Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
StarCompliance Operating
GDPR evidence
StarCompliance Enterprise simplifies conflict monitoring and regulatory compliance, helping firms reduce risk and stay ahead with
Vendor-statedStarCompliance Operating and GDPR
StarCompliance Operating states it holds a data processing agreement. CertReports captured this on 21 Sep 2026 from its trust centre (Vanta); it is a vendor statement, not an independent confirmation.
Evidence
Vendor-statedVendor states GDPR on its trust centre
as of 21 Sep 2026 · confidence 90%VerifiedActive: SW-US Certification, EU-US Certification, UK Extension Certification
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 13 Mar 2017
- Expires or valid through
- 5 Jan 2027
- Scope
- We are a compliance SaaS provider to the financial sector. We process personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to provide and operate our compliance software and related services and to administer our workforce. Purposes include: provisioning and administering customer accounts; delivering platform functionality; supporting end users and troubleshooting; maintaining security, monitoring, audit logging, and fraud misuse prevention; performing service communications; improving and developing our services; and recruiting, hiring, and managing employees and applicants. The personal data processed includes client and end-user data such as names, business contact details (email, phone), role/title, account identifiers, user credentials and authentication-related information, communications support content submitted to us, and service usage data (e.g., log data, device and session information, IP address, and activity records) collected in connection with use of the platform. Where applicable, we may also process limited information contained in customer-provided content uploaded or entered into the service as part of providing the contracted services. We also process HR data relating to employees and applicants, which may include identifiers and contact details, recruitment and application information, employment-related records, and necessary administrative information (e.g., role, start/end dates, and related HR administration details). We share personal data to third parties solely for the purposes described above, including: • Cloud hosting and infrastructure: Microsoft Azure (to host and operate the platform and store/backup data). • Sub processors service providers supporting delivery and maintenance of the service: ShoreGroup, Xebia, and Persistent (to provide implementation, engineering, support, and operational services). • Security monitoring and analytics: Elasticsearch to analyze and monitor system and security logs and service activity. • Data warehousing: Snowflake to store and analyze service-related data for operational reporting and service improvement. • Authentication and identity services: Auth0 to authenticate users and manage identity and access controls.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | StarCompliance Operating LLC: Active: SW-US Certification, EU-US Certification, UK Extension Certification | Live pagesha256 e4b32c73fa |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is StarCompliance Operating GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
- 18 Sep 2026Subprocessor added: AWSAWS appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: AkoyaAkoya appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Auth0Auth0 appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: CloudflareCloudflare appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: DopplerDoppler appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Elastic SearchElastic Search appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Microsoft AzureMicrosoft Azure appeared on the subprocessor list.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Developer tools category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read