How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
registry
CSA STAR evidence across 434 vendors
The CSA STAR registry is a public, scheme-operated list. Level 1 is a self-assessment against the Consensus Assessments Initiative Questionnaire; Level 2 is a third-party certification (ISO 27001 basis) or attestation (SOC 2 basis) against the Cloud Controls Matrix. CertReports mirrors every entry and links it to the vendor page.
- Verified rows
- 418
- Vendor-stated
- 16
- Expired
- 0
- Last verified
- 2 Nov 2026
Enso
Data platforms
Self-Service Data Prep and Blend Built for Data Teams.
Litmus
Email marketing
Litmus is an email Design, Testing, and Analytics
SU
Surge
Developer tools
Stripe for telephony
Bud
HR and HRIS
Agent with a computer
Elementary
DevOps and observability
Open-source data observability for data teams
HackerRank
Recruiting
Change the world to value skills over pedigree
Flo
Automotive and mobility
The talent platform for legal
Cactus
AI tools
All-In-One AI Growth Partner. Built for Trades.
Miru
Security
Config Management for Robotics
People.ai
Sales tools
Harnesses business activity to unlock growth.
Protex AI
Manufacturing and industrial
Computer vision that makes the industrial workplace, safer
Routable
Payments
Simplifying payouts at scale
superglue
AI infrastructure
connect, migrate and implement enterprise systems
Turing Labs
AI tools
AI for R&D of consumer brands like P&G to develop better products
Vouch
Insurance
Insurance and risk management tools for startups and growth-stage…
Culture Amp
HR and HRIS
Empower your teams and fuel positive change with performance, development, and employee engagement tools – all-in-one intuitive employee
LangChain
AI infrastructure
LangChain is a software framework that helps facilitate the integration of large language models (LLMs) into applications
Redis
Data platforms
Redis is an in-memory key–value database, used as a distributed cache and message broker, with optional durability
Typeform
Form builders and surveys
Typeform is a software as a service (SaaS) company that specializes in online form building and online surveys
Weaviate
AI infrastructure
Bring AI-native applications to life with less hallucination, data leakage, and vendor
Paystratus Group Limited Weavr
Finance and accounting
Weavr's embedded finance solution is fully headless, easily integrated, and designed to seamlessly enhance your
AlertEnterprise
Identity and access
The future of work requires cyber-physical security
Crucial Data Solutions
Research and data providers
TrialKit is a unified eClinical platform with embedded intelligence that helps sponsors and CROs design, build, manage, and analyze
SmartComms
smartcommunications.com
Why Level 2 matters for SOC 2
No SOC 2 registry exists. A STAR Level 2 attestation is built on a SOC 2 examination, which makes it the strongest free, registry-grade signal that a SOC 2 report exists.