RegScale

Security and trust center evidence

RegScale is a continuous controls monitoring (CCM) platform that enables rapid GRC

regscale.com DevOps and observabilityLast verified 1 Nov 2026

Vendor website Are you RegScale?

FedRAMPVerified

CSA STARVerified

RegScale has 2 registry-verified rows in the CertReports index, last verified 1 Nov 2026. The strongest row is FedRAMP: FedRAMP Authorized. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

RegScale is listed in the FedRAMP registry as FedRAMP Authorized, with an issue date of 24 Jun 2025, as of 27 Sep 2026. The FedRAMP authorization lists A-LIGN Compliance and Security, Inc. dba A-LIGN as the assessing auditor, as of 27 Sep 2026. RegScale is also listed in the CSA STAR registry at STAR Level 1, a self-assessment submitted via the CAIQ, issued 2 Aug 2024, as of 17 Sep 2026. The CSA STAR Level 1 listing is a self-assessment rather than a third-party audited certification, as of 17 Sep 2026. No public evidence found for SOC 2, ISO/IEC 27001 or GDPR for RegScale as of 27 Sep 2026.

FedRAMP: listed as FedRAMP Authorized, issued 24 Jun 2025, auditor A-LIGN Compliance and Security, Inc., as of 27 Sep 2026.
CSA STAR: Level 1 self-assessment (CAIQ), issued 2 Aug 2024, as of 17 Sep 2026.
No public evidence found for SOC 2, ISO/IEC 27001 or GDPR as of 27 Sep 2026.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 28 Sep 2026; it is regenerated whenever a row changes.

Among devops and observability vendors

2verified rows

Category median 1, across 193 indexed devops and observability vendors. RegScale has more verified rows than 89 percent of them.

compliance automationcontinuous controls monitoringgrc platformrisk management

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, SOC 2, GDPR, PCI DSS, ISO 27001, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

No DPA, BAA or subprocessor list has been captured from a public page yet. Registry rows above do not depend on this.

Subprocessors

No subprocessor list captured yet.

Change history

18 Sep 2026First indexed by CertReports2 evidence rows across 2 frameworks entered the index.

Similar vendors with evidence

Related by product tags and the DevOps and observability category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.