How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
registry
CSA STAR evidence across 434 vendors
The CSA STAR registry is a public, scheme-operated list. Level 1 is a self-assessment against the Consensus Assessments Initiative Questionnaire; Level 2 is a third-party certification (ISO 27001 basis) or attestation (SOC 2 basis) against the Cloud Controls Matrix. CertReports mirrors every entry and links it to the vendor page.
- Verified rows
- 418
- Vendor-stated
- 16
- Expired
- 0
- Last verified
- 2 Nov 2026
Workday
HR and HRIS
Experience a new way to work with Sana and agentic AI from
Lookout
Security
Lookout is a private IT security company headquartered in San Francisco
Figma
Design tools
Figma is a design platform for teams who build products
MongoDB
Data platforms
MongoDB is a source-available, cross-platform, document-oriented database program
Zscaler
Security
Zscaler was founded in 2008 on a simple but powerful concept: as applications move to the cloud, security needs to move there as
VA
Varonis
varonis.com
Varonis (Nasdaq: VRNS) secures AI and the data that powers
F5
Logistics and supply chain
F5 is a global leader in application delivery and security, offering services that optimize, protect, and ensure the availability of apps
Dynatrace
DevOps and observability
Dynatrace considers itself as the leader in digital performance management (DPM) and the innovator behind digital performance
New Relic
DevOps and observability
New Relic is a software analytics company that makes sense of billions of metrics about millions of applications in real
Red Hat
Cloud and hosting
OpenShift is Red Hat's free, auto-scaling Platform as a Service (PaaS) for
AvePoint
Cloud storage
AvePoint is a public company headquartered in Jersey City, New Jersey, United States
Deloitte
Business services
Shape the future faster with our innovation and technology
Sumo Logic
Analytics
Sumo Logic empowers the people who power modern, digital
Tanium
IT management
Tanium is the only unified endpoint management and security platform that requires zero on-premises infrastructure and provides
Informatica
Data platforms
Informatica (NYSE: INFA), an Enterprise Cloud Data Management leader, brings data to life by empowering businesses to realize the
Deltek
Project management
Deltek is a leading global provider of enterprise software and information solutions designed to help project-based businesses optimize
Collibra
Research and data providers
Your system of record for
Talkdesk
Communications and CPaaS
Talkdesk is an easy-to-use, cloud-based call center software solution that helps growing businesses, improve customer interactions, while
Keeper Security
DevOps and observability
Keeper is the leading provider of zero-knowledge security and encryption software covering password management, dark web monitoring
Nexthink
IT management
Nexthink is the leader in digital employee experience management
HackerOne
Security
HackerOne Inc. is a cybersecurity operations technology company managed by certified information system security professionals who conduct
Avature
HR and HRIS
Avature is an HCM software company which employs more than 450 employees around the world and operates in six countries (USA, UK, Spain
Nintex
No-code and automation
Nintex is the global standard for process management and
Pegasystems
CRM
Pegasystems Inc. (Pega) is a global software company based in Waltham, Massachusetts, in the United States, and founded in 1983
Why Level 2 matters for SOC 2
No SOC 2 registry exists. A STAR Level 2 attestation is built on a SOC 2 examination, which makes it the strongest free, registry-grade signal that a SOC 2 report exists.