Different questions need separate evidence
PepCred does not force pharmacies, testing services, research sellers and compounds into one trust score. Start with the route that matches what you are checking; each uses different evidence and different limits.
Choose the right evidence route
A, B and C must be shown separately
A hard failure overrides every softer positive. A polished site, real company or COA can never rescue an unavailable or unapproved human-use product.
Product status
Is the exact product approved and legally available for human use? Investigational, warned or unapproved products stop here.
Business and legal route
Do the operator, company history, prescriber, pharmacy, regulator and contact details independently match?
Exact purchase
Does the exact medicine/supply chain or exact research batch match independent evidence—not a seller-controlled claim?
Prescription services
We check the chain behind the website, not whether a familiar brand feels trustworthy.
The evidence route is the exact website domain, its legal operator, the clinical provider responsible for prescribing and the dispensing pharmacy. UK checks use the relevant official company, care-provider and pharmacy registers; US checks depend on the applicable state medical and pharmacy records. A matched registration establishes that cited record only. It does not guarantee every consultation, prescription, product or transaction.
1 · Unrated
Official service identified; no independent provider score.
2 · Operator
Legal operator independently matched; care route incomplete.
3 · One care role
Clinical provider or pharmacy matched; the other remains unresolved.
4 · Full named route
Operator, clinical provider and pharmacy matched; official findings remain a separate warning.
What a legal authorised route looks like
- The exact branded medicine and indication are authorised in the buyer's country.
- A real clinical assessment happens before a prescription is issued.
- The consumer service is connected to the regulated clinical provider and dispensing pharmacy.
- For the USA, prescriber and pharmacy authority covers the patient's state.
What does not count
- An ingredient name, company registration, Trustpilot score or seller badge.
- A research vial, raw powder or compounded product described as FDA/MHRA approved.
- Buying a prescription-only medicine without a prescription or meaningful consultation.
- A national US brand with no patient-state prescriber and pharmacy match.
Compound evidence method Open
Evidence Grade (A–F)
Graded purely on the strength of published evidence. Tiers are never conflated.
Evidence is ranked on a strict ladder, strongest first:
- A — Two or more confirmatory human RCTs (an approved product, or completed Phase 3).
- B — One human RCT, Phase-2-only RCTs, or three or more other human studies.
- C — At least one other human study.
- D — Animal evidence only.
- F — In-vitro / mechanistic only, or none.
Investigational compounds whose only RCTs are Phase 2 cap at B, never A.
Animal or in-vitro results are never presented as established human outcomes. Each grade carries a grade-confidence level (High / Medium / Low) — how settled the grade is given the record, not how likely the compound is to work. A preclinical-only record (no human evidence) never exceeds Low confidence.
Route stage, official status and confidence
These are separate signals. Route stage shows how much of the service chain is independently connected. Current regulator findings are shown alongside it and never hidden inside one blended score.
Category-specific route stages
No match
No exact evidence matched.
Unrated
Official service website identified; no independent provider stage yet.
Provider
Legal operator or regulated provider independently matched.
One route role
Diagnostics: a current named-laboratory credential is found, while exact test allocation can still vary. Prescriptions: one regulated care role matched.
Exact route
Diagnostics: test-to-laboratory scope matched. Prescriptions: prescribing and dispensing routes matched.
Levels 0 and 1 are Unrated: finding a company's own website never produces a positive route stage. Adverse records do not change route stage or evidence confidence; they appear as a separate official-status warning. Confidence describes freshness, source independence and how securely each relationship is bound. High confidence requires independent evidence connecting every relevant regulated role to the service—not merely a seller naming a real credential.
Technical research-seller audit · not a buying ranking Open
Four channels. One composite. No hidden maths.
These are the live weights from the scoring engine — the same constants published on the methodology page. If any channel lacks verified data, it reads “insufficient”, never an invented number — today that is true of lab reliability and verified experience, so no vendor carries an overall trust score yet.
- 1Lab reliabilityweight 55%awaiting data
Independent third-party test results only. Minimum 1 independent result before any score exists.
- 2Verified experienceweight 0%awaiting data
Aggregated community reports with Bayesian shrinkage. Fewer than 3 qualifying reviews → "insufficient", not a number.
- 3Transparencyweight 30%
A checklist crawled from the vendor's own published pages — batch COAs, a named lab, shipping origin, “research use only” labelling.
- 4Stabilityweight 15%
Domain-registration age and record consistency from ICANN RDAP and Companies House.
- ΣThe composite readout
Weighted channels combine into one 0–100 score with a letter grade at the published cut points — and a confidence grade that says how much verified data sits underneath. Every figure links to its source.
The verdict (the headline signal)
Decided only by hard public-record facts — never by reviews or a vendor's own claims. This is what every vendor leads with today.
- High-risk signals
- At least one serious public-record flag — for example, a research catalogue using a prescription-medicine ingredient name without a matched regulated care route, or an open regulator warning.
- Some caution
- A softer flag worth knowing — for example, a brand-new domain or a possible shared operator — but nothing serious found.
- Limited public record
- Too little public record to give a verdict — usually a site we couldn't reach or a domain with no registration record. Never counted against the vendor.
- No red flags found
- No red flags in the public record we checked, plus at least one hard-to-fake positive (an established domain or a company-register match).
No vendor carries an overall 0–100 trust score yet: that needs verified independent evidence, which does not yet exist for these vendors. Until then the verdict above — not a number — is the headline. The three 0–100 sub-scores below are computed and shown where data exists.
