PCI SSC Qualified Security Assessor (QSA) Company Directory

Scrapes the PCI Security Standards Council's public QSA company directory — the authoritative list of companies qualified to perform PCI DSS assessments — into clean, structured JSON. The official page only exposes a client-side "Export List" button behind a per-session token; this Actor reproduces that same request so the full dataset is available for scheduled/programmatic pulls.

Why use this Actor?

Any merchant or service provider handling payment card data eventually needs to select and vet a Qualified Security Assessor (QSA) firm for PCI DSS validation. This Actor is useful for:

• Compliance and procurement teams building a shortlist of QSA firms by region, language, or business location before running an RFP.
• QSA firms themselves monitoring their own listing (remediation status, DSS v4 qualification) or tracking competitors' regional footprint.
• Compliance/security researchers and consultancies mapping the QSA market — who serves which regions, which firms support Associate QSAs, who is currently "In Remediation."
• AI agents and research pipelines that need machine-readable PCI compliance vendor data instead of manually working the site's search/filter widget.

How to use this Actor

1. Click Try for free (or Run) on this Actor's page.
2. Leave the default Start URL as the PCI SSC QSA directory page — it's only used to obtain a fresh session token before the real data request.
3. Set Max items to the number of companies you want (default 500 — comfortably above the current total of 421).
4. Click Start and download your results as JSON, CSV, or Excel from the Output tab.

Input

Field	Type	Description
startUrls	array	PCI SSC QSA directory page URL. Defaults to the official page.
maxItems	integer	Maximum number of QSA company records to return (default 500).

Output

Each item represents one QSA company:

{
  "company_id": 400042,
  "company_name": "Protiviti",
  "previous_company_name": "",
  "website": "www.protiviti.com",
  "place_of_business": ["Asia Pacific", "Australia", "Canada", "CEMEA", "China", "Europe", "USA"],
  "region": ["USA", "Asia Pacific", "CEMEA", "Europe", "LAC", "Canada"],
  "languages": ["Chinese", "English", "German", "Spanish", "French", "Japanese"],
  "primary_contact": "Chip Wolford (USA, LAC) chip.wolford@protiviti.com T: +1.513.362.1716 | Thomas Lemon (CEMEA, Europe) Thomas.Lemon@Protiviti.co.uk T: 44-207-024-7526",
  "in_remediation": false,
  "supports_associate_qsa": true,
  "dss_v4_assessor": true,
  "source_url": "https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors/"
}

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel.

Data table

Field	Description
company_id	PCI SSC's internal company record ID
company_name	Public QSA company name
previous_company_name	Prior name on record, if the company was renamed (blank if none)
website	Company's own public website
place_of_business	Countries/territories where the company has a QSA office
region	Servicing markets/regions (USA, Europe, CEMEA, LAC, Asia Pacific, Canada)
languages	Languages the QSA company supports
primary_contact	Public point-of-contact block(s) as published by PCI SSC: name, region tag, business email, business phone
in_remediation	true if PCI SSC currently lists this QSA as "In Remediation" for a validation-requirement violation
supports_associate_qsa	true if the company supports Associate QSAs
dss_v4_assessor	true if qualified to assess against PCI DSS v4
source_url	The QSA directory page URL the record was scraped from

Pricing

This Actor is priced at $5.99 per 1,000 results. Example costs:

Results	Cost
100	$0.60
500	$3.00
1,000	$5.99
5,000	$29.95

Tips

• The full directory currently holds 421 QSA companies — a single run with the default maxItems captures everything in one pass; there is no pagination to configure.
• Schedule this Actor on a recurring basis and diff on company_id + in_remediation to catch remediation-status changes without re-checking the site by hand.

FAQ

Is this legal? Yes — this Actor only reads PCI SSC's public QSA directory page and its own listing widget's data endpoint. No login is required and the site's robots.txt does not restrict this page.

Does this include personal contact information? The primary_contact field includes the point-of-contact name, business email, and business phone that each QSA company itself chose to publish on PCI SSC's public directory for procurement purposes — the same information visible to any visitor of the official page. This Actor does not perform any additional individual-employee lookup or enrichment beyond what PCI SSC already publishes per company.

Found an issue? Use the Issues tab on this Actor's Apify Store page to report it.