{ "name": "Identity Vendor Certifications Directory", "publisher": "Start with Identity", "url": "https://startwithidentity.com/tools/vendor-certifications/", "license": "CC BY 4.0", "updated": "2026-11-05", "count": 155, "vendors": [ { "vendor_key": "mfa/1kosmos", "vendor": "1Kosmos", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.1kosmos.com/company/about", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001, edition not stated", "source_url": "https://www.1kosmos.com/company/about", "evidence": "docs" }, { "id": "iso27018", "status": "yes", "scope": "ISO 27018, edition not stated", "source_url": "https://www.1kosmos.com/company/about", "evidence": "docs" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High (1Kosmos Platform within the HRTec FedHIVE authorization)", "source_url": "https://marketplace.fedramp.gov/products/FR1802451335", "evidence": "official-registry" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "password-management/1password", "vendor": "1Password", "trust_center_url": "https://trust.1password.io/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://trust.1password.io/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.1password.io/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "SAQ A self-assessment and Attestation of Compliance", "source_url": "https://trust.1password.io/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://trust.1password.io/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://trust.1password.io/", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://trust.1password.io/", "evidence": "trust-center" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 1", "source_url": "https://trust.1password.io/", "evidence": "trust-center" }, { "id": "tisax", "status": "yes", "scope": "TISAX assessment (Schellman; level not stated)", "source_url": "https://trust.1password.io/", "evidence": "trust-center" } ], "data_residency": [ "US", "CA", "EU" ], "data_residency_source": "https://support.1password.com/regions/", "notes": "Trust center says 1Password holds TX-RAMP Level 2 (valid through October 2028) rather than FedRAMP." }, { "vendor_key": "secrets/1password-secrets", "vendor": "1Password Secrets Automation", "trust_center_url": "https://1password.com/security", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (1Password company-wide)", "source_url": "https://1password.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (1Password company-wide)", "source_url": "https://1password.com/resources/iso27001", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015 (1Password company-wide)", "source_url": "https://1password.com/resources/iso27001", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019 (1Password company-wide)", "source_url": "https://1password.com/resources/iso27001", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019 (1Password company-wide)", "source_url": "https://1password.com/resources/iso27001", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "CA", "EU" ], "data_residency_source": "https://support.1password.com/regions/", "notes": "Secrets Automation runs on the 1Password platform, so these are 1Password's company-wide certifications." }, { "vendor_key": "ai-identity/aembit", "vendor": "Aembit", "trust_center_url": "https://trust.aembit.io/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Sensiba LLP, ANAB accredited)", "source_url": "https://aembit.io/", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "The trust center lists SOC 2 without stating the report type." }, { "vendor_key": "ciam/akamai-identity-cloud", "vendor": "Akamai Identity Cloud", "trust_center_url": "https://trust.akamai.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2, separate Identity Cloud report covering all five Trust Services Criteria", "source_url": "https://www.akamai.com/x-failover/legal/compliance.html", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Identity Cloud listed as applicable service)", "source_url": "https://www.akamai.com/x-failover/legal/compliance.html", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "Identity Cloud listed for HIPAA; standard BAA available on request", "source_url": "https://www.akamai.com/x-failover/legal/compliance.html", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://www.akamai.com/x-failover/legal/compliance.html", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://www.akamai.com/x-failover/legal/compliance.html", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://www.akamai.com/x-failover/legal/compliance.html", "evidence": "trust-center" } ], "data_residency": [ "US", "EU", "AU", "SG", "JP", "CN" ], "data_residency_source": "https://techdocs.akamai.com/identity-cloud/docs/product-status", "notes": "End of sale March 7, 2024; Akamai will decommission Identity Cloud on December 31, 2027." }, { "vendor_key": "machine-identity/akeyless", "vendor": "Akeyless", "trust_center_url": "https://www.akeyless.io/security/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.akeyless.io/security/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001", "source_url": "https://www.akeyless.io/security/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "Hosted in Second Front Systems Game Warden package (FedRAMP Certified, Class D), not a vendor-held authorization (vendor describes as FedRAMP Class D High)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2410866384/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS compliance (vendor-stated)", "source_url": "https://www.akeyless.io/security/", "evidence": "trust-center" }, { "id": "fips-140", "status": "yes", "scope": "FIPS 140-3 (vendor-stated)", "source_url": "https://www.akeyless.io/security/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "identity-verification/alloy", "vendor": "Alloy", "trust_center_url": "https://trust.alloy.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2", "source_url": "https://trust.alloy.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001:2022", "source_url": "https://trust.alloy.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "Data Processing Addendum published", "source_url": "https://trust.alloy.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "ciam/amazon-cognito", "vendor": "Amazon Cognito", "trust_center_url": "https://aws.amazon.com/compliance/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 (AWS SOC 1, 2, 3 reports; Amazon Cognito in scope)", "source_url": "https://aws.amazon.com/compliance/services-in-scope/SOC/", "evidence": "official-registry" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Amazon Cognito in scope)", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "hipaa-baa", "status": "yes", "scope": "HIPAA eligible service under the AWS BAA", "source_url": "https://aws.amazon.com/compliance/hipaa-eligible-services-reference/", "evidence": "official-registry" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High (Class D) in AWS GovCloud (US); Moderate (Class C) in US East/West", "source_url": "https://aws.amazon.com/compliance/services-in-scope/FedRAMP/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS, AWS is a Level 1 service provider", "source_url": "https://aws.amazon.com/compliance/services-in-scope/PCI/", "evidence": "official-registry" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR CCM v4.0 certification", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "hitrust", "status": "yes", "scope": "HITRUST CSF (AWS services in scope)", "source_url": "https://aws.amazon.com/compliance/services-in-scope/HITRUST-CSF/", "evidence": "official-registry" }, { "id": "c5", "status": "yes", "scope": "BSI C5", "source_url": "https://aws.amazon.com/compliance/services-in-scope/C5/", "evidence": "official-registry" }, { "id": "irap", "status": "yes", "scope": "IRAP PROTECTED", "source_url": "https://aws.amazon.com/compliance/services-in-scope/IRAP/", "evidence": "official-registry" }, { "id": "ismap", "status": "yes", "scope": "ISMAP", "source_url": "https://aws.amazon.com/compliance/services-in-scope/ISMAP/", "evidence": "official-registry" }, { "id": "ens", "status": "yes", "scope": "ENS High", "source_url": "https://aws.amazon.com/compliance/services-in-scope/ENS-High/", "evidence": "official-registry" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (AWS GDPR DPA, part of Service Terms)", "source_url": "https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf", "evidence": "docs" } ], "data_residency": [ "US", "CA", "MX", "BR", "EU", "DE", "UK", "CH", "IL", "AE", "BH", "ZA", "IN", "JP", "KR", "SG", "AU", "NZ", "HK", "ID", "MY", "TW", "TH" ], "data_residency_source": "https://docs.aws.amazon.com/general/latest/gr/cognito_identity.html", "notes": "Per-service scope taken from AWS Services in Scope by Compliance Program pages; regions from the AWS General Reference endpoint list." }, { "vendor_key": "authorization/aws-verified-permissions", "vendor": "Amazon Verified Permissions", "trust_center_url": "https://aws.amazon.com/compliance/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 (AWS SOC 1, 2, 3 reports; Amazon Verified Permissions in scope)", "source_url": "https://aws.amazon.com/compliance/services-in-scope/SOC/", "evidence": "official-registry" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Amazon Verified Permissions in scope)", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "hipaa-baa", "status": "yes", "scope": "HIPAA eligible service under the AWS BAA", "source_url": "https://aws.amazon.com/compliance/hipaa-eligible-services-reference/", "evidence": "official-registry" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High (Class D) in AWS GovCloud (US); Moderate (Class C) in US East/West", "source_url": "https://aws.amazon.com/compliance/services-in-scope/FedRAMP/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS, AWS is a Level 1 service provider", "source_url": "https://aws.amazon.com/compliance/services-in-scope/PCI/", "evidence": "official-registry" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR CCM v4.0 certification", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "hitrust", "status": "yes", "scope": "HITRUST CSF (AWS services in scope)", "source_url": "https://aws.amazon.com/compliance/services-in-scope/HITRUST-CSF/", "evidence": "official-registry" }, { "id": "c5", "status": "yes", "scope": "BSI C5", "source_url": "https://aws.amazon.com/compliance/services-in-scope/C5/", "evidence": "official-registry" }, { "id": "irap", "status": "yes", "scope": "IRAP PROTECTED", "source_url": "https://aws.amazon.com/compliance/services-in-scope/IRAP/", "evidence": "official-registry" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (AWS GDPR DPA, part of Service Terms)", "source_url": "https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf", "evidence": "docs" } ], "data_residency": [ "US", "CA", "MX", "BR", "EU", "DE", "UK", "CH", "IL", "AE", "BH", "ZA", "IN", "JP", "KR", "SG", "AU", "NZ", "HK", "ID", "MY", "TW", "TH" ], "data_residency_source": "https://docs.aws.amazon.com/general/latest/gr/verifiedpermissions.html", "notes": "Per-service scope taken from AWS Services in Scope by Compliance Program pages; regions from the AWS General Reference endpoint list." }, { "vendor_key": "pki/appviewx", "vendor": "AppViewX", "trust_center_url": "https://trust.appviewx.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (KPMG, July 1, 2025 to June 30, 2026)", "source_url": "https://trust.appviewx.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001", "source_url": "https://trust.appviewx.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1", "source_url": "https://trust.appviewx.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "ai-identity/astrix-security", "vendor": "Astrix Security", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "No trust center found; Astrix is joining Cisco and ended standalone sales of new licenses on June 30, 2026, and its only SOC 2 statement is a July 2022 announcement." }, { "vendor_key": "identity-verification/au10tix", "vendor": "AU10TIX", "trust_center_url": "https://www.au10tix.com/trust-center/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.au10tix.com/trust-center/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001", "source_url": "https://www.au10tix.com/trust-center/", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701", "source_url": "https://www.au10tix.com/trust-center/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "AU10TIX also lists TX-RAMP, NIST 800-63A and ISO/IEC 30107-3 PAD Levels 1 and 2." }, { "vendor_key": "ciam/auth0", "vendor": "Auth0", "trust_center_url": "https://trust.okta.