Technical evidence signals—not buying ratings
These diagnostics expose gaps and inconsistencies. They never rank sellers or override A, B or C.
Review intelligence · display only
Licensed business-level aggregates may identify complaint patterns. PepCred stores no usernames, author hashes or review text in the new pipeline. Reviews carry zero positive weight and never create a green finding.
positive verification weight = 0 access = licensed API only storage = aggregate topics only
Lab Reliability
From independent lab results: median HPLC purity vs label, identity pass rate, quantity accuracy and contaminant screens.
Vendor-submitted COAs are cherry-picked, so they carry lower confidence and alone cap the score at 60. A high independent-lab score requires qualifying independent results.
Transparency
The crawl now records batch/COA links, named laboratories, shipping and payment claims, RUO wording, legal names and company numbers, email domains, phones, contact/about/terms/privacy/returns pages, “no prescription” claims, human-use language beside research-only disclaimers, and whether testimonials are site-controlled or link to an external platform. Auto-crawled from each vendor's own published pages, with the quote and URL attached. Seller-controlled claims receive zero positive verification weight. A signal we can't find is shown as “not found” (neutral) — never recorded as a failure, because a crawl can't prove a negative.
Trust Score & confidence-gating
Default weights
Composite = 0.55·Lab + 0.00·Reviews + 0.30·Trans + 0.15·Stability. Weights are versioned (currently v1.0.0).
When lab confidence is low → reweighted
If independent lab data is sparse, weight shifts off Lab toward Transparency and Stability, and the caveat is shown on the Readout. We never let a thin lab signal masquerade as strong.
Grade bands
Display thresholds (hard rules)
- Reviews and forum mentions carry
0positive-verification weight. - Lab score needs ≥
1independent result; vendor COAs alone don't unlock it. - Seller PDF: a seller-controlled COA is a claim only.
- Lab-portal match: a report ID and exact lot that verify at the named laboratory support that batch, but do not prove who selected or handled the sample.
- Independent procurement: a documented blind purchase with chain of custody is the strongest batch evidence.
- Seller-level tested status requires at least
3verified reports with documented blind-purchase chain of custody across at least2batches and2products, a matched legal identity and no unresolved severe official event. - Regulatory events are shown as sourced alerts, never a silent penalty.
Conflict-of-interest rules
- • Vendor payment never changes a score, rank or confidence grade. This is enforced in code — no payment field can touch the maths.
- • Every negative signal is traceable to a cited source. No unsourced claims about any business, ever.
- • Every
vendor_scoresrow is retained, so the history is inspectable. The same inputs always produce the same outputs. - • The authority spine is free, official data: PubMed, Crossref, ClinicalTrials.gov, openFDA, DailyMed, regulator feeds, Companies House and ICANN RDAP. Community sentiment is a layer on top.
See our disclosures for every commercial relationship, and the corrections log for changes and right-of-reply.
What the words mean
Every term we use that is not everyday English, in one place.
- Human-use route
- A legal path for a medicine to reach a person — a prescriber and a registered pharmacy. Selling the same ingredient as a “research chemical” is not one.
- Research use only
- A label some sellers put on products to avoid medicines law. It does not make a product safe, tested, or legal to take.
- Transparency signals
- Basic things an honest business publishes on its own site: a real address, who runs it, returns and contact details. We count how many we could find.
- Companies House
- The UK's official register of companies. A match proves a real legal business exists — not that its products are any good.
- GPhC
- The General Pharmaceutical Council — the UK regulator pharmacies must register with. You can look any pharmacy up on its public register.
- CQC
- The Care Quality Commission, which inspects health services in England.
- CLIA
- The US programme that certifies clinical laboratories for testing human samples.
- Domain age
- How long the website address has existed. It cannot be backdated, so a brand-new address behind an established-looking brand is a warning sign.
- Evidence grade
- How strong the published science is, A to F. It rates the research only — not whether something is safe or whether a seller is honest.
- Independent lab result
- A test the seller did not pay for or hand-pick. A certificate on a seller's own site is a claim; a result we verified with the lab is proof.
- COA
- Certificate of analysis — a lab report saying what is actually in a batch. On a seller's own site it is a claim, because they chose which one to publish.
- Gate
- A check that has to pass before we will call something safe to buy for yourself. If it fails, nothing else can make up for it.
- Operator fingerprint
- Signs that two “separate” brands are run by the same setup — the same server, the same page template, the same contact details. It is a clue, not proof of ownership.
- Receipts
- The sources behind a finding. Every claim we make links to the record we read it in, so you can check it yourself.
- Unapproved
- No medicines regulator (the MHRA in the UK, the FDA in the USA) has approved this substance as a medicine for people. It is not a judgement about the seller.
- Prescription-only
- By law a prescriber has to authorise it and a registered pharmacy has to supply it. Buying it any other way is not legal, whatever the label says.
- Regulator-warned
- A medicines regulator has published a warning about this substance. We link the warning so you can read it in their words.
- RDAP record
- The official registration record for a website address, including the date it was first registered. It comes from the registry, so a seller cannot edit it.
- Evidence level
- How much of a seller's identity and supply route we have managed to match to official records, out of four steps. A low number means we could not check, not that something is wrong.
- MHRA
- The Medicines and Healthcare products Regulatory Agency — the UK body that approves medicines and acts against illegal sellers.
- FDA
- The Food and Drug Administration — the US body that approves medicines and publishes warning letters to companies.
- UKAS
- The UK body that accredits laboratories. An accredited lab has been independently checked as competent to run the tests it offers.