. We do not edit it silently, and we do not remove commitments without saying that a commitment was removed.

VersionDateChange
1.02026-07First publication. Five commitments, vetting criteria, and conflict policy established. Fee structure marked as pending.
Hold us to it

A commitment nobody can check is just marketing.

If you think we've broken one of these, or that the standard in section three is too low, we want to hear it - from buyers and providers equally. Substantiated challenges change the charter, and the change gets logged.

trust@regulera.com