Skip to main content
Research use only. Prices updated nightly · vendor record checks dated one by one (most re-checked daily or weekly) · not independently verified · not medical advice.
Peptide Price HistoryPowered by the Peptide Index
Methodology

How we determine if a vendor is verified

The Peptide Index assigns every US vendor a trust tier from public records only. This page is the whole method: the exact records we read, how each tier is assigned, and — for every signal — how you can confirm it yourself at the original source. If we can’t prove it, we don’t publish it. How prices are calculated is a separate page: how $/mg works.

Our promise

A trust index is only worth anything if it is honest about what it does and does not know. Five rules bind everything below.

  • Exact or nothing. We publish a signal only when it resolves to a specific, checkable public record — a registry filing, a federal trademark, a WHOIS date, a served certificate. No inference, no “probably.”
  • Every claim links its proof. Next to each fact on a vendor profile is a Verify link that opens the primary source — the state Secretary of State, USPTO TSDR, an RDAP/WHOIS lookup, crt.sh, or the issuing agency. You never have to take our word for it.
  • US-based resellers only. We index vendors that present as United States resellers. Overseas storefronts are out of scope and excluded, so a tier is always comparing like with like.
  • We show “Neutral” honestly. When there isn’t enough public information to verify a vendor, we say so plainly rather than guess. Neutral means unproven, never bad.
  • We surface facts, we do not accuse. Where a public enforcement record exists we state it factually and attribute it to the agency that issued it. A record is a matter of public record — not a conviction, a safety verdict, or an allegation of wrongdoing by us.

Trust tiers

Every vendor lands in exactly one of three tiers, decided by a documented, versioned rule set — not an editor’s opinion. A separate Caution overlay can sit on top of any tier. The thresholds below are the literal rules the scorer applies.

Verified

An independently confirmed legal identity and an established domain, with nothing adverse on record.

Assigned when all hold:

  • A strong entity — a USPTO-trademark-resolved owner or a Secretary-of-State-confirmed entity (a third party you can check, not the vendor’s own claim)
  • Domain age ≥ 0.5 years online
  • No public enforcement action, a valid TLS certificate, and a payment path with buyer recourse
  • Publicly posted third-party Certificates of Analysis on the vendor’s own site, re-checked within the last 180 days (we record that reports are posted, not what they show)

Established

A resolvable business identity or a real operating history — but not the full set Verified requires.

Assigned when at least one holds:

  • A strong entity, but the domain is newer than 6 months (or its age is unknown)
  • A self-disclosed legal entity we could not yet independently confirm
  • Domain age ≥ 5.0 years online, on its own

A vendor that would otherwise be Verified but carries a regulatory enforcement record lands here, with the Caution overlay.

Neutral

Not enough public information to verify this vendor yet. This lowers confidence — it is not a negative finding.

Assigned when:

  • No legal entity resolves from any public record, and
  • No meaningful domain longevity is on record

Operating anonymously is common and lawful in this market. Neutral means unproven, not untrustworthy. (Shown as “Neutral”; recorded internally as the baseline tier.)

Caution — an overlay, not a tier

Any public enforcement record — an FDA warning letter, an FTC or ITC action, a Health Canada alert, or a DOJ criminal case — adds a factual Caution badge and blocks the Verified tier. It sits on top of whatever tier the vendor earned. Each action is stated with its reference, date and link, and attributed to the issuing agency. A criminal case is the highest-severity record and additionally caps the vendor at the Neutral floor. We report the record; we do not characterise guilt.

Signals we check

For each signal: what it is, how we determine it, and how you can verify it yourself. Every one is drawn from a source you can open.

Operating entity

What it is The legal entity (usually an LLC) that runs the storefront — the strongest positive identity signal we hold.

How we determine it We resolve it by one of five methods, and we always label which one:

  • StrongState registry recordan active Secretary-of-State business filing
  • StrongUSPTO trademark registrantthe owner of a live federal trademark in a peptide-relevant class
  • SupportPublic federal recordan entity named in another public federal filing
  • SupportUSPTO trademark applicanta pending (not yet registered) trademark application
  • Self-assertedSelf-disclosedan entity the vendor names on its own site, not yet independently confirmed

Verify it yourself Open the state Secretary-of-State business search or the USPTO TSDR record linked on the profile and search the entity name. A trademark or SoS record is a sworn public filing; a self-disclosed name is the vendor’s own claim until a registry confirms it.

