Companies Using RapidScan Secure SiteSeal

RapidScan Secure SiteSeal is the website badge of Aperia's PCI compliance programmes, and our October 2026 crawl counts it on 1,086 domains once lapsed seals are removed. A domain counts here when a page loads a script from www.rapidscansecure.com, and that script draws a badge reading CompliAssure SiteSeal. Click it and you get a record kept by Aperia: the merchant's name, its PCI status, the questionnaire it filed and the date it validated. 848 of the 1,086 domains match a company, and the seal ranks 9th of 17 in Security Testing & Compliance with 0.85%. Getting to that count meant removing 705 domains, and the reason is the most useful thing on this page.

A seal that comes with a card processor

Aperia Compliance doesn't sell to merchants directly. Its PCI Apply product is a white-labelled PCI programme for acquirers, ISOs, banks and payment platforms, and its home page claims more than 100 payment partners and 1.6 million merchants across their portfolios. Since a December 2024 merger, it has traded as Aperia Compliance, an IXOPAY company. A merchant meets it through its processor: Paya's support site, for example, sends its merchants to pciapply.com/paya.

The seal code shows the same structure. Each code is a number, a comma and a 40-character merchant key. Among the 1,006 live seals on this page there are 48 different leading numbers, and each one spans many unrelated merchants; the commonest covers 232 domains. I read that number as the partner programme. Each merchant still has its own key and its own record, so no single account covers other people's sites: the most domains sharing one key is 6, all carrying SynergenX's seal record. GoDaddy's DNS or mail sits on 341 of the 1,086 domains (31.40%), but before the cut those domains spread across 47 of the leading numbers and lapsed at the same rate as the rest, so GoDaddy isn't bundling the seal.

Sales signal: the buyer of the seal is the card processor, not the merchant. If you sell PCI tooling, the decision sits with the acquirer or ISO that runs the programme.

Four in ten seals had lapsed

Our crawl found the seal script on 1,791 live domains once 2 broken pages were filtered out. On 15 October 2026 I opened the verification record behind every code we could read. 1,006 domains led to a live merchant record. 703 led to a blank record, and on those sites the seal image no longer loads; 2 more were suspended sites. That's 41.20% of the 1,711 domains we could check, and all 705 are out of this page's numbers. The other 80 had no code we could read and stay in. The lapses cluster by programme: before the cut, 20 of 68 leading numbers had no live record left. Even live records age. Of 842 we read in full, 115 were last validated more than a year earlier, some in 2021, and still read Compliant.

"A seal script on a page tells you a business once validated PCI through its processor. Whether that record still exists is a separate question, and on four domains in ten the answer was no." - Mehmet Suleyman, CEO & Co-founder at TechnologyChecker.io

Sales signal: a lapsed seal is a lead in its own right. A merchant whose record went blank either moved processor or stopped validating, and both are conversations for a compliance or payments seller.

The chart

The chart has one point, 1,086 domains in October 2026, because the lapse test was run once. Our earlier monthly totals counted every seal script, working or not, so they can't be compared with it. Since we started tracking the seal on 4 August, 139 domains dropped it on at least one hostname, but 37 still carry it on another, so 102 left entirely.

Sales signal: there's no adoption trend to sell into here. Size the market on live records, about a thousand domains.

Who files for it

61.19% of matched companies with a known size have 1 to 10 staff and 29.87% have 11 to 50. Only 1 has more than 1,000. They're older than most web-tool customers: 46.46% were founded before 2000 and only 7.09% in the 2020s. The industries are the ones that take payment in person or by phone. Medical Practices leads at 7.46%, then Retail (6.9%), Construction (3.8%) and Consumer Services (3.24%). The seal records match. Of the 842 live records read in full, 228 were filed on SAQ A, for merchants who hand card handling to a third party, and 219 on SAQ C-VT, for merchants who key cards into a virtual terminal. The named users fit: Jeffer Mangels Butler & Mitchell runs it on its payment portal, SynergenX Health on its clinic site, the City of Spencer, Iowa on its town website.

Sales signal: these merchants pay a processor's PCI fee every year and rarely have IT staff. Payment-page hosting, managed WordPress and simple card-present upgrades are the pitches that fit.

What the seal says, and what it doesn't

The name suggests scanning, but the records show little of it. Of the 842 live records read in full, 661 (78.50%) show the quarterly ASV scan as Not Required, because the merchant's questionnaire doesn't call for one, and 180 show a compliant scan. Aperia's own disclaimer on each record says it makes no representation that the merchant's systems are secure. What the seal reports is paperwork filed through a processor.

"Nearly four in five live records say no scan was required. Read the seal as a receipt for PCI paperwork, filed through a card processor." - Mehmet Suleyman, CEO & Co-founder at TechnologyChecker.io

Sales signal: website security vendors have an opening here. These owners already put a security badge on their site, and 78.50% of the live records show no website scan under the programme.

Stack and neighbours

Across the 1,086 domains, Google Analytics runs on 73.39% and WordPress on 48.25%, with Elementor (11.97%) and Divi (5.16%) on top. Squarespace has 4.97%. The category table isn't like-for-like. eNamad is Iran's government trust seal, Have I Been Pwned counts verified domains and SafeBase hosts trust centres. SecurityMetrics, at 749 domains, is the only true rival, and its own page describes a PCI programme as a system acquirers use to track merchants. For a badge without the paperwork, TrustedSite's profile counts 93,953 live domains.

Sales signal: WordPress agencies and hosts serving US small businesses will find these sites familiar. The seal tells them the owner takes cards online.

What it costs

There's no public price. Paya's support page says its Aperia programme's annual cost is billed on the June statement and adds breach coverage of up to $50,000 per merchant ID. PracticeQ's says merchants who haven't validated keep paying a monthly non-compliance fee.

Sales signal: the non-compliance fee is the pain point. Merchants whose seals lapsed are likely paying it.

Key takeaways

1. 1,086 domains after 705 lapsed or suspended ones were removed, the same count our category table uses.

2. The seal is Aperia's CompliAssure badge, sold to card processors, which pass it on to their merchants.

3. 91.06% of sized companies have 50 or fewer staff, and 97.27% are American.

4. 78.50% of live records needed no quarterly scan.

How to use this list

Filter on industry and size, and re-check the seal record before you call. For the full list of 1,086 RapidScan Secure SiteSeal domains with company, size and stack data, explore TechnologyChecker.io. Our guide to technology detection methods explains why a script on a page is evidence of an install, not of a working product.