How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
registry
CSA STAR evidence across 434 vendors
The CSA STAR registry is a public, scheme-operated list. Level 1 is a self-assessment against the Consensus Assessments Initiative Questionnaire; Level 2 is a third-party certification (ISO 27001 basis) or attestation (SOC 2 basis) against the Cloud Controls Matrix. CertReports mirrors every entry and links it to the vendor page.
- Verified rows
- 418
- Vendor-stated
- 16
- Expired
- 0
- Last verified
- 2 Nov 2026
CircleCI
Developer tools
CircleCI provides a CI/CD cloud environment for software engineers to test their code and deploy
Boomi
Cloud and hosting
Boomi is the leading cloud-based integration platform as a service (iPaaS) that enables businesses to connect applications, data, and
Medallia
Education
Medallia is an American customer and employee experience management company based in Tysons, Virginia
Sprinklr
Customer support
Sprinklr is a provider of enterprise software solutions that help organizations unify customer-facing functions across digital
WalkMe
Productivity
WalkMe provides a platform for on-boarding and simplifying of user experience in web based
Bugcrowd
Security
Bugcrowd enables organizations to do everything proactively possible to avoid being blind-sided by
Expedient
DevOps and observability
Expedient combines data centers, network access and managed services to deliver information technology infrastructure as a service (IaaS)
HireVue
Recruiting
At HireVue, we exist to connect talent to opportunity and unlock the potential in every candidate—because everyone has
ScienceLogic
IT management
ScienceLogic is a leader in IT Operations Management, providing modern IT operations with actionable insights to predict and resolve
Articulate Global
Education
Articulate Global, LLC. (Articulate) was founded in 2002 to simplify e-learning development and expand access to training globally. The company offers its...
Broadridge Financial Solutions
Analytics
Broadridge Financial Solutions
Simetrik
Finance and accounting
No code enterprise SaaS for financial control automation.
Box
Cloud storage
Box (NYSE:BOX) is the market leader for Cloud Content Management, whose mission is to power how the world works
Vanta
Compliance and GRC
Vanta—the proven leader in automated compliance helping startups…
Tenable
Security
Tenable Holdings, Inc. is a cybersecurity company based in Columbia, Maryland
Adobe
Cloud and hosting
Founded in 1982, Adobe Incorporated (“Adobe”) is one of the largest and most diversified software companies in the
Atlassian
Collaboration
Atlassian unleashes the potential in every
Rapid7
Security
Rapid7 is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations’ cyber
Verkada
Security
Verkada Inc. is an American security technology company, based in San Mateo, California
Zendesk
Customer support
The best customer experiences are built with
ServiceNow
IT management
ServiceNow delivers digital workflows that create great experiences and unlock productivity for employees and the
Asana
Project management
From the small stuff to the big picture, Asana organizes work so teams know what to do, why it matters, and how to get it
Qualtrics
Form builders and surveys
Qualtrics is a Software-as-a-Service (SaaS) who provides a platform for creating and distributing online surveys, performing employee
Qualys
Compliance and GRC
Qualys, Inc. is an American technology firm based in Foster City, California, specializing in cloud security, compliance and related
Why Level 2 matters for SOC 2
No SOC 2 registry exists. A STAR Level 2 attestation is built on a SOC 2 examination, which makes it the strongest free, registry-grade signal that a SOC 2 report exists.