Compliance attestations
On file, in date, gating the level
Partners upload their compliance attestation, such as a PCI DSS attestation of compliance, or declare an exemption. The airline reviews it, a level can require it before its certificate is issued, and expiry is tracked with reminders.