How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
registry
CSA STAR evidence across 418 vendors
The CSA STAR registry is a public, scheme-operated list. Level 1 is a self-assessment against the Consensus Assessments Initiative Questionnaire; Level 2 is a third-party certification (ISO 27001 basis) or attestation (SOC 2 basis) against the Cloud Controls Matrix. CertReports mirrors every entry and links it to the vendor page.
- Verified rows
- 418
- Vendor-stated
- 16
- Expired
- 0
- Last verified
- 2 Nov 2026
Mixpanel
Analytics
Mixpanel is event analytics for builders that need answers.
Black Kite
Compliance and GRC
At Black Kite, we’re redefining vendor risk management with the world’s first global third-party cyber risk monitoring platform, built from
Abnormal AI
AI tools
Abnormal AI is the leading AI-native human behavior security platform, leveraging machine learning to stop sophisticated inbound attacks
Appian
Developer tools
Appian provides a leading low-code software development platform that enables organizations to rapidly develop powerful and unique
Claroty
Security
Claroty is a global cybersecurity company specializing in the protection of cyber-physical systems (CPS) and the Extended Internet of
Deloitte
Business services
Shape the future faster with our innovation and technology
Envoy
Legal tech
We provide full-scale international legal immigration services and a proprietary online platform related to managing all employment-based
OpenText
Legal tech
OpenText™ Core Legal Hold is a simple, powerful cloud-based litigation hold notification software that helps law departments automate
8x8
Communications and CPaaS
8x8 business VoIP helps you serve your customers better with mobile, flexible solutions that help you do business anywhere
Checkmarx
DevOps and observability
Checkmarx makes software security essential infrastructure: unified with DevOps, and seamlessly embedded into your entire CI/CD pipeline
Fountain
Recruiting
High volume hiring made simple
Hootsuite
Marketing
Hootsuite is the world’s most widely used social media relationship
Abbott
Healthcare
Abbott Laboratories is an American multinational medical devices and health care company with headquarters in Abbott Park, Illinois, United
Vonage
Communications and CPaaS
Vonage, a global cloud communications leader, helps businesses accelerate their digital
xAI
AI infrastructure
xAI is an AI company building advanced large language models and generative AI solutions, including Grok, to accelerate human scientific
Axonius
Security
The Axonius Platform gives customers a comprehensive understanding of all assets, their relationships, and business-level
Celonis
Analytics
Celonis has one very simple goal: to analyze today’s processes to make tomorrow’s world more
Druva
Cloud storage
The Druva Data Resiliency Cloud is the only at-scale SaaS platform designed for your multi-cloud
iBoss
Security
iboss enables companies to reduce cyber risk with a Zero Trust Security Service Edge that protects resources across cloud, SaaS and on prem
IDrive
Cloud storage
IDrive provides secure online data backup and recovery, disaster recovery, remote access, and object storage services for individuals and
Nutanix
Cloud and hosting
Nutanix strives to delight customers with a simple, flexible, and cost-efficient cloud platform, one that offers freedom of choice and
Acronis
Cloud storage
Acronis sets the standard for cyber protection through its innovative backup, anti-ransomware, disaster recovery, storage, and enterprise
CrashPlan
Cloud storage
CrashPlan provides secure endpoint backup for enterprise and Small Business
Forcepoint
Security
Forcepoint is a global data security leader headquartered in Austin, Texas, delivering AI-native protection for sensitive data across
Why Level 2 matters for SOC 2
No SOC 2 registry exists. A STAR Level 2 attestation is built on a SOC 2 examination, which makes it the strongest free, registry-grade signal that a SOC 2 report exists.