The Peptide Index assigns every US vendor a trust tier from public records only. This page is the whole method: the exact records we read, how each tier is assigned, and — for every signal — how you can confirm it yourself at the original source. If we can’t prove it, we don’t publish it.
A trust index is only worth anything if it is honest about what it does and does not know. Five rules bind everything below.
Every vendor lands in exactly one of three tiers, decided by a documented, versioned rule set — not an editor’s opinion. A separate Caution overlay can sit on top of any tier. The thresholds below are the literal rules the scorer applies.
An independently confirmed legal identity and an established domain, with nothing adverse on record.
Assigned when all hold:
A resolvable business identity or a real operating history — but not the full set Verified requires.
Assigned when at least one holds:
A vendor that would otherwise be Verified but carries a regulatory enforcement record lands here, with the Caution overlay.
Not enough public information to verify this vendor yet. This lowers confidence — it is not a negative finding.
Assigned when:
Operating anonymously is common and lawful in this market. Neutral means unproven, not untrustworthy. (Shown as “Neutral”; recorded internally as the baseline tier.)
Any public enforcement record — an FDA warning letter, an FTC or ITC action, a Health Canada alert, or a DOJ criminal case — adds a factual Caution badge and blocks the Verified tier. It sits on top of whatever tier the vendor earned. Each action is stated with its reference, date and link, and attributed to the issuing agency. A criminal case is the highest-severity record and additionally caps the vendor at the Neutral floor. We report the record; we do not characterise guilt.
For each signal: what it is, how we determine it, and how you can verify it yourself. Every one is drawn from a source you can open.
What it is The legal entity (usually an LLC) that runs the storefront — the strongest positive identity signal we hold.
How we determine it We resolve it by one of five methods, and we always label which one:
Verify it yourself Open the state Secretary-of-State business search or the USPTO TSDR record linked on the profile and search the entity name. A trademark or SoS record is a sworn public filing; a self-disclosed name is the vendor’s own claim until a registry confirms it.
What it is How long the storefront’s domain has been registered. 6 months is the floor for Verified; 5 years counts as an established presence on its own.
How we determine it We read the domain’s creation date from RDAP (with a WHOIS fallback) at the authoritative registry.
Verify it yourself The profile’s Verify link opens a public WHOIS/RDAP lookup for the domain; the creation date we cite is on that record. A newer domain is a neutral factor — it lowers confidence, not trust.
What it is The certificate the site serves over HTTPS, and what kind of validation stands behind it.
How we determine it From a live handshake, cross-checked against certificate-transparency logs. An organization-validated (OV/EV) certificate carries a CA-verified legal organization — a factual positive. A domain-validated (DV) certificate (e.g. Let’s Encrypt) is the neutral norm for most sites. A certificate that does not validate (expired, self-signed, or host-mismatched) blocks Verified — stated as a neutral technical fact, not an accusation.
Verify it yourself The Verify link opens crt.sh for the domain, where you can inspect every certificate ever issued for it.
What it is Whether the domain’s registrant is disclosed or hidden behind a WHOIS privacy/proxy service.
How we determine it From the registrant fields in the RDAP/WHOIS record. A named registrant organization is a mild transparency positive. Concealment behind a privacy service is near-universal and neutral — it lowers confidence, never trust, and never moves the tier.
Verify it yourself The Verify link opens an RDAP lookup; you can read the registrant (or the privacy-service name) directly.
What it is Whether the operating entity is formed in a privacy-forward state whose filings limit public disclosure of owners and officers.
How we determine it From the registration state on the resolved entity. This is a neutral registration-jurisdiction note — a common, lawful choice, presented as context, never a negative finding.
Verify it yourself The state named on the profile is the entity’s own filing jurisdiction; the SoS search for that state shows what its records do and don’t disclose.
What it is Any public enforcement action on record — FDA warning letter, FTC or ITC action, Health Canada alert, or DOJ criminal case. This is the one signal that is a genuine negative.
How we determine it We screen public agency records. A hit sets the Caution overlay and blocks Verified; a criminal case caps the vendor at the Neutral floor. A clean screen is a mild reassurance; an unscreened vendor simply has lower confidence.
Verify it yourself Each action carries the agency’s reference, date, jurisdiction and a link to the agency’s own record. Open it; the record speaks for itself.
What it is Whether a purchase carries a chargeback or dispute path.
How we determine it From the payment methods the storefront publicly displays. A shop that accepts only cryptocurrency or peer-to-peer apps — no cards, no recourse-bearing wallet — leaves a buyer no dispute path. That factual limitation blocks Verified; it is stated neutrally and is not an accusation.
Verify it yourself Check the vendor’s own checkout page for the payment methods it accepts.
What it is Whether the vendor publishes prices we can index and normalise to a single $/mg figure.
How we determine it We index publicly listed prices nightly, ex-shipping, and normalise them to USD per milligram so they compare across pack sizes and vendors.
Verify it yourself Every priced compound on a profile links to the live price view, and the vendor’s own listing is one click away.
Methodology version 1.4.2 · Every stored tier is reproducible from the signals and thresholds documented above.