How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
registry
CSA STAR evidence across 418 vendors
The CSA STAR registry is a public, scheme-operated list. Level 1 is a self-assessment against the Consensus Assessments Initiative Questionnaire; Level 2 is a third-party certification (ISO 27001 basis) or attestation (SOC 2 basis) against the Cloud Controls Matrix. CertReports mirrors every entry and links it to the vendor page.
- Verified rows
- 418
- Vendor-stated
- 16
- Expired
- 0
- Last verified
- 2 Nov 2026
Cloud and hosting
Google LLC is a global technology
iManage
Legal tech
iManage was founded in 1995 and initially merged with Interwoven in
Wrike
Project management
Wrike is a work management platform that delivers real-time project and task insight to its
Panopto
Education
At Panopto, we believe that video can have a transformative effect on
Sauce Labs
Developer tools
What is Sauce Labs? Sauce Labs makes software work for everyone, when they want it
Microsoft
Cloud and hosting
Microsoft Azure is a cloud computing platform for building, deploying and managing applications through a global network of Microsoft and
Amazon
DevOps and observability
Amazon Web Services provides a highly reliable, scalable, low-cost infrastructure platform in the cloud that powers hundreds of thousands
Accenture
Business services
Accenture is a Global professional services company providing a range of Strategy & Consulting, Song, Technology and Operations services
Confluent
Data platforms
Founded by the team that built Apache Kafka®, Confluent builds a streaming platform that enables companies to easily access data as
CrowdStrike
Security
CrowdStrike Falcon is the only solution to unify next-gen AV, endpoint protection and response, managed hunting, IT hygiene and threat
Datadog
DevOps and observability
Datadog is a monitoring service for hybrid cloud applications, assisting organizations in improving agility, increasing efficiency, and
DocuSign
E-signature
Docusign brings agreements to
Okta
Identity and access
Okta is an Identity-as-a-Service (IDaaS) platform that provides a comprehensive suite of services focused on managing and securing user
Drata
Compliance and GRC
Drata’s AI-native compliance automation & agentic trust management platform powers GRC and assurance (GRC +A) for startups, mid-size
Cyera
Security
The Cyera Data Security system allows organizations to discover data categories and ensure that they are protected according to
GitLab
Developer tools
A complete DevOps platform delivered as a single application.
Axon
Government and public sector
Axon Enterprise, formerly known as TASER International, creates connected technologies for truth in public
Mimecast
Security
Mimecast provides email management as a single service in the cloud that helps customers slash on-premise email storage requirements
SentinelOne
Security
SentinelOne is redefining cybersecurity by pushing the boundaries of autonomous
Ironclad
Legal tech
AI-powered contract management
UKG
HR and HRIS
HR, Payroll, & Workforce Management
Netskope
Security
Netskope™, the leading cloud access security broker (CASB), helps enterprises find, understand and secure sanctioned and unsanctioned cloud
UiPath
DevOps and observability
UiPath Inc. is a Romanian-American multinational software company that develops artificial intelligence (AI) and agentic automation and
Acquia
Business services
Acquia, Inc. (Acquia) is a privately held, open-source digital experience company that supports customers using the free and open-source content managemen...
Why Level 2 matters for SOC 2
No SOC 2 registry exists. A STAR Level 2 attestation is built on a SOC 2 examination, which makes it the strongest free, registry-grade signal that a SOC 2 report exists.