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II, all five Trust Services Criteria", "source_url": "https://auth0.com/docs/secure/data-privacy-and-compliance", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001 (edition not stated); certificate via Support Center", "source_url": "https://auth0.com/docs/secure/data-privacy-and-compliance", "evidence": "docs" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017 (edition not stated)", "source_url": "https://auth0.com/docs/secure/data-privacy-and-compliance", "evidence": "docs" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018 (edition not stated)", "source_url": "https://auth0.com/docs/secure/data-privacy-and-compliance", "evidence": "docs" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on request; not available on Azure deployments", "source_url": "https://auth0.com/docs/secure/data-privacy-and-compliance", "evidence": "docs" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI-compliant deployment models; AOC or SAQ-D on request (level not stated)", "source_url": "https://auth0.com/docs/secure/data-privacy-and-compliance", "evidence": "docs" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR certified (level not stated on the Auth0 page)", "source_url": "https://auth0.com/docs/secure/data-privacy-and-compliance", "evidence": "docs" } ], "data_residency": [ "US", "EU", "UK", "AU", "CA", "JP" ], "data_residency_source": "https://auth0.com/docs/get-started/auth0-overview/create-tenants", "notes": "Okta subsidiary; Okta's FedRAMP listings cover Okta IDaaS clouds, not Auth0." }, { "vendor_key": "ciam/authgear", "vendor": "Authgear", "trust_center_url": "https://www.authgear.com/security/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.authgear.com/security/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated)", "source_url": "https://www.authgear.com/security/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://www.authgear.com/dpa/", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "An EU region for Authgear Cloud is announced as coming soon." }, { "vendor_key": "ciam/authsignal", "vendor": "Authsignal", "trust_center_url": "https://www.authsignal.com/legal/security", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.authsignal.com/legal/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://www.authsignal.com/legal/security", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "AU", "EU", "CA", "UK" ], "data_residency_source": "https://docs.authsignal.com/sdks/server/overview" }, { "vendor_key": "authorization/authzed", "vendor": "AuthZed", "trust_center_url": "https://security.authzed.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (annual report, AuthZed Cloud and Dedicated)", "source_url": "https://authzed.com/pricing", "evidence": "pricing-page" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Dedicated runs in the customer's chosen cloud provider and regions; no fixed region list is published." }, { "vendor_key": "iam/aws-iam-identity-center", "vendor": "AWS IAM Identity Center", "trust_center_url": "https://aws.amazon.com/compliance/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 (AWS SOC 1, 2, 3 reports; AWS IAM Identity Center in scope)", "source_url": "https://aws.amazon.com/compliance/services-in-scope/SOC/", "evidence": "official-registry" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (AWS IAM Identity Center in scope)", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "hipaa-baa", "status": "yes", "scope": "HIPAA eligible service under the AWS BAA", "source_url": "https://aws.amazon.com/compliance/hipaa-eligible-services-reference/", "evidence": "official-registry" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High (Class D) in AWS GovCloud (US); Moderate (Class C) in US East/West", "source_url": "https://aws.amazon.com/compliance/services-in-scope/FedRAMP/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS, AWS is a Level 1 service provider", "source_url": "https://aws.amazon.com/compliance/services-in-scope/PCI/", "evidence": "official-registry" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR CCM v4.0 certification", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "hitrust", "status": "yes", "scope": "HITRUST CSF (AWS services in scope)", "source_url": "https://aws.amazon.com/compliance/services-in-scope/HITRUST-CSF/", "evidence": "official-registry" }, { "id": "c5", "status": "yes", "scope": "BSI C5", "source_url": "https://aws.amazon.com/compliance/services-in-scope/C5/", "evidence": "official-registry" }, { "id": "irap", "status": "yes", "scope": "IRAP PROTECTED", "source_url": "https://aws.amazon.com/compliance/services-in-scope/IRAP/", "evidence": "official-registry" }, { "id": "ismap", "status": "yes", "scope": "ISMAP", "source_url": "https://aws.amazon.com/compliance/services-in-scope/ISMAP/", "evidence": "official-registry" }, { "id": "ens", "status": "yes", "scope": "ENS High", "source_url": "https://aws.amazon.com/compliance/services-in-scope/ENS-High/", "evidence": "official-registry" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (AWS GDPR DPA, part of Service Terms)", "source_url": "https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf", "evidence": "docs" } ], "data_residency": [ "US", "CA", "MX", "BR", "EU", "DE", "UK", "CH", "IL", "AE", "BH", "ZA", "IN", "JP", "KR", "SG", "AU", "NZ", "HK", "ID", "MY", "TW", "TH" ], "data_residency_source": "https://docs.aws.amazon.com/general/latest/gr/sso.html", "notes": "Per-service scope taken from AWS Services in Scope by Compliance Program pages; regions from the AWS General Reference endpoint list." }, { "vendor_key": "secrets/aws-secrets-manager", "vendor": "AWS Secrets Manager", "trust_center_url": "https://aws.amazon.com/compliance/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 (AWS SOC 1, 2, 3 reports; AWS Secrets Manager in scope)", "source_url": "https://aws.amazon.com/compliance/services-in-scope/SOC/", "evidence": "official-registry" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (AWS Secrets Manager in scope)", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "hipaa-baa", "status": "yes", "scope": "HIPAA eligible service under the AWS BAA", "source_url": "https://aws.amazon.com/compliance/hipaa-eligible-services-reference/", "evidence": "official-registry" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High (Class D) in AWS GovCloud (US); Moderate (Class C) in US East/West", "source_url": "https://aws.amazon.com/compliance/services-in-scope/FedRAMP/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS, AWS is a Level 1 service provider", "source_url": "https://aws.amazon.com/compliance/services-in-scope/PCI/", "evidence": "official-registry" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR CCM v4.0 certification", "source_url": "https://aws.amazon.com/compliance/iso-certified/", "evidence": "official-registry" }, { "id": "hitrust", "status": "yes", "scope": "HITRUST CSF (AWS services in scope)", "source_url": "https://aws.amazon.com/compliance/services-in-scope/HITRUST-CSF/", "evidence": "official-registry" }, { "id": "c5", "status": "yes", "scope": "BSI C5", "source_url": "https://aws.amazon.com/compliance/services-in-scope/C5/", "evidence": "official-registry" }, { "id": "irap", "status": "yes", "scope": "IRAP PROTECTED", "source_url": "https://aws.amazon.com/compliance/services-in-scope/IRAP/", "evidence": "official-registry" }, { "id": "ismap", "status": "yes", "scope": "ISMAP", "source_url": "https://aws.amazon.com/compliance/services-in-scope/ISMAP/", "evidence": "official-registry" }, { "id": "ens", "status": "yes", "scope": "ENS High", "source_url": "https://aws.amazon.com/compliance/services-in-scope/ENS-High/", "evidence": "official-registry" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (AWS GDPR DPA, part of Service Terms)", "source_url": "https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf", "evidence": "docs" } ], "data_residency": [ "US", "CA", "MX", "BR", "EU", "DE", "UK", "CH", "IL", "AE", "BH", "ZA", "IN", "JP", "KR", "SG", "AU", "NZ", "HK", "ID", "MY", "TW", "TH" ], "data_residency_source": "https://docs.aws.amazon.com/general/latest/gr/asm.html", "notes": "Per-service scope taken from AWS Services in Scope by Compliance Program pages; regions from the AWS General Reference endpoint list." }, { "vendor_key": "mfa/axiad", "vendor": "Axiad", "trust_center_url": "https://trustcenter.axiad.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Schellman)", "source_url": "https://trustcenter.axiad.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001, edition not stated", "source_url": "https://trustcenter.axiad.com/", "evidence": "trust-center" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Moderate (Axiad Conductor)", "source_url": "https://marketplace.fedramp.gov/products/FR2333756970", "evidence": "official-registry" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "secrets/azure-key-vault", "vendor": "Azure Key Vault", "trust_center_url": "https://servicetrust.microsoft.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (Azure report; Key Vault in audit scope)", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Azure certificate; Key Vault in audit scope)", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "hipaa-baa", "status": "yes", "scope": "Covered by the HIPAA BAA in the Microsoft Product Terms", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High in Azure (public) and Azure Government; DoD IL2 to IL5 in Azure Government", "source_url": "https://learn.microsoft.com/en-us/azure/azure-government/compliance/azure-services-in-fedramp-auditscope", "evidence": "docs" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0, Azure is a Level 1 service provider", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Certification and Attestation", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "hitrust", "status": "yes", "scope": "HITRUST (Azure services in audit scope)", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "c5", "status": "yes", "scope": "Germany C5", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "ens", "status": "yes", "scope": "Spain ENS High", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (Microsoft Products and Services DPA)", "source_url": "https://aka.ms/dpa", "evidence": "docs" } ], "data_residency": [ "US", "CA", "MX", "BR", "CL", "EU", "DE", "FR", "IT", "ES", "SE", "NO", "DK", "PL", "AT", "BE", "CH", "UK", "IL", "QA", "AE", "ZA", "IN", "JP", "KR", "SG", "HK", "AU", "NZ", "ID", "MY", "TW", "CN" ], "data_residency_source": "https://azure.microsoft.com/en-us/explore/global-infrastructure/products-by-region/table", "notes": "Key Vault and Managed HSM share one audit-scope entry in the Azure Compliance Offerings appendix." }, { "vendor_key": "mfa/beyond-identity", "vendor": "Beyond Identity", "trust_center_url": "https://trust.beyondidentity.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://trust.beyondidentity.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "The compliance page lists FedRAMP and PCI DSS as requirements it helps customers meet, not as held authorizations." }, { "vendor_key": "pam/beyondtrust", "vendor": "BeyondTrust", "trust_center_url": "https://www.beyondtrust.com/trust-center/industry-certifications", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 for specific cloud products (Entitle, Identity Security Insights, EPM Linux, Secure Remote Access on AWS; EPM Cloud and Password Safe Cloud on Azure)", "source_url": "https://www.beyondtrust.com/trust-center/industry-certifications", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (SoA includes ISO 27017 and 27018 controls)", "source_url": "https://www.beyondtrust.com/trust-center/industry-certifications", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://www.beyondtrust.com/trust-center/industry-certifications", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class C (Rev5, Agency): BeyondTrust Identity Security For Government", "source_url": "https://www.fedramp.gov/marketplace/products/FR2231070252/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" }, { "id": "fips-140", "status": "yes", "scope": "FIPS 140-2 (Remote Support)", "source_url": "https://www.beyondtrust.com/trust-center/industry-certifications", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "SOC 2 Type 2 coverage is product-specific rather than company-wide; a TX-RAMP certification is also listed." }, { "vendor_key": "password-management/bitdefender-password-manager", "vendor": "Bitdefender Password Manager", "trust_center_url": "https://trust.bitdefender.