{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"okta","name":"Okta","domain":"okta.com","category":"Identity and access","one_liner":"Okta is an Identity-as-a-Service (IDaaS) platform that provides a comprehensive suite of services focused on managing and securing user","trust_center_url":"https://security.okta.com/","security_page_url":null,"url":"https://certreports.com/vendors/okta/security","last_verified_at":"2026-09-19T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"hipaa","framework_name":"HIPAA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states that it will sign a business associate agreement on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/hipaa","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"HIPAA","confidence":1}]},{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states SOC 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/soc-2","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"SOC 2","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/gdpr","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"fedramp","framework_name":"FedRAMP","state":"verified_registry","state_label":"Verified","sentence":"Listed in the FedRAMP Marketplace as of 19 Sep 2026.","kind":"authorization","status_text":"FedRAMP Authorized","issued_at":"2023-03-23","expires_at":null,"period_start":null,"period_end":null,"auditor":"Coalfire Systems, Inc.","impact_level":"High","as_of":"2026-09-19","under_review":false,"source":"fedramp","url":"https://certreports.com/vendors/okta/fedramp","evidence":[{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/FR2131856836","fetched_at":"2026-09-19 08:30:01.700532+00","content_hash":"b2bb3e031fda16f1f3201a5640ae64a639a15e4997f9d1ca43ef13a2942600e6","wayback_url":null,"quote":"Okta - Okta IDaaS Government High Cloud (GHC): FedRAMP Authorized","confidence":1},{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/FR2131856836","fetched_at":"2026-09-18 22:35:17.44827+00","content_hash":"db2d03fa40cba0e5287b9cc7361e71b7c30c7ca9d51efb7b540477105fb30c7b","wayback_url":null,"quote":"Okta - Okta IDaaS Government High Cloud (GHC): FedRAMP Authorized","confidence":1},{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/FR2131856836","fetched_at":"2026-09-17 15:44:39.301965+00","content_hash":"395e7ad35dd25d1c547414140161c47ec22827b7ffae3bdbbd5256c38a3b940f","wayback_url":null,"quote":"Okta - Okta IDaaS Government High Cloud (GHC): FedRAMP Authorized","confidence":1}]},{"framework":"pci-dss","framework_name":"PCI DSS","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a PCI DSS attestation of compliance on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states PCI DSS on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/pci-dss","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"PCI DSS","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"ISO/IEC 27001:2022","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"verified_registry","state_label":"Verified","sentence":"Listed in the CSA STAR registry as of 17 Sep 2026.","kind":"level2","status_text":"STAR Level 2 certification, Trusted Cloud Provider","issued_at":"2013-03-28","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/okta/csa-star","evidence":[{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/okta-inc","fetched_at":"2026-09-17 15:44:42.254747+00","content_hash":"e7f124247f5399c92ba048620a83c0b6cca1f9a2f97419f32566e462a3b1bda7","wayback_url":null,"quote":"okta inc.: STAR Level 2 certification, Trusted Cloud Provider","confidence":1}]},{"framework":"soc-1","framework_name":"SOC 1","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 1 Type II report on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states SOC 1 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/security","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"SOC 1","confidence":1}]},{"framework":"soc-3","framework_name":"SOC 3","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a public SOC 3 report on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states SOC 3 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/security","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"SOC 3","confidence":1}]},{"framework":"iso-27017","framework_name":"ISO/IEC 27017","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27017 certificate on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27017:2015 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/security","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"ISO/IEC 27017:2015","confidence":1}]},{"framework":"iso-27018","framework_name":"ISO/IEC 27018","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27018 certificate on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ISO/IEC 27018:2019 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/security","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"ISO/IEC 27018:2019","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"expired","state_label":"Expired","sentence":"Certificate expiry unknown date passed; no renewal found as of 17 Sep 2026.","kind":"listing","status_text":"Inactive","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/okta/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/9259","fetched_at":"2026-09-17 15:50:58.914968+00","content_hash":"4850fb6c85d63481011aac25e24c23452c508139dd4d8be9548b12cf49e829f6","wayback_url":null,"quote":"Auth0, LLC: Inactive","confidence":1}]},{"framework":"govramp","framework_name":"GovRAMP","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an GovRAMP authorization on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states GovRAMP on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/security","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"GovRAMP","confidence":1}]},{"framework":"tisax","framework_name":"TISAX","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an TISAX assessment label on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states TISAX on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/security","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"TISAX","confidence":1}]},{"framework":"c5","framework_name":"BSI C5","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an BSI C5 attestation on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states C5 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/security","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"C5","confidence":1}]},{"framework":"ens","framework_name":"ENS","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ENS certificate on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states ENS on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/security","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"ENS","confidence":1}]},{"framework":"irap","framework_name":"IRAP","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an IRAP assessment on its trust centre (Drata) as of 17 Sep 2026.","kind":null,"status_text":"Vendor states IRAP on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"drata","url":"https://certreports.com/vendors/okta/security","evidence":[{"source_type":"trust_center","source_name":"Okta trust centre (Drata)","url":"https://security.okta.com/","fetched_at":"2026-09-17 16:27:53.135755+00","content_hash":"9fa130beaf6774088ee6161aedb4771b4308fde290ea9f844bf4d5ff0dc76c36","wayback_url":null,"quote":"IRAP","confidence":1}]}],"brief":{"summary":"Okta (okta.com), an identity and access vendor, is listed in FedRAMP as Authorized, issued 23 Mar 2023 with Coalfire Systems, Inc. as auditor, as of 19 Sep 2026. Okta is listed in CSA STAR at Level 2 certification as a Trusted Cloud Provider, issued 28 Mar 2013, as of 17 Sep 2026. Okta displays a HIPAA badge on its trust centre as of 17 Sep 2026, a claim for which BAA availability has not yet been captured in the evidence. Okta states on its trust centre that it holds SOC 2, GDPR, PCI DSS, ISO/IEC 27001:2022, SOC 1, SOC 3, ISO/IEC 27017:2015, ISO/IEC 27018:2019, GovRAMP, TISAX, BSI C5, ENS, and IRAP, as of 17 Sep 2026. Okta's EU-US Data Privacy Framework listing is expired, shown as Inactive as of 17 Sep 2026.","bullets":["FedRAMP: listed as Authorized, issued 23 Mar 2023, auditor Coalfire Systems, Inc., as of 19 Sep 2026.","CSA STAR: Level 2 certification, Trusted Cloud Provider, issued 28 Mar 2013, as of 17 Sep 2026.","HIPAA: vendor displays a badge on its trust centre as of 17 Sep 2026, but BAA availability has not been captured in the evidence."],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-19 10:58:26.506343+00"},"legal_docs":[],"subprocessors":[],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-20T06:07:58.410Z"}