Domain age

What it is How long the storefront’s domain has been registered. 6 months is the floor for Verified; 5 years counts as an established presence on its own.

How we determine it We read the domain’s creation date from RDAP (with a WHOIS fallback) at the authoritative registry.

Verify it yourself The profile’s Verify link opens a public WHOIS/RDAP lookup for the domain; the creation date we cite is on that record. A newer domain is a neutral factor — it lowers confidence, not trust.

SSL / TLS certificate

What it is The certificate the site serves over HTTPS, and what kind of validation stands behind it.

How we determine it From a live handshake, cross-checked against certificate-transparency logs. An organization-validated (OV/EV) certificate carries a CA-verified legal organization — a factual positive. A domain-validated (DV) certificate (e.g. Let’s Encrypt) is the neutral norm for most sites. A certificate that does not validate (expired, self-signed, or host-mismatched) blocks Verified — stated as a neutral technical fact, not an accusation.

Verify it yourself The Verify link opens crt.sh for the domain, where you can inspect every certificate ever issued for it.

Ownership transparency

What it is Whether the domain’s registrant is disclosed or hidden behind a WHOIS privacy/proxy service.

How we determine it From the registrant fields in the RDAP/WHOIS record. A named registrant organization is a mild transparency positive. Concealment behind a privacy service is near-universal and neutral — it lowers confidence, never trust, and never moves the tier.

Verify it yourself The Verify link opens an RDAP lookup; you can read the registrant (or the privacy-service name) directly.

Location check

What it is A plain notice shown when the country on the domain’s registration differs from the country the store itself states (the address on its own contact or about page, or its registered operating company).

How we determine it We compare countries only, and only when both facts are known with a source and a date. The registration country is re-read from the public RDAP record every night. A registration hidden behind a privacy service never triggers it, because the address shown is the service’s, not the store’s. It is a notice, not a rating — it never changes the tier and never adds Caution.

Verify it yourself The notice links both sources with the date each was checked. Stores can correct either fact through the correction form.

Registration jurisdiction

What it is Whether the operating entity is formed in a privacy-forward state whose filings limit public disclosure of owners and officers.

How we determine it From the registration state on the resolved entity. This is a neutral registration-jurisdiction note — a common, lawful choice, presented as context, never a negative finding.

Verify it yourself The state named on the profile is the entity’s own filing jurisdiction; the SoS search for that state shows what its records do and don’t disclose.

Enforcement & regulatory record

What it is Any public enforcement action on record — FDA warning letter, FTC or ITC action, Health Canada alert, or DOJ criminal case. This is the one signal that is a genuine negative.

How we determine it We screen public agency records. A hit sets the Caution overlay and blocks Verified; a criminal case caps the vendor at the Neutral floor. A clean screen is a mild reassurance; an unscreened vendor simply has lower confidence.

Verify it yourself Each action carries the agency’s reference, date, jurisdiction and a link to the agency’s own record. Open it; the record speaks for itself.

Payment recourse

What it is Whether a purchase carries a chargeback or dispute path.

How we determine it From the payment methods the storefront publicly displays, with one evidence rule (methodology 1.5.1): card acceptance counts only when it is visible at checkout level — a wired-in card processor, the payment icons a Shopify checkout has enabled, or a card option or field at checkout. A card mention in FAQ or footer text alone is recorded as claimed: neutral, never a positive. Where the checkout we could see offers no card and no recourse-bearing wallet, the store is treated as accepting crypto, bank or peer-to-peer only, even if its text mentions cards. A shop that accepts only cryptocurrency or peer-to-peer apps — no cards, no recourse-bearing wallet — leaves a buyer no dispute path. That factual limitation blocks Verified; it is stated neutrally and is not an accusation.

Verify it yourself Add a product to the cart on the vendor’s own site and read the payment options its checkout page offers. Each signal on the profile carries the date we last read it.

Price transparency

What it is Whether the vendor publishes prices we can index and normalise to a single $/mg figure.