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Bitdefender company-level)", "source_url": "https://trust.bitdefender.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Bitdefender company-level)", "source_url": "https://trust.bitdefender.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://trust.bitdefender.com/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://trust.bitdefender.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "Certifications are listed for Bitdefender as a company; the Password Manager product is not named in scope." }, { "vendor_key": "password-management/bitwarden", "vendor": "Bitwarden", "trust_center_url": "https://bitwarden.com/compliance/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (plus SOC 3)", "source_url": "https://bitwarden.com/compliance/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated)", "source_url": "https://bitwarden.com/compliance/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "in-progress", "scope": "FedRAMP High (Class D), actively pursuing", "source_url": "https://bitwarden.com/compliance/", "evidence": "trust-center" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "EU" ], "data_residency_source": "https://bitwarden.com/help/server-geographies/", "notes": "Bitwarden says it is HIPAA compliant with annual third-party audits but does not state that it signs a BAA." }, { "vendor_key": "iga/conductorone", "vendor": "C1 (formerly ConductorOne)", "trust_center_url": "https://trust.c1.ai/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (2026 report)", "source_url": "https://trust.c1.ai/", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "zero-trust/cato-networks", "vendor": "Cato Networks", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 (type not stated in site footer)", "source_url": "https://www.catonetworks.com/", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001", "source_url": "https://www.catonetworks.com/", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "No public trust center found; certifications are listed in the catonetworks.com site footer only." }, { "vendor_key": "authorization/cerbos", "vendor": "Cerbos", "trust_center_url": "https://trust.cerbos.dev/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (first report announced January 2024)", "source_url": "https://www.cerbos.dev/news/cerbos-achieves-soc-2-type-ii-compliance", "evidence": "press-release" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://www.cerbos.dev/dpa", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "ciam/cidaas", "vendor": "cidaas", "trust_center_url": "https://www.cidaas.com/security", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated), cidaas and its infrastructure partners", "source_url": "https://www.cidaas.com/security", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "EU" ], "data_residency_source": "https://www.cidaas.com/security" }, { "vendor_key": "identity-verification/clear", "vendor": "CLEAR", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "in-progress", "scope": "FedRAMP In Process, Class C (Rev5, Agency): CLEAR1 Gov", "source_url": "https://www.fedramp.gov/marketplace/products/FR2616782844/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "No public trust center or certification page found on clearme.com." }, { "vendor_key": "ciam/clerk", "vendor": "Clerk", "trust_center_url": "https://clerk.com/security", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II since May 2022; report on Business plan and above", "source_url": "https://clerk.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "no", "scope": "Clerk states it is not ISO 27001 certified", "source_url": "https://clerk.com/security", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on Enterprise plan", "source_url": "https://clerk.com/security", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "no", "scope": "Not applicable; Clerk states it stores no cardholder data and makes no PCI DSS claim", "source_url": "https://clerk.com/security", "evidence": "trust-center" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://clerk.com/legal/dpa", "evidence": "docs" } ], "data_residency": [ "US" ], "data_residency_source": "https://clerk.com/security", "notes": "Clerk states it offers no regional data residency; data is hosted in the US." }, { "vendor_key": "zero-trust/cloudflare", "vendor": "Cloudflare Zero Trust", "trust_center_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Security, Confidentiality, Availability)", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001:2022", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO 27017:2015", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO 27018:2019", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO 27701:2019", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown", "scope": "", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class D (Rev5, Agency): Cloudflare for Government; FedRAMP Certified, Class C (Rev5, Agency): Cloudflare for Government (vendor describes as FedRAMP High)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2000863987A/", "evidence": "official-registry" }, { "id": "stateramp", "status": "yes", "scope": "GovRAMP", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS 4.0 AOC", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "c5", "status": "yes", "scope": "C5:2020", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP (Cloudflare for Government-Australia)", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "ismap", "status": "yes", "scope": "ISMAP (Cloudflare for Government-Japan)", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" }, { "id": "ens", "status": "yes", "scope": "ENS", "source_url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "States HIPAA compliance but documents no BAA, so recorded as not documented." }, { "vendor_key": "ai-identity/clutch-security", "vendor": "Clutch Security", "trust_center_url": "https://www.clutch.security/trust-center", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.clutch.security/trust-center", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001", "source_url": "https://www.clutch.security/trust-center", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "ciam/corbado", "vendor": "Corbado", "trust_center_url": "https://trust.corbado.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (security, availability, confidentiality)", "source_url": "https://www.corbado.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001:2022", "source_url": "https://www.corbado.com/security", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "DE" ], "data_residency_source": "https://www.corbado.com/security", "notes": "Shared cloud runs in AWS Frankfurt; dedicated instances can run in a customer-chosen AWS region." }, { "vendor_key": "itdr/crowdstrike-falcon-identity", "vendor": "CrowdStrike Falcon Identity Protection", "trust_center_url": "https://www.crowdstrike.com/en-us/why-crowdstrike/crowdstrike-compliance-certification/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (Falcon platform)", "source_url": "https://www.crowdstrike.com/en-us/why-crowdstrike/crowdstrike-compliance-certification/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://www.crowdstrike.com/en-us/why-crowdstrike/crowdstrike-compliance-certification/", "evidence": "trust-center" }, { "id": "iso42001", "status": "yes", "scope": "ISO/IEC 42001:2023", "source_url": "https://www.crowdstrike.com/en-us/why-crowdstrike/crowdstrike-compliance-certification/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class D (Rev5, Agency): CrowdStrike Falcon Platform for Government; FedRAMP Certified, Class D (Rev5, Agency): CrowdStrike Falcon Platform IL5 SaaS (vendor describes as FedRAMP High)", "source_url": "https://www.fedramp.gov/marketplace/products/FR1807853629A/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4 (Coalfire QSA report and AOC)", "source_url": "https://www.crowdstrike.com/en-us/why-crowdstrike/crowdstrike-compliance-certification/", "evidence": "trust-center" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 1 and Level 2", "source_url": "https://www.crowdstrike.com/en-us/why-crowdstrike/crowdstrike-compliance-certification/", "evidence": "trust-center" }, { "id": "c5", "status": "yes", "scope": "C5", "source_url": "https://www.crowdstrike.com/en-us/why-crowdstrike/crowdstrike-compliance-certification/", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP assessed", "source_url": "https://www.crowdstrike.com/en-us/why-crowdstrike/crowdstrike-compliance-certification/", "evidence": "trust-center" }, { "id": "ens", "status": "yes", "scope": "ENS High (EDR)", "source_url": "https://www.crowdstrike.com/en-us/why-crowdstrike/crowdstrike-compliance-certification/", "evidence": "trust-center" }, { "id": "tisax", "status": "yes", "scope": "TISAX (assessment ID AM1KZ4-1)", "source_url": "https://www.crowdstrike.com/en-us/why-crowdstrike/crowdstrike-compliance-certification/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "Certifications are stated for the CrowdStrike Falcon platform, which hosts Falcon Identity Protection; a Coalfire HIPAA assessment is listed but no BAA is documented." }, { "vendor_key": "secrets/cyberark-conjur", "vendor": "CyberArk Conjur Cloud / Secrets Hub", "trust_center_url": "https://trust.cyberark.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (CyberArk company-wide; product scope not stated)", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015 (CyberArk company-wide; product scope not stated)", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019 (CyberArk company-wide; product scope not stated)", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "iso42001", "status": "yes", "scope": "ISO/IEC 42001:2023 (CyberArk company-wide)", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1 (level and product scope not stated)", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Now part of Palo Alto Networks (Idira); the trust center lists SOC 2 (PwC) without a report type, and FedRAMP High only for Endpoint Privilege Manager and Workforce Identity." }, { "vendor_key": "ai-identity/cyera", "vendor": "Cyera", "trust_center_url": "https://security.cyera.io/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "Annual SOC 2 Type 2 audit", "source_url": "https://www.cyera.com/contact-us", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://security.cyera.io/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://security.cyera.io/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2025", "source_url": "https://security.cyera.io/", "evidence": "trust-center" }, { "id": "iso42001", "status": "yes", "scope": "ISO/IEC 42001:2023", "source_url": "https://security.cyera.io/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown", "scope": "", "source_url": "https://security.cyera.io/", "evidence": "trust-center" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class D (Rev5, Agency): Cyera for Government (vendor describes as FedRAMP High)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2618046015/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS", "source_url": "https://security.cyera.io/", "evidence": "trust-center" }, { "id": "c5", "status": "yes", "scope": "C5", "source_url": "https://security.cyera.io/", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP", "source_url": "https://security.cyera.io/", "evidence": "trust-center" }, { "id": "ens", "status": "yes", "scope": "ENS RD311/2022 High", "source_url": "https://security.cyera.io/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "States HIPAA compliance but documents no BAA, so recorded as not documented." }, { "vendor_key": "password-management/dashlane", "vendor": "Dashlane", "trust_center_url": "https://trust.dashlane.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.dashlane.com/uploads/2026/01/Security-at-a-Glance-Two-Pager_Updated-March-2026.pdf", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://www.dashlane.com/blog/dashlane-iso-certified", "evidence": "press-release" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "EU" ], "data_residency_source": "https://www.dashlane.com/uploads/2026/01/Security-at-a-Glance-Two-Pager_Updated-March-2026.pdf", "notes": "Encrypted data is hosted in AWS data centers in Ireland per Dashlane's security one-pager." }, { "vendor_key": "pam/delinea", "vendor": "Delinea", "trust_center_url": "https://trust.delinea.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (plus SOC 1 Type 2)", "source_url": "https://trust.delinea.