> Not anywhere on the page you linked.
Read the page carefully - it specifically states they are an auditor approved org.
Quote from page: “Meet penetration testing requirements for PCI DSS and SOC2 Type II compliance certifications with our auditor-approved penetration testing methodology and Security Assessment Report.[1].”
Secondly, PayPal works with HackerOne officially [2] and within the CVSS standards as they clearly state on their HackerOne page, which is complying with PCI DSS.
[1] https://www.hackerone.com/product/challenge
[2] https://hackerone.com/paypal
Edit: Archived incase: