Methodology

Every metric carries its source and a timestamp. We label each value with exactly one provenance:

• Verified: read by VentureIndex directly from the provider through a read-only connection we control.
• Connected: from a provider connection whose verification has lapsed or is still pending.
• Company reported: entered by the company and not independently checked.
• VentureIndex estimate: a model output, always shown as an estimate and never styled as verified.
• Public source: taken from a public record or announcement.

When several sources report the same period, the most trusted one is shown. History is stored per period and never overwritten across periods. Revisions to closed months, for example a late refund, are logged.

Revenue is verified by connecting a payment provider with a read-only, restricted credential. For Stripe we accept only restricted keys (rk_live_…) and reject full secret keys. Our client issues only GET requests. Credentials are encrypted at rest with AES-256-GCM, bound to their record, and rotatable.

We store normalised aggregates (revenue, MRR, subscriptions, customers, churned and new MRR) and no customer personal data. MRR history is reconstructed from subscription lifecycles at 80% confidence, and the current MRR is read exactly. Badges are shown per signal: Revenue, Traffic, Search, Development and Domain. A company is Fully Verified when revenue plus at least two independent signals are verified.

The score rates business quality, not size alone. It is a weighted mean of six components, each mapped from raw inputs to 0–100 with the published curves below.

Missing inputs are never imputed. A component without inputs is excluded, and the remaining weights are renormalised. Coverage is the share of total weight that had inputs. Below 50% coverage the score is withheld.

Uncertainty shrinks scores toward 50. The published score is 50 + (raw − 50) × coverage × min(1, months / 6), so a company with two months of data cannot top the table by chance. Confidence is high (≥ 80% coverage, verified revenue, ≥ 6 months), medium (≥ 60%, ≥ 3 months) or low.

Verified data dominates. Without verified revenue the score is capped at 60. Verification depth weights: revenue 60, traffic 15, search 10, development 10, domain 5. Depth is multiplied by a freshness factor (1.0 within 24h of the last sync, falling to 0.1 after 90 days).

Momentum identifies companies accelerating right now. It uses relative change only, so a company going from $2K to $8K MRR outranks a flat $500K company.

• 30-day revenue or MRR growth: 35%
• Acceleration vs. the prior 3-month average: 20%
• 7-day revenue run rate: 10%
• 30-day traffic growth: 15%
• 30-day customer growth: 15%
• Development activity trend: 5%

Eligibility: at least $250 monthly revenue and 2 months of history. Bases below ~$2K are damped (factor ≥ 0.6) so that $50 → $200 does not dominate. Scores shrink toward 40, the value for zero growth, when history is short.

Rankings are precomputed daily into snapshots, and movement (▲/▼) compares each position with the previous snapshot. Every ranking states its entry criteria: most require verified revenue, and score rankings require at least medium confidence. Companies under internal data review are temporarily excluded. A ranking is only indexed by search engines once at least five companies qualify.

Rankings can be combined in the URL. /rankings/fastest-growing-bootstrapped-saas resolves to a ranking with the same methodology plus those filters.

Founders choose a visibility level for each group of metrics: public (exact), range (a bucket such as $10K–$25K), buyers only, or private.

Enforcement happens on the server, in one projection used by pages, metadata, share cards, badges and the API. Hidden values never reach the browser. Derived values that could reconstruct a hidden metric are suppressed too: ARPU × customers would reveal revenue, and revenue per visitor × visits would as well. Rankings and filters only use public values, so a private number cannot be inferred by repeated filtering. Score components that would reveal a private input are shown as “Private”.

Aggregates use only public data from listed companies. A category trend is shown only when at least five companies in it have public growth data. Medians are used rather than means so a single outlier cannot move the index.

Automated checks flag records for internal review. Examples are implausible month-over-month jumps, disconnecting a provider right after a milestone, the same provider account used by two companies, frequent revisions to closed months, and revenue-to-traffic ratios outside normal bounds. Flags are never shown publicly and never imply wrongdoing. A reviewer resolves each one, and only high-severity open flags pause a company’s ranking.