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.delinea.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "Hosted in UberEther IAM Advantage package (FedRAMP Certified, Class D), not a vendor-held authorization: Delinea Secret Server", "source_url": "https://www.fedramp.gov/marketplace/products/FR2208555094/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1", "source_url": "https://trust.delinea.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "The trust center does not map certifications to individual products." }, { "vendor_key": "secrets/delinea-devops-secrets-vault", "vendor": "Delinea DevOps Secrets Vault", "trust_center_url": "https://trust.delinea.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Delinea company-wide; DSV not named on trust center)", "source_url": "https://trust.delinea.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Delinea company-wide)", "source_url": "https://trust.delinea.com/", "evidence": "trust-center" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1 (level and product scope not stated)", "source_url": "https://trust.delinea.com/", "evidence": "trust-center" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://delinea.com/dpa", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" } ], "data_residency": [ "US", "EU", "AU" ], "data_residency_source": "https://docs.delinea.com/online-help/devops-secrets-vault/quickstart/obtaindsv.htm", "notes": "Trust center certifications are listed at company level without naming DevOps Secrets Vault." }, { "vendor_key": "ciam/descope", "vendor": "Descope", "trust_center_url": "https://www.descope.com/security-compliance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.descope.com/security-compliance", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated)", "source_url": "https://www.descope.com/security-compliance", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on Growth plan and above", "source_url": "https://www.descope.com/pricing", "evidence": "pricing-page" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High via Palantir FedStart (PFCS-SS boundary, FedRAMP instance only)", "source_url": "https://docs.descope.com/fedramp", "evidence": "docs" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS SAQ-D AOC for service providers", "source_url": "https://www.descope.com/security-compliance", "evidence": "trust-center" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 2", "source_url": "https://www.descope.com/security-compliance", "evidence": "trust-center" } ], "data_residency": [ "US", "EU", "UK", "CA", "SG", "AU", "BR" ], "data_residency_source": "https://www.descope.com/security-compliance", "notes": "FedRAMP High is inherited from Palantir's PFCS-SS authorization (FR2315464863), not a separate Descope package." }, { "vendor_key": "password-management/devolutions", "vendor": "Devolutions Hub", "trust_center_url": "https://app.conveyor.com/profile/devolutions", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Devolutions Cloud incl. Hub Business; 2024 report)", "source_url": "https://devolutions.net/blog/devolutions-renews-soc-2-type-ii-report-for-hub-business-and-hub-personal/", "evidence": "press-release" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001 (edition not stated)", "source_url": "https://devolutions.net/blog/devolutions-trust-center-gets-a-new-look/", "evidence": "press-release" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701 (edition not stated)", "source_url": "https://devolutions.net/blog/devolutions-trust-center-gets-a-new-look/", "evidence": "press-release" } ], "data_residency": [ "US", "CA", "FR", "AU" ], "data_residency_source": "https://docs.devolutions.net/cloud/knowledge-base/knowledge-base-articles/hosting-region-for-devolutions-cloud" }, { "vendor_key": "identity-verification/didit", "vendor": "Didit", "trust_center_url": "https://docs.didit.me/getting-started/security-compliance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (July 2026 report, March 9 to July 1, 2026 period)", "source_url": "https://docs.didit.me/getting-started/security-compliance", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001", "source_url": "https://docs.didit.me/getting-started/security-compliance", "evidence": "docs" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017", "source_url": "https://docs.didit.me/getting-started/security-compliance", "evidence": "docs" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018", "source_url": "https://docs.didit.me/getting-started/security-compliance", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA and TOMs on request", "source_url": "https://docs.didit.me/getting-started/security-compliance", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "Didit also lists iBeta Level 1 (ISO 30107-3) liveness testing and offers in-country processing for enterprise customers without listing regions." }, { "vendor_key": "pki/digicert", "vendor": "DigiCert", "trust_center_url": "https://www.digicert.com/legal-repository/client-audits-security-documentation", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (report under NDA)", "source_url": "https://www.digicert.com/news/digicert-achieves-global-iso-iec-27001", "evidence": "press-release" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 for CA and trust services (announced October 26, 2026; audit by MSECB)", "source_url": "https://www.digicert.com/news/digicert-achieves-global-iso-iec-27001", "evidence": "press-release" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "in-progress", "scope": "Initial Implementation, class not yet listed (20x, Program): DigiCert for Government", "source_url": "https://www.fedramp.gov/marketplace/products/FR2635050845/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "DigiCert also holds WebTrust for CAs, Baseline Requirements, EV and Code Signing, plus ETSI audits for qualified trust services." }, { "vendor_key": "secrets/doppler", "vendor": "Doppler", "trust_center_url": "https://trust.doppler.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.doppler.com/pricing", "evidence": "pricing-page" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated)", "source_url": "https://www.doppler.com/security", "evidence": "trust-center" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://www.doppler.com/legal/dpa", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Vanta trust center could not be read without JavaScript." }, { "vendor_key": "mfa/duo", "vendor": "Duo Security", "trust_center_url": "https://trustportal.cisco.com/c/r/ctp/trust-portal.html?search_keyword=duo", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (Duo commercial)", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001, edition not stated (Duo commercial)", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO 27017, edition not stated (Duo commercial)", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO 27018, edition not stated (Duo commercial)", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Moderate (Duo Federal); FedRAMP High via Cisco Security Cloud for Government package", "source_url": "https://duo.com/docs/duo-federal-guide", "evidence": "docs" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS self-assessment questionnaire (SAQ), Duo commercial", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 1 (Duo commercial)", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" }, { "id": "c5", "status": "yes", "scope": "BSI C5 (Duo commercial)", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" }, { "id": "ens", "status": "yes", "scope": "Spanish ENS (Duo commercial and Duo Federal)", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" }, { "id": "ismap", "status": "yes", "scope": "ISMAP (Duo commercial)", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP (Duo commercial), level not stated", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" }, { "id": "stateramp", "status": "yes", "scope": "GovRAMP (Duo Federal)", "source_url": "https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-saas-roadmap.pdf", "evidence": "trust-center" } ], "data_residency": [ "US", "CA", "EU", "UK", "AU", "DE", "IN", "SG", "JP" ], "data_residency_source": "https://duo.com/support/security-and-reliability", "notes": "Certifications taken from Cisco's Compliant Cloud Portfolio (last updated May 8, 2026) linked from the Cisco Trust Portal." }, { "vendor_key": "iam/entrust", "vendor": "Entrust", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Entrust's compliance pages returned HTTP 403 to automated checks, so no IDaaS certification could be confirmed." }, { "vendor_key": "identity-verification/footprint", "vendor": "Footprint", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.onefootprint.com/", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001", "source_url": "https://www.onefootprint.com/", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS", "source_url": "https://www.onefootprint.com/", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "No trust center page found; certifications appear in the site footer." }, { "vendor_key": "ciam/frontegg", "vendor": "Frontegg", "trust_center_url": "https://frontegg.com/trust-center", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://frontegg.com/trust-center", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated)", "source_url": "https://frontegg.com/trust-center", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO 27701 (edition not stated)", "source_url": "https://frontegg.com/trust-center/privacy", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on Enterprise plan", "source_url": "https://frontegg.com/pricing", "evidence": "pricing-page" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://frontegg.com/data-processing-addendum", "evidence": "docs" } ], "data_residency": [ "EU", "US", "AU", "CA" ], "data_residency_source": "https://developers.frontegg.com/ciam/api/overview" }, { "vendor_key": "ciam/fusionauth", "vendor": "FusionAuth", "trust_center_url": "https://trust.fusionauth.io/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://trust.fusionauth.io/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated)", "source_url": "https://trust.fusionauth.io/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA offered to select customers", "source_url": "https://trust.fusionauth.io/", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Says it can be deployed in FedRAMP-compliant infrastructure, which is not a FedRAMP authorization." }, { "vendor_key": "secrets/gitguardian", "vendor": "GitGuardian", "trust_center_url": "https://trust.gitguardian.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (audited by Prescient Assurance)", "source_url": "https://www.gitguardian.com/legal/public-security-policy", "evidence": "docs" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "EU" ], "data_residency_source": "https://blog.gitguardian.com/european-hosting-data-sovereignty/", "notes": "Vanta trust center could not be read without JavaScript." }, { "vendor_key": "pki/globalsign", "vendor": "GlobalSign", "trust_center_url": "https://www.globalsign.com/en/company", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001 (GMO GlobalSign K.K. certificate covers CA and TrustLogin operations, ISO/IEC 27001:2022)", "source_url": "https://www.globalsign.com/en/company", "evidence": "docs" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://www.globalsign.com/en/company", "evidence": "docs" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://www.globalsign.com/en/company", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "As a public CA, GlobalSign publishes WebTrust audit reports and an eIDAS conformity certificate in its repository; no SOC 2 report is listed." }, { "vendor_key": "ciam/google-identity", "vendor": "Google Cloud Identity Platform", "trust_center_url": "https://cloud.google.com/security/compliance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 (Google Cloud SOC 1, 2, 3 reports; service in scope)", "source_url": "https://cloud.google.com/security/compliance/soc-2", "evidence": "official-registry" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (service in scope)", "source_url": "https://cloud.google.com/security/compliance/iso-27001", "evidence": "official-registry" }, { "id": "hipaa-baa", "status": "yes", "scope": "Covered under the Google Cloud BAA", "source_url": "https://cloud.google.com/security/compliance/hipaa", "evidence": "docs" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High P-ATO and DoD IL2 (Google Cloud)", "source_url": "https://docs.cloud.google.com/architecture/security/fedramp-dod-compliance-scope", "evidence": "docs" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1 (service in scope of Google Cloud QSA assessment)", "source_url": "https://cloud.google.com/security/compliance/pci-dss", "evidence": "official-registry" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://cloud.google.com/security/compliance/iso-27017", "evidence": "official-registry" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018 (edition not stated on scope list)", "source_url": "https://cloud.google.com/security/compliance/iso-27018", "evidence": "official-registry" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701, edition not stated", "source_url": "https://cloud.google.com/security/compliance/iso-27701", "evidence": "official-registry" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 2", "source_url": "https://cloud.google.com/security/compliance/csa", "evidence": "official-registry" }, { "id": "c5", "status": "yes", "scope": "BSI C5", "source_url": "https://cloud.google.com/security/compliance/bsi-c5", "evidence": "official-registry" }, { "id": "irap", "status": "yes", "scope": "IRAP", "source_url": "https://cloud.google.com/security/compliance/irap", "evidence": "official-registry" }, { "id": "ismap", "status": "yes", "scope": "ISMAP", "source_url": "https://cloud.google.com/security/compliance/ismap", "evidence": "official-registry" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (Cloud Data Processing Addendum)", "source_url": "https://cloud.google.com/terms/data-processing-addendum", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "Google does not document a selectable data location for Identity Platform user data." }, { "vendor_key": "secrets/google-cloud-secret-manager", "vendor": "Google Cloud Secret Manager", "trust_center_url": "https://cloud.google.com/security/compliance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 (Google Cloud SOC 1, 2, 3 reports; service in scope)", "source_url": "https://cloud.google.com/security/compliance/soc-2", "evidence": "official-registry" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (service in scope)", "source_url": "https://cloud.google.com/security/compliance/iso-27001", "evidence": "official-registry" }, { "id": "hipaa-baa", "status": "yes", "scope": "Covered under the Google Cloud BAA", "source_url": "https://cloud.google.com/security/compliance/hipaa", "evidence": "docs" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High P-ATO and DoD IL2 to IL5 (excludes global secrets)", "source_url": "https://docs.cloud.google.com/architecture/security/fedramp-dod-compliance-scope", "evidence": "docs" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1 (service in scope of Google Cloud QSA assessment)", "source_url": "https://cloud.google.com/security/compliance/pci-dss", "evidence": "official-registry" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://cloud.google.com/security/compliance/iso-27017", "evidence": "official-registry" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018 (edition not stated on scope list)", "source_url": "https://cloud.google.com/security/compliance/iso-27018", "evidence": "official-registry" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701, edition not stated", "source_url": "https://cloud.google.com/security/compliance/iso-27701", "evidence": "official-registry" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 2", "source_url": "https://cloud.google.com/security/compliance/csa", "evidence": "official-registry" }, { "id": "c5", "status": "yes", "scope": "BSI C5", "source_url": "https://cloud.google.com/security/compliance/bsi-c5", "evidence": "official-registry" }, { "id": "irap", "status": "yes", "scope": "IRAP", "source_url": "https://cloud.google.com/security/compliance/irap", "evidence": "official-registry" }, { "id": "ismap", "status": "yes", "scope": "ISMAP", "source_url": "https://cloud.google.com/security/compliance/ismap", "evidence": "official-registry" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (Cloud Data Processing Addendum)", "source_url": "https://cloud.google.com/terms/data-processing-addendum", "evidence": "docs" } ], "data_residency": [ "US", "CA", "MX", "BR", "CL", "EU", "DE", "FR", "IT", "ES", "NL", "BE", "PL", "FI", "SE", "CH", "UK", "IL", "QA", "SA", "ZA", "IN", "JP", "KR", "SG", "HK", "TW", "ID", "TH", "AU" ], "data_residency_source": "https://cloud.google.com/secret-manager/docs/locations", "notes": "Regional secrets keep data in the chosen location; FedRAMP scope excludes global secrets." }, { "vendor_key": "open-source/hanko", "vendor": "Hanko Cloud", "trust_center_url": "https://trust.hanko.io/", "checked_on": "2026-11-05", "certifications": [ { "id": "iso27001", "status": "in-progress", "scope": "ISO 27001 in progress (edition not stated)", "source_url": "https://trust.hanko.io/", "evidence": "trust-center" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://www.hanko.io/dpa", "evidence": "docs" }, { "id": "soc2-type2", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "DE" ], "data_residency_source": "https://www.hanko.io/pricing" }, { "vendor_key": "pam/hashicorp-boundary", "vendor": "HashiCorp Boundary", "trust_center_url": "https://www.hashicorp.com/trust/compliance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 (available under NDA; type not stated on the page)", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (IBM Boundary and Boundary Self-Managed in scope)", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO 27017", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO 27018", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1 Level 1 Service Provider (HCP Boundary)", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "tisax", "status": "yes", "scope": "TISAX (scope SV253H)", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "machine-identity/hashicorp-vault", "vendor": "HashiCorp Vault", "trust_center_url": "https://www.hashicorp.com/trust/compliance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 (available under NDA; type not stated on the page)", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (IBM Vault, Vault Self-Managed, other HashiCorp products)", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO 27017", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO 27018", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1 Level 1 Service Provider (HCP Vault Dedicated, Vault Radar, Boundary)", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "ens", "status": "yes", "scope": "ENS High (IBM Vault)", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "tisax", "status": "yes", "scope": "TISAX (scope SV253H, assessment AV72BA-1)", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" }, { "id": "fips-140", "status": "yes", "scope": "FIPS 140-2 and FIPS 140-3 (Vault)", "source_url": "https://www.hashicorp.com/trust/compliance", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "mfa/hypr", "vendor": "HYPR", "trust_center_url": "https://trust.hypr.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.hypr.com/trust-center/security-compliance", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001, edition not stated (A-LIGN)", "source_url": "https://www.hypr.com/trust-center/security-compliance", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO 27017, edition not stated", "source_url": "https://www.hypr.com/trust-center/security-compliance", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO 27018, edition not stated", "source_url": "https://www.hypr.com/trust-center/security-compliance", "evidence": "trust-center" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 1 (CAIQ v4.0.2 self-assessment)", "source_url": "https://cloudsecurityalliance.org/star/registry/hypr/services/hypr/", "evidence": "official-registry" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://www.hypr.com/trust-center/data-processing-addendum", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "iam/ibm-verify", "vendor": "IBM Verify", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001, edition not stated (Bureau Veritas certification badge)", "source_url": "https://www.ibm.com/products/verify", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Moderate (IBM Verify for Government, under the IBM Platform Services for Government package)", "source_url": "https://www.fedramp.gov/marketplace/products/F1208031461/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS, level not stated", "source_url": "https://www.ibm.com/products/verify", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "IBM's Verify product page shows SOC 2 and HIPAA badges without stating the SOC 2 type or a BAA offer." }, { "vendor_key": "identity-verification/id-me", "vendor": "ID.me", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "Annual SOC 2 Type II audit", "source_url": "https://www.id.me/enterprise", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 certified", "source_url": "https://www.id.me/enterprise", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class C (Rev5, Agency): ID.me Identity Gateway", "source_url": "https://www.fedramp.gov/marketplace/products/FR1718334757/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "ID.me also holds Kantara NIST 800-63-3 IAL2/AAL2 approval (since 2018)." }, { "vendor_key": "pam/cyberark", "vendor": "Idira (formerly CyberArk)", "trust_center_url": "https://trust.cyberark.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 (type not stated on the trust center) and SOC 3", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "iso42001", "status": "yes", "scope": "ISO/IEC 42001:2023", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown", "scope": "", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class D (Rev5, Agency): Idira Identity Security Government Services Platform; FedRAMP Certified, Class D (Rev5, Agency): Idira Endpoint Privilege Manager for Government (vendor describes as FedRAMP High)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2001619337/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR (level not stated)", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "cyber-essentials-plus", "status": "yes", "scope": "Cyber Essentials Plus", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP", "source_url": "https://trust.cyberark.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "FedRAMP packages are now listed under Palo Alto Networks with Idira product names; the trust center does not map certifications to products; states HIPAA compliance but documents no BAA, so recorded as not documented." }, { "vendor_key": "identity-verification/idnow", "vendor": "IDnow", "trust_center_url": "https://trust.idnow.io/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001:2022 (cert I-12353/25), all four IDnow group entities", "source_url": "https://trust.idnow.io/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "tisax", "status": "yes", "scope": "TISAX AL3 (ID LWCYV1)", "source_url": "https://trust.idnow.io/", "evidence": "trust-center" }, { "id": "gdpr-dpa", "status": "yes", "scope": "Art. 28 GDPR data processor terms", "source_url": "https://trust.idnow.io/", "evidence": "trust-center" } ], "data_residency": [ "EU" ], "data_residency_source": "https://trust.idnow.io/", "notes": "IDnow is also a qualified trust service provider under eIDAS 2.0 and lists ISAE 3402 Type 2 for VideoIdent." }, { "vendor_key": "zero-trust/illumio", "vendor": "Illumio", "trust_center_url": "https://trust.illumio.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2", "source_url": "https://trust.illumio.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.illumio.com/", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://trust.illumio.com/", "evidence": "trust-center" }, { "id": "iso42001", "status": "yes", "scope": "ISO/IEC 42001:2023", "source_url": "https://trust.illumio.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class C (Rev5, Agency): Illumio Government Cloud", "source_url": "https://www.fedramp.gov/marketplace/products/FR2230244107/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" }, { "id": "fips-140", "status": "yes", "scope": "FIPS 140-2 (listed on trust center)", "source_url": "https://trust.illumio.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "A PCI DSS report is listed among trust center documents but not as a certification, so PCI is left unknown." }, { "vendor_key": "identity-verification/incode", "vendor": "Incode", "trust_center_url": "https://trust.incode.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2", "source_url": "https://trust.incode.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.incode.com/", "evidence": "trust-center" }, { "id": "iso42001", "status": "yes", "scope": "ISO/IEC 42001:2023", "source_url": "https://trust.incode.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown", "scope": "", "source_url": "https://trust.incode.com/", "evidence": "trust-center" }, { "id": "fedramp", "status": "in-progress", "scope": "Agency Authorization In Process, Class C (Rev5, Agency): Incode Platform (vendor trust center lists FedRAMP Moderate; marketplace shows Agency Authorization In Process)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2510341317/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Incode also lists ISO/IEC 30107-3:2023 and a Kantara IAL2 trust mark; states HIPAA compliance but documents no BAA, so recorded as not documented." }, { "vendor_key": "secrets/infisical", "vendor": "Infisical", "trust_center_url": "https://trust.infisical.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Infisical Cloud)", "source_url": "https://infisical.com/pricing", "evidence": "pricing-page" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "EU" ], "data_residency_source": "https://infisical.com/docs/internals/architecture/cloud", "notes": "Homepage says HIPAA compliant but does not state that a BAA is offered; Vanta trust center could not be read without JavaScript." }, { "vendor_key": "identity-verification/jumio", "vendor": "Jumio", "trust_center_url": "https://trust.jumio.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2", "source_url": "https://trust.jumio.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001", "source_url": "https://trust.jumio.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS 4.0.1", "source_url": "https://trust.jumio.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "The trust center lists SOC 2 without stating the report type." }, { "vendor_key": "iam/jumpcloud", "vendor": "JumpCloud", "trust_center_url": "https://jumpcloud.com/security", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (open directory platform); report under NDA", "source_url": "https://jumpcloud.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001, edition not stated (open directory platform)", "source_url": "https://jumpcloud.com/security", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://jumpcloud.com/legal/dataprotection", "evidence": "docs" } ], "data_residency": [ "US", "EU", "IN" ], "data_residency_source": "https://jumpcloud.com/support/jumpcloud-data-centers-login-urls-and-service-endpoints" }, { "vendor_key": "pam/keeper-security", "vendor": "Keeper Security", "trust_center_url": "https://www.keepersecurity.com/security.html", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2", "source_url": "https://www.keepersecurity.com/security.html", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001", "source_url": "https://www.keepersecurity.com/security.html", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO 27017", "source_url": "https://www.keepersecurity.com/security.html", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO 27018", "source_url": "https://www.keepersecurity.com/security.html", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown", "scope": "", "source_url": "https://www.keepersecurity.com/security.html", "evidence": "trust-center" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class D (Rev5, Agency): Keeper ICAM & Identity Security Platform for Government (vendor describes as FedRAMP High)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2116544598A/", "evidence": "official-registry" }, { "id": "stateramp", "status": "yes", "scope": "GovRAMP High Authorized (vendor-stated)", "source_url": "https://www.keepersecurity.com/security.html", "evidence": "trust-center" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS Level 1", "source_url": "https://www.keepersecurity.com/security.html", "evidence": "trust-center" }, { "id": "fips-140", "status": "yes", "scope": "FIPS 140-3 validated encryption modules (vendor-stated)", "source_url": "https://www.keepersecurity.com/security.html", "evidence": "trust-center" } ], "data_residency": [ "US", "EU", "AU", "JP", "CA" ], "data_residency_source": "https://www.keepersecurity.com/security.html", "notes": "Keeper also runs a separate US Government Cloud region; states HIPAA compliance but documents no BAA, so recorded as not documented." }, { "vendor_key": "pki/keyfactor", "vendor": "Keyfactor", "trust_center_url": "https://trust.keyfactor.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (EJBCA SaaS and PKIaaS) and SOC 3", "source_url": "https://trust.keyfactor.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (2026 annual certificate)", "source_url": "https://trust.keyfactor.com/", "evidence": "trust-center" }, { "id": "iso42001", "status": "yes", "scope": "ISO/IEC 42001:2023", "source_url": "https://trust.keyfactor.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class C (Rev5, Agency): Keyfactor for Government", "source_url": "https://www.fedramp.gov/marketplace/products/FR2335051964/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Keyfactor also lists CMMC and Common Criteria." }, { "vendor_key": "mfa/keytos", "vendor": "Keytos", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.keytos.io/docs/keytos-faq/", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001, edition not stated", "source_url": "https://www.keytos.io/docs/keytos-faq/", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "AU", "EU" ], "data_residency_source": "https://www.keytos.io/docs/keytos-faq/", "notes": "Reports are available to customers from the Trust Center page inside the product portal." }, { "vendor_key": "ciam/kinde", "vendor": "Kinde", "trust_center_url": "https://docs.kinde.com/trust-center/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (attested by AssuranceLab)", "source_url": "https://docs.kinde.com/trust-center/privacy-and-compliance/compliance/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001:2022 (certified by Compass Assurance Services)", "source_url": "https://docs.kinde.com/trust-center/privacy-and-compliance/compliance/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on request", "source_url": "https://docs.kinde.com/trust-center/privacy-and-compliance/compliance/", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "AU", "US", "CA", "EU", "UK" ], "data_residency_source": "https://docs.kinde.com/get-started/learn-about-kinde/supported-data-regions/" }, { "vendor_key": "password-management/lastpass", "vendor": "LastPass", "trust_center_url": "https://www.lastpass.com/trust-center", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (plus SOC 3)", "source_url": "https://www.lastpass.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated)", "source_url": "https://www.lastpass.com/security", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "iso27701", "status": "yes", "scope": "ISO 27701 (edition not stated)", "source_url": "https://www.lastpass.com/trust-center/privacy", "evidence": "trust-center" }, { "id": "c5", "status": "yes", "scope": "BSI C5", "source_url": "https://www.lastpass.com/security", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP assessment against the ISM completed September 2025", "source_url": "https://blog.lastpass.com/posts/lastpass-completes-irap-assessment", "evidence": "press-release" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "identity-verification/lexisnexis-risk", "vendor": "LexisNexis Risk Solutions", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "in-progress", "scope": "FedRAMP In Process, Class C (Rev5, Agency): LexisNexis Risk Enterprise Platform", "source_url": "https://www.fedramp.gov/marketplace/products/FR2611036548/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "No public certification list found on risk.lexisnexis.com." }, { "vendor_key": "ciam/loginradius", "vendor": "LoginRadius", "trust_center_url": "https://trust.loginradius.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (audited by A-LIGN)", "source_url": "https://www.loginradius.com/compliance", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (certified by BSI)", "source_url": "https://www.loginradius.com/docs/tenant-management/platform-security/infrastructure-and-data-security/overview/", "evidence": "docs" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA offered (plan terms not stated)", "source_url": "https://www.loginradius.com/compliance/hipaa", "evidence": "docs" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS compliant (level and role not stated)", "source_url": "https://www.loginradius.com/compliance/pci-dss-compliant", "evidence": "docs" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://www.loginradius.com/compliance", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019 (certified by BSI)", "source_url": "https://www.loginradius.com/docs/tenant-management/platform-security/infrastructure-and-data-security/overview/", "evidence": "docs" } ], "data_residency": [ "US", "CA", "BR", "CL", "ZA", "UK", "EU", "IE", "BE", "NL", "FR", "DE", "CH", "PL", "SE", "FI", "ES", "IT", "BH", "AE", "QA", "SA", "IL", "HK", "TW", "IN", "SG", "ID", "JP", "KR", "AU" ], "data_residency_source": "https://www.loginradius.com/docs/tenant-management/platform-security/tenant-and-environment/loginradius-data-region/" }, { "vendor_key": "open-source/logto", "vendor": "Logto Cloud", "trust_center_url": "https://trust.logto.io/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Logto Cloud)", "source_url": "https://logto.io/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on Enterprise plan", "source_url": "https://logto.io/pricing", "evidence": "pricing-page" }, { "id": "iso27001", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "EU", "US", "AU", "JP" ], "data_residency_source": "https://docs.logto.io/logto-cloud/tenant-settings", "notes": "Trust center returned HTTP 429 during checks." }, { "vendor_key": "iga/lumos", "vendor": "Lumos", "trust_center_url": "https://trust.lumos.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (plus SOC 1 Type II)", "source_url": "https://trust.lumos.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001:2022", "source_url": "https://trust.lumos.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "Data Processing Addendum published", "source_url": "https://trust.lumos.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "itdr/microsoft-defender-identity", "vendor": "Microsoft Defender for Identity", "trust_center_url": "https://servicetrust.microsoft.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "In scope of the Azure SOC 2 Type 2 attestation report", "source_url": "https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-2", "evidence": "docs" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "Listed as Azure Advanced Threat Protection (the former name of Defender for Identity) inside Microsoft Azure Government (FedRAMP Certified, Class D, Rev5, JAB)", "source_url": "https://www.fedramp.gov/marketplace/products/F1603087869/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Microsoft publishes certifications per cloud and lists in-scope services; Defender for Identity is not named on the ISO 27001 or PCI DSS offering pages." }, { "vendor_key": "ciam/microsoft-entra-external-id", "vendor": "Microsoft Entra External ID", "trust_center_url": "https://servicetrust.microsoft.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High and DoD IL2 in Azure public cloud (Entra ID authorization applies to External ID)", "source_url": "https://learn.microsoft.com/en-us/azure/azure-government/compliance/azure-services-in-fedramp-auditscope", "evidence": "docs" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (Microsoft Products and Services DPA)", "source_url": "https://aka.ms/dpa", "evidence": "docs" } ], "data_residency": [ "US", "EU", "APAC", "AU", "JP" ], "data_residency_source": "https://learn.microsoft.com/en-us/entra/fundamentals/data-residency", "notes": "External ID is not named separately in the Azure audit-scope appendix (Entra ID and Azure AD B2C are), so only FedRAMP is confirmed." }, { "vendor_key": "iam/microsoft-entra", "vendor": "Microsoft Entra ID", "trust_center_url": "https://servicetrust.microsoft.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (Azure report; Microsoft Entra ID (Free and Premium P1 + P2) in audit scope)", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Azure certificate; Microsoft Entra ID (Free and Premium P1 + P2) in audit scope)", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "hipaa-baa", "status": "yes", "scope": "Covered by the HIPAA BAA in the Microsoft Product Terms", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High in Azure (public) and Azure Government; DoD IL2 to IL5 in Azure Government", "source_url": "https://learn.microsoft.com/en-us/azure/azure-government/compliance/azure-services-in-fedramp-auditscope", "evidence": "docs" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0, Azure is a Level 1 service provider", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Certification and Attestation", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "hitrust", "status": "yes", "scope": "HITRUST (Azure services in audit scope)", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "c5", "status": "yes", "scope": "Germany C5", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "ens", "status": "yes", "scope": "Spain ENS High", "source_url": "https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3", "evidence": "docs" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (Microsoft Products and Services DPA)", "source_url": "https://aka.ms/dpa", "evidence": "docs" } ], "data_residency": [ "US", "EU", "APAC", "AU", "JP" ], "data_residency_source": "https://learn.microsoft.com/en-us/entra/fundamentals/data-residency", "notes": "Tenant data stays in the geo chosen at creation (North America, EMEA, Asia/Pacific, Australia, Japan); APAC is the Asia/Pacific geo." }, { "vendor_key": "identity-verification/middesk", "vendor": "Middesk", "trust_center_url": "https://trust.middesk.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.middesk.com/", "evidence": "docs" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "The trust center did not render for automated checks; the SOC 2 claim comes from the Middesk homepage." }, { "vendor_key": "iam/miniorange", "vendor": "miniOrange", "trust_center_url": "https://www.miniorange.com/terms-and-policies/security-practices", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001, edition not stated (certification badge)", "source_url": "https://www.miniorange.com/compliances/", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "EU", "AU" ], "data_residency_source": "https://www.miniorange.com/terms-and-policies/security-practices", "notes": "The SOC 2 report miniOrange links to is AWS's, not its own." }, { "vendor_key": "ciam/mojoauth", "vendor": "MojoAuth", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (listed on vendor HIPAA page; no public report)", "source_url": "https://mojoauth.com/resources/hipaa-authentication/", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated; listed on vendor HIPAA page)", "source_url": "https://mojoauth.com/resources/hipaa-authentication/", "evidence": "docs" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on Enterprise plan", "source_url": "https://mojoauth.com/resources/hipaa-authentication/", "evidence": "docs" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "EU" ], "data_residency_source": "https://mojoauth.com/resources/gdpr-authentication/", "notes": "Also lists an Asia-Pacific residency option without naming a country." }, { "vendor_key": "zero-trust/netskope", "vendor": "Netskope", "trust_center_url": "https://www.netskope.com/company/security-compliance-and-assurance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 report (type not stated on page)", "source_url": "https://www.netskope.com/company/security-compliance-and-assurance", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001", "source_url": "https://www.netskope.com/company/security-compliance-and-assurance", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown", "scope": "", "source_url": "https://www.netskope.com/company/security-compliance-and-assurance", "evidence": "trust-center" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class D (Rev5, Agency): Netskope NewEdge Government.", "source_url": "https://www.fedramp.gov/marketplace/products/FR2105946715/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Certification", "source_url": "https://www.netskope.com/company/security-compliance-and-assurance", "evidence": "trust-center" }, { "id": "c5", "status": "yes", "scope": "C5 attestation", "source_url": "https://www.netskope.com/company/security-compliance-and-assurance", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP assessed", "source_url": "https://www.netskope.com/company/security-compliance-and-assurance", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "States HIPAA compliance but documents no BAA, so recorded as not documented." }, { "vendor_key": "ciam/nevis", "vendor": "Nevis", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Nevis Security AG; secure software development and SaaS product operation and support; valid to 2027-11-17)", "source_url": "https://nevis.net/hubfs/2023/Images/ISO/NEVIS%20AG%20-%20IWS%20Certificate_2024.pdf", "evidence": "certificate" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "mfa/nok-nok-labs", "vendor": "Nok Nok Labs", "trust_center_url": "https://www.onespan.com/support/onespan-trust-compliance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Acquired by OneSpan in June 2025; OneSpan's certification list does not name the Nok Nok product." }, { "vendor_key": "password-management/nordpass", "vendor": "NordPass", "trust_center_url": "https://trust.nordpass.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "NordPass's site and trust center could not be read by our checker on 2026-11-05, so its stated certifications await manual verification." }, { "vendor_key": "ai-identity/oasis-security", "vendor": "Oasis Security", "trust_center_url": "https://trust.oasis.security/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2", "source_url": "https://trust.oasis.security/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.oasis.security/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "iam/okta", "vendor": "Okta", "trust_center_url": "https://security.okta.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Workforce Identity, Customer Identity and Auth0 platforms)", "source_url": "https://security.okta.com/?itemUid=7bfa66da-33ab-49de-8391-e329738a1ae9", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://security.okta.com/?itemUid=5c93ca3e-519a-4260-a50a-a9de78294538", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://security.okta.com/?itemUid=0c1fdf36-c946-4670-9354-8fa3e4260ab1", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://security.okta.com/?itemUid=d9cdeb36-7f27-4904-962f-d39c6d32384a", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA available for core identity cloud services", "source_url": "https://security.okta.com/?itemUid=aec41c33-0f3a-4030-ac59-49adfd4a975b", "evidence": "trust-center" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Moderate (Okta for Government Moderate) and FedRAMP High (Okta for Government High only)", "source_url": "https://security.okta.com/?itemUid=73045931-8cee-4b8a-bcc7-94373219e6a3", "evidence": "trust-center" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0 ROC; core IDaaS in scope as a supporting service provider", "source_url": "https://security.okta.com/?itemUid=979071a1-db25-43f3-a8e2-31cefc7329cd", "evidence": "trust-center" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 2 certification", "source_url": "https://cloudsecurityalliance.org/star/registry/okta-inc", "evidence": "official-registry" }, { "id": "c5", "status": "yes", "scope": "BSI C5 (achieved October 2024)", "source_url": "https://security.okta.com/?itemUid=ff0a4951-2f01-4656-b5eb-9f804fd43ce0", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP PROTECTED (IDaaS, Auth0, Workflows, OPA, OIG, OAG)", "source_url": "https://security.okta.com/?itemUid=5f41759e-586c-45bc-b9cd-dc147d8e6aaa", "evidence": "trust-center" }, { "id": "stateramp", "status": "yes", "scope": "StateRAMP (GovRAMP) Authorized, Workforce IDaaS", "source_url": "https://security.okta.com/?itemUid=4d7b51f2-a131-4dce-9692-4782d6972317", "evidence": "trust-center" }, { "id": "ens", "status": "yes", "scope": "ENS High (March 2024)", "source_url": "https://security.okta.com/?itemUid=c5b5f0a4-0b1f-4b9e-9c1f-1b5c1b0e5b1e", "evidence": "trust-center" }, { "id": "tisax", "status": "yes", "scope": "TISAX (issued August 15, 2024)", "source_url": "https://security.okta.com/?itemUid=2116be92-6557-4c2a-9b40-1a393d20e1b9", "evidence": "trust-center" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://security.okta.com/?itemUid=45220873-6e51-4dbb-b1b1-37d66ee9ef95", "evidence": "trust-center" } ], "data_residency": [ "US", "EU", "JP", "AU", "CA", "IN" ], "data_residency_source": "https://www.okta.com/okta-data-residency/", "notes": "FedRAMP Marketplace lists Okta IDaaS Regulated Cloud (Moderate) and Okta IDaaS Government High Cloud (High)." }, { "vendor_key": "iga/omada", "vendor": "Omada", "trust_center_url": "https://omadaidentity.com/company/trust/compliance/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (bridge letter to September 30, 2026) and public SOC 3", "source_url": "https://omadaidentity.com/company/trust/compliance/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (certificate downloadable)", "source_url": "https://omadaidentity.com/company/trust/compliance/", "evidence": "certificate" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "iam/onelogin", "vendor": "OneLogin", "trust_center_url": "https://trust.oneidentity.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "The One Identity trust center is JavaScript-rendered and gated, so no certification could be confirmed from a public first-party page." }, { "vendor_key": "mfa/onespan", "vendor": "OneSpan", "trust_center_url": "https://www.onespan.com/support/onespan-trust-compliance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Digital Agreements and Cybersecurity SaaS)", "source_url": "https://www.onespan.com/support/onespan-trust-compliance", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (MSECB, valid to 2028-08-19)", "source_url": "https://www.onespan.com/sites/default/files/2026-01/ISO-27001-2022-OneSpan-2025.pdf", "evidence": "certificate" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://www.onespan.com/sites/default/files/2026-01/ISO-27017-2015-OneSpan-2025.pdf", "evidence": "certificate" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://www.onespan.com/sites/default/files/2026-01/ISO-27018-2019-OneSpan-2025.pdf", "evidence": "certificate" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Moderate (OneSpan Sign only)", "source_url": "https://marketplace.fedramp.gov/products/FR1828848692", "evidence": "official-registry" }, { "id": "fips-140", "status": "yes", "scope": "FIPS 140-3 Level 3, DIGIPASS FX Crypto Module (CMVP #5048)", "source_url": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5048", "evidence": "official-registry" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "EU", "CA", "AU" ], "data_residency_source": "https://www.onespan.com/support/onespan-trust-compliance", "notes": "HIPAA is listed for Digital Agreements without a stated BAA; Canada and Australia hosting apply to OneSpan Sign only." }, { "vendor_key": "iam/oracle", "vendor": "Oracle OCI IAM (identity domains)", "trust_center_url": "https://www.oracle.com/corporate/cloud-compliance/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High (Oracle US Government Cloud regions; IAM with identity domains offered there)", "source_url": "https://docs.oracle.com/en-us/iaas/Content/General/Concepts/govfedramp.htm", "evidence": "docs" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "CA", "MX", "BR", "CL", "CO", "EU", "DE", "FR", "IT", "NL", "ES", "SE", "CH", "RS", "UK", "IL", "SA", "AE", "ZA", "MA", "IN", "JP", "KR", "SG", "ID", "AU" ], "data_residency_source": "https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm", "notes": "Oracle lists OCI attestations at line-of-business level only; per-service scope sits in the OCI Console Compliance Documents service." }, { "vendor_key": "ciem/orca-security", "vendor": "Orca Security", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://orca.security/", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001", "source_url": "https://orca.security/", "evidence": "docs" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017", "source_url": "https://orca.security/", "evidence": "docs" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018", "source_url": "https://orca.security/", "evidence": "docs" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701", "source_url": "https://orca.security/", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class C (Rev5, Agency): Orca Cloud Security Platform", "source_url": "https://www.fedramp.gov/marketplace/products/FR2301844932/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI SAQ-D (self-assessment)", "source_url": "https://orca.security/", "evidence": "docs" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level One self-assessment", "source_url": "https://orca.security/", "evidence": "docs" }, { "id": "irap", "status": "yes", "scope": "IRAP certification", "source_url": "https://orca.security/", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "Badges are in the orca.security site footer; no standalone trust center page was found." }, { "vendor_key": "open-source/ory", "vendor": "Ory Network", "trust_center_url": "https://trust.ory.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Ory Network)", "source_url": "https://www.ory.com/docs/security-compliance/compliance-and-certifications", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Ory Network)", "source_url": "https://www.ory.com/docs/security-compliance/compliance-and-certifications", "evidence": "docs" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1 SAQ D for Service Providers (Ory Network)", "source_url": "https://www.ory.com/docs/security-compliance/compliance-and-certifications", "evidence": "docs" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://www.ory.com/legal/dpa", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" } ], "data_residency": [ "EU", "US" ], "data_residency_source": "https://www.ory.com/docs/security-compliance/personal-data-location" }, { "vendor_key": "authorization/oso", "vendor": "Oso", "trust_center_url": "https://trust.osohq.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://www.osohq.com/oso-dpa", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "Oso says it is SOC 2 certified without stating the report type; Oso was acquired by Tiny in October 2026." }, { "vendor_key": "ai-identity/p0-security", "vendor": "P0 Security", "trust_center_url": "https://p0.dev/trust-center/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Advantage Partners)", "source_url": "https://p0.dev/trust-center/", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "zero-trust/palo-alto", "vendor": "Palo Alto Prisma Access", "trust_center_url": "https://www.paloaltonetworks.com/legal-notices/trust-center/certifications", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "Prisma Access operations team and service are SOC 2 certified (vendor FAQ; type not stated)", "source_url": "https://www.paloaltonetworks.com/sase/access", "evidence": "docs" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class D (Rev5, Program): GCS-HIGH; FedRAMP Certified, Class C (Rev5, Agency): Palo Alto Networks Government Cloud Services", "source_url": "https://www.fedramp.gov/marketplace/products/FR2317253567/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "The Palo Alto Networks certifications page lists ISO, PCI DSS, C5, IRAP, ISMAP, ENS High and others company-wide without mapping them to Prisma Access." }, { "vendor_key": "password-management/passbolt", "vendor": "Passbolt", "trust_center_url": "https://passbolt.com/security/more", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.passbolt.com/docs/files/gdpr-report-passbolt-july-2026.pdf", "evidence": "docs" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "EU" ], "data_residency_source": "https://passbolt.com/security/more", "notes": "Passbolt Cloud runs on ISO 27001 certified hosting (GCP Europe, or Luxembourg for Sovereign Cloud), but Passbolt does not state its own ISO 27001 certificate." }, { "vendor_key": "authorization/permit-io", "vendor": "Permit.io", "trust_center_url": "https://www.permit.io/trust", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (latest renewal January 2026)", "source_url": "https://www.permit.io/trust", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA available where applicable", "source_url": "https://www.permit.io/trust", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "identity-verification/persona", "vendor": "Persona", "trust_center_url": "https://trust.withpersona.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (2026 report, combined with HIPAA)", "source_url": "https://trust.withpersona.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001", "source_url": "https://trust.withpersona.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown", "scope": "", "source_url": "https://trust.withpersona.com/", "evidence": "trust-center" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class C (20x Pilot, Program): Persona for Government", "source_url": "https://www.fedramp.gov/marketplace/products/FR2504154395XL/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS certified", "source_url": "https://trust.withpersona.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "Persona also lists Kantara IAL2, iBeta and KJM certifications and offers customer-chosen data residency without listing regions on the trust center; states HIPAA compliance but documents no BAA, so recorded as not documented." }, { "vendor_key": "iam/ping-identity", "vendor": "Ping Identity", "trust_center_url": "https://www.pingidentity.com/en/company/security-at-ping-identity.html", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II; separate Ping and ForgeRock reports under NDA", "source_url": "https://docs.pingidentity.com/pingoneaic/product-information/security-compliance.html", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022, all products and cloud services", "source_url": "https://www.pingidentity.com/en/company/security-at-ping-identity.html", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017 (edition not stated), within certified ISMS", "source_url": "https://www.pingidentity.com/en/company/security-at-ping-identity.html", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018 (edition not stated), within certified ISMS", "source_url": "https://www.pingidentity.com/en/company/security-at-ping-identity.html", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High (Ping Government Identity Cloud via UberEther IAM Advantage only)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2208555094/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 2 (PingOne, PingOne Advanced Services, PingOne Advanced Identity Cloud)", "source_url": "https://www.pingidentity.com/en/company/security-at-ping-identity.html", "evidence": "trust-center" }, { "id": "tisax", "status": "yes", "scope": "TISAX (PingOne Advanced Identity Cloud, ForgeRock entities)", "source_url": "https://www.pingidentity.com/en/company/security-at-ping-identity.html", "evidence": "trust-center" } ], "data_residency": [ "US", "CA", "EU", "AU", "SG" ], "data_residency_source": "https://docs.pingidentity.com/pingone/developer_tools/p1_ip_address_domain_reference.html", "notes": "Ping says its products meet HIPAA requirements but its security page does not mention signing a BAA." }, { "vendor_key": "identity-verification/plaid-identity", "vendor": "Plaid Identity Verification", "trust_center_url": "https://plaid.com/safety/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "Annual SOC 2 Type II report (stated December 2021)", "source_url": "https://plaid.com/blog/plaids-continued-investment-in-security-and-privacy-standards/", "evidence": "press-release" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (announced December 2021)", "source_url": "https://plaid.com/blog/plaids-continued-investment-in-security-and-privacy-standards/", "evidence": "press-release" }, { "id": "iso27701", "status": "yes", "scope": "ISO 27701 (announced December 2021)", "source_url": "https://plaid.com/blog/plaids-continued-investment-in-security-and-privacy-standards/", "evidence": "press-release" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Plaid publishes no current public certification list; the only vendor statement found is a December 2021 announcement, and audit materials sit in a gated security portal." }, { "vendor_key": "authorization/plainid", "vendor": "PlainID", "trust_center_url": "https://www.plainid.com/security-and-compliance/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA on request (privacy@plainid.com)", "source_url": "https://www.plainid.com/security-and-compliance/", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "PlainID announced ISO 27001 and SOC 2 in a January 2021 release, but no current certificate or report type is published." }, { "vendor_key": "ciam/propelauth", "vendor": "PropelAuth", "trust_center_url": "https://www.propelauth.com/security", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2", "source_url": "https://www.propelauth.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://www.propelauth.com/dpa", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "password-management/proton-pass", "vendor": "Proton Pass", "trust_center_url": "https://proton.me/business/trust", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Proton company-wide)", "source_url": "https://proton.me/business/trust", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated; Proton company-wide)", "source_url": "https://proton.me/business/trust", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA available to any Proton user on request", "source_url": "https://proton.me/business/healthcare", "evidence": "docs" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Certifications are stated for Proton as a whole; Proton Pass is not named separately in scope." }, { "vendor_key": "identity-verification/prove", "vendor": "Prove", "trust_center_url": "https://app.vanta.com/prove/trust/p7q3uqiiuel9j5ymrylwzh", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Prove links a Vanta trust center that did not render for automated checks, and its public pages name no certification, only annual third-party audits." }, { "vendor_key": "password-management/psono", "vendor": "Psono", "trust_center_url": "https://trust.esaqa.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated)", "source_url": "https://psono.com/blog/iso27001-certification-2025", "evidence": "press-release" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Psono offers SaaS alongside self-hosting, but its SaaS hosting region is not documented publicly." }, { "vendor_key": "itdr/push-security", "vendor": "Push Security", "trust_center_url": "https://trust.pushsecurity.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Linford & Co)", "source_url": "https://trust.pushsecurity.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001 (ISOQAR cert 26983ISMS001)", "source_url": "https://trust.pushsecurity.com/", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701 (ISOQAR cert 26983PIM001)", "source_url": "https://trust.pushsecurity.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "Data Processing Agreement", "source_url": "https://trust.pushsecurity.com/", "evidence": "trust-center" } ], "data_residency": [ "EU" ], "data_residency_source": "https://trust.pushsecurity.com/", "notes": "Production data is stored in AWS eu-west-1 (Dublin) with backups in eu-west-3 (Paris); Push holds Cyber Essentials (not Plus)." }, { "vendor_key": "password-management/roboform", "vendor": "RoboForm", "trust_center_url": "https://www.roboform.com/security", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Publishes a Secfault Security penetration test summary but no compliance certifications." }, { "vendor_key": "iam/rsa", "vendor": "RSA", "trust_center_url": "https://www.rsa.com/company/secure/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (security, availability, confidentiality); not applicable to FedRAMP environments", "source_url": "https://www.rsa.com/company/secure/", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Moderate (RSA ID Plus for Government only)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2102652499/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "unknown" }, { "id": "csa-star", "status": "yes", "scope": "Listed in CSA STAR registry, level not stated", "source_url": "https://www.rsa.com/company/secure/", "evidence": "trust-center" }, { "id": "fips-140", "status": "yes", "scope": "Uses FIPS 140-2/140-3 validated cryptographic modules", "source_url": "https://www.rsa.com/company/secure/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "iga/sailpoint", "vendor": "SailPoint", "trust_center_url": "https://trust.sailpoint.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (plus SOC 1 Type 2 and SOC 