How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
registry
CSA STAR evidence across 434 vendors
The CSA STAR registry is a public, scheme-operated list. Level 1 is a self-assessment against the Consensus Assessments Initiative Questionnaire; Level 2 is a third-party certification (ISO 27001 basis) or attestation (SOC 2 basis) against the Cloud Controls Matrix. CertReports mirrors every entry and links it to the vendor page.
- Verified rows
- 418
- Vendor-stated
- 16
- Expired
- 0
- Last verified
- 2 Nov 2026
ChannelAdvisor
E-commerce
ChannelAdvisor Corporation is a leading e-commerce cloud platform whose mission is to connect and optimize the world’s
CI
CipherCloud
Security
CipherCloud is a pioneer in delivering cloud information protection and enabling you to overcome risks to data privacy, residency
Cirrus Insight
CRM
Transform your CRM experience with Cirrus
Cleanshelf
IT management
Cleanshelf is the leading enterprise SaaS management platform focused on tracking, controlling, and benchmarking SaaS
Commvault Systems
Cloud storage
Only Commvault continuously recovers and restores the data powering your enterprise and agents to a clean, trusted
Complion
Healthcare
Complion’s mission is to transform the way clinical trial documentation is created and
Concord Worldwide
Legal tech
Concord empowers growing businesses to make smarter operational decisions by unlocking actionable data from all their
Oracle America Inc. CrowdTwist
Compliance and GRC
Whistic enables organizations to assess, publish and share security
Donnelley Financial Solutions
Compliance and GRC
Donnelley Financial Solutions (DFIN) is the leading provider of innovative, software and technology-enabled financial regulatory and
DuoCircle
Security
DuoCircle: Enterprise Email Security Solutions Founded in 2014 in San Diego, California, DuoCircle specializes in enterprise email
eShare
Cloud storage
eSHARE offers an advanced solution that revolutionizes the way organizations share sensitive data with external
eFileCabinet
Cloud storage
Since 2001, eFileCabinet (now Revver) has been perfecting its approach to intelligent organization to create one of the most advanced
EP
Epsagon
DevOps and observability
Epsagon’s applied observability platform enables DevOps and Engineering teams to automatically detect, troubleshoot, and resolve issues
Espressive
Collaboration
Espressive, the pioneer in automating digital workplace assistance and a 2022 Forrester New Wave Leader, redefines how employees get help
Green Cloud Technologies
Cloud and hosting
Green Cloud Technologies is transforming the IT channel business by helping MSP’s and VAR’s embrace the cloud so they can flourish and
Guidebook
No-code and automation
Guidebook enables anybody to create a beautiful, engaging mobile apps without any
Hawk Search
E-commerce
Hawksearch provides best-in-class features for you to define your visitors search
Highspot
Sales tools
Highspot is the only unified solution built to bridge the gap between strategy and execution—empowering organizations to Equip, Train, and
Innovative Business Software
DevOps and observability
We provide software to the Worlds leading security monitoring providers, and Central
IBS Software
Travel and hospitality
IBS Software is a leading SaaS solutions provider to the travel industry globally, managing mission-critical operations for customers in
Interact Intranet
Collaboration
Deliver a better employee
Iron.io
Collaboration
Scalable serverless tools to run background jobs in parallel and to quickly pass messages through a hosted messaging queue with reliable
SaaS.group
Developer tools
SaaS Labs is a global SaaS product company powered by experimentation and first principles thinking, building a complete platform for high
Kapiche
Analytics
Kapiche is on a mission to help organisations understand and empathize with their customers at scale using our unique
Why Level 2 matters for SOC 2
No SOC 2 registry exists. A STAR Level 2 attestation is built on a SOC 2 examination, which makes it the strongest free, registry-grade signal that a SOC 2 report exists.