Liferay
Security and trust center evidence
Liferay helps organizations solve digital challenges with omnichannel intranet, portal, commerce, and integration
Summary
Liferay has 2 registry-verified rows and 1 third-party reported row in the CertReports index, last verified 26 Oct 2026. The strongest row is SOC 2: CSA STAR Level 2 attestation on the registry, which is built on a SOC 2 examination. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
Liferay is listed in CSA STAR with a Level 2 attestation and Trusted Cloud Provider status, issued 23 Nov 2020, as of 17 Sep 2026. That CSA STAR Level 2 attestation, as of 17 Sep 2026, is built on a SOC 2 examination, so Liferay has a SOC 2 examination underlying the registry listing rather than a separately published SOC 2 report. Liferay is listed in the EU-US Data Privacy Framework registry as active under SW-US Certification, EU-US Certification and UK Extension Certification, as of 17 Sep 2026. The Data Privacy Framework listing, as of 17 Sep 2026, was issued 5 Jan 2017 and expires 27 Jan 2027. No public evidence found for FedRAMP or ISO/IEC 27001 as of 17 Sep 2026.
- CSA STAR - Level 2 attestation, Trusted Cloud Provider, issued 23 Nov 2020 (as of 17 Sep 2026)
- SOC 2 - has an examination underlying the CSA STAR Level 2 attestation, issued 23 Nov 2020, not a standalone report (as of 17 Sep 2026)
- EU-US Data Privacy Framework - active (SW-US, EU-US, UK Extension), issued 5 Jan 2017, expires 27 Jan 2027 (as of 17 Sep 2026)
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 20 Sep 2026; it is regenerated whenever a row changes.
Among e-commerce vendors
2verified rows
Category median 1, across 128 indexed e-commerce vendors. Liferay has more verified rows than 93 percent of them.
digital experiencelow-code platformomnichannelportal builder
Compare with similar vendors
Pick your own comparisonCompliance grid
SOC 2ReportedCSA STAR Level 2 attestation on the registry, which is built on a SOC 2 examination
as of 26 Oct 20266 sources
CSA STARVerifiedSTAR Level 2 attestation, Trusted Cloud Provider
as of 26 Oct 20266 sources
EU-US Data Privacy FrameworkVerifiedActive: SW-US Certification, EU-US Certification, UK Extension Certification
as of 26 Oct 20261 source
Legal artefacts
No DPA, BAA or subprocessor list has been captured from a public page yet. Registry rows above do not depend on this.
Subprocessors
No subprocessor list captured yet.
Change history
- 18 Sep 2026First indexed by CertReports3 evidence rows across 3 frameworks entered the index.
Similar vendors with evidence
Related by product tags and the E-commerce category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
Lightspeed POS
E-commerce
Lightspeed Commerce is a point-of-sale and e-commerce software provider based in Montreal, Quebec, Canada
Enactor
E-commerce
Discover how Enactor helps retailers deliver on their omnichannel journeys through its next-generation unified commerce
Shopline
E-commerce
SHOPLINE's integrated ecommerce platform provides solutions to online selling, social commerce, omni-channel selling and more - the
iQmetrix
E-commerce
Retail management, omnichannel, and point of sale systems for wireless
Evidence against regulations
All regulations for LiferayHow much of each regulation’s vendor requirements Liferay’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read