Spreedly has fulfilled all the requirements of SAQ D. The compliance status is not just the result of vulnerability scanning. https://spreedly.com/info/faq/

Disclosure: I'm a Spreedly co-founder.