How we determine it We index publicly listed prices nightly, ex-shipping, and normalise them to USD per milligram so they compare across pack sizes and vendors.

Verify it yourself Every priced compound on a profile links to the live price view, and the vendor’s own listing is one click away.

Shared identifiers

What it is A notice on a profile when another store in our index carries the same identifier: the same analytics or ad-tracking ID, one security certificate covering both sites, the same phone number, the same street address including the suite number, or the same lab-test batch number or file. Shared identifiers can mean shared ownership, a shared contractor, or a shared service. This is not a finding that the stores are run by the same people, and it never changes a trust tier.

How we determine it Every night we read each store’s home and contact pages (robots.txt respected, with our named crawler) and the certificate its site serves, and compare exact values. Weak overlaps — the same web host, theme, registrar or registered-agent mailing address — never count, and IDs that belong to a shared platform are ignored. A page we could not read never adds or removes a notice. A store’s owner can dispute a notice from their signed-in PeptideIQ account; while that dispute is reviewed, the notice is withheld. Anyone can also report an error through the profile’s correction form — a person reviews it, and the notice stays up meanwhile.

Verify it yourself Each notice names the other store, what matches, and when we first and last saw it. The IDs are in each site’s own public page source; the certificate is in your browser’s padlock view.

How to read a profile

  1. Start with the tier badge. It states the tier and a one-line plain-language meaning. A Caution badge beside it means a public enforcement record exists — scroll to the enforcement section for the specifics.
  2. Read the operating entity. If a legal entity resolved, it shows the name, the method that established it, and a Verify link. “Not disclosed” is neutral, not a red flag.
  3. Work down the signals. Each is tagged positive, neutral, or negative, with the record it came from and its date. Follow any Verify link to the primary source.
  4. Remember Neutral is a floor, not a verdict. A Neutral vendor may simply have little public information on record yet — that is not an accusation.
  5. If you operate the vendor, correct us. Every profile has a correction form; documented corrections update the record.

Scope & limits

  • US resellers only. We index vendors presenting as United States resellers; overseas storefronts are excluded.
  • A large share are Neutral — by design of the market, not by our judgement. Many vendors operate anonymously: WHOIS behind a privacy proxy, an LLC formed in a privacy-forward state that discloses no owners. With no public identity to confirm, the honest tier is Neutral. We would rather say “unproven” than invent confidence.
  • Signals are point-in-time. Each carries the date it was checked. Records change; a profile reflects what was public when we last read it.
  • Preliminary and not independently audited. This is a transparency index built from public records — not an endorsement, a safety verdict, or a recommendation to purchase.
  • Corrections are welcome. If a fact is wrong or out of date, tell us from the vendor’s profile correction form. A person reviews every submission before anything changes; nothing is published automatically.

Methodology version 1.5.1 · Every stored tier is reproducible from the signals and thresholds documented above.

“Selling since” is an estimate

A store page may say “Selling since about Jul 2026 (estimate)”. It is a month, never an exact date, and it is not part of the trust tier. We work it out once a week from three public signals and show it only when they support it:

  • The store’s own first product. The date of the oldest product in the store’s public product list (the feed the store’s platform publishes to every visitor). It is the main signal. It can be wrong, for example when a store imports products from an older site.
  • When the domain was registered. From the public domain registry. This is only a lower bound: a name is often bought months before a store opens.
  • The earliest web-archive copy that shows prices. From the Internet Archive. This is a late upper bound, because the archive visits a new store weeks or months after it opens. Copies from before the current domain was registered belong to another site and are ignored.

Confidence. High means two of these agree within about six weeks. Medium means one usable signal. When the signals contradict each other, or only the registration date is known, we show nothing. We only read a store’s own pages after checking its robots.txt, and we do not read stores that forbid it.

Tracked by us since is a different fact: the first night our own crawler recorded the store. It says nothing about when the store opened.

How to cite this page: The Peptide Index (Peptide Price History). “How we determine if a vendor is verified: trust tier methodology.” https://www.peptidepricehistory.com/verification/. Trust tiers are computed from public records by a published, versioned rule set; the method is also summarised in the price methodology.