How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
registry
CSA STAR evidence across 418 vendors
The CSA STAR registry is a public, scheme-operated list. Level 1 is a self-assessment against the Consensus Assessments Initiative Questionnaire; Level 2 is a third-party certification (ISO 27001 basis) or attestation (SOC 2 basis) against the Cloud Controls Matrix. CertReports mirrors every entry and links it to the vendor page.
- Verified rows
- 418
- Vendor-stated
- 16
- Expired
- 0
- Last verified
- 2 Nov 2026
OpenAI
AI infrastructure
OpenAI is an AI research and deployment
Wiz
Security
Wiz is on a mission to transform cloud security for customers – which include 40% of the Fortune 100 – by empowering them to embrace a new
Dropbox
Cloud storage
Backup and share files in the cloud.
IN
Indeed
Recruiting
Indeed is the #1 job site in the world with over 350M+ unique visitors every
Armis
Manufacturing and industrial
Armis is the first agentless, enterprise-class security platform to address the new threat landscape of unmanaged and IoT
Fortinet
IoT and devices
Fortinet delivers award-winning cyber security solutions across the entire digital attack surface, securing devices, data, and
Proofpoint
Security
Proofpoint, Inc. is an American enterprise cybersecurity company based in Sunnyvale, California that provides software as a service and
Splunk
DevOps and observability
Splunk Inc. is a subsidiary of Cisco Systems that produces software for indexing, searching, and analyzing machine-generated data, allowing
KnowBe4
Education
Everything you need to reduce human risk and secure your agents all in one platform: Security Awareness Training, Email Security, Agent
Calendly
Collaboration
Calendly takes the busywork of scheduling off your to-do list so you can get more
Planet
Video conferencing
Planet is a leader Video over Ip service provider and system
Grammarly
Collaboration
Grammarly’s mission is to improve lives by improving
ZoomInfo
Sales tools
ZoomInfo is the trusted go-to-market platform for businesses to find, acquire, and grow
Fivetran
Data platforms
The leader in automated data movement
Strada
Insurance
AI agents that run insurance operations
DigitalOcean
Cloud and hosting
DigitalOcean provides the easiest cloud platform to deploy, manage, and scale applications of any size, removing infrastructure friction
Expel
Security
Expel provides leading managed detection and response services to thwart cyber adversaries from disrupting your business and improve your
OneTrust
Compliance and GRC
OneTrust’s mission is to enable organizations to use data and AI
Egnyte
Cloud storage
Egnyte is the only file sharing platform that adheres to data gravity - the simple idea that not all files were meant to be "up in the
PagerDuty
DevOps and observability
Real-time visibility into critical apps and services all in one place.
Postman
Developer tools
Postman is an API platform for building and using
Freshworks
Customer support
Freshworks is a cloud-based CEM software suite that streamlines customer conversations across multiple channels including email &
Mixpanel
Analytics
Mixpanel is event analytics for builders that need answers.
Black Kite
Compliance and GRC
At Black Kite, we’re redefining vendor risk management with the world’s first global third-party cyber risk monitoring platform, built from
Why Level 2 matters for SOC 2
No SOC 2 registry exists. A STAR Level 2 attestation is built on a SOC 2 examination, which makes it the strongest free, registry-grade signal that a SOC 2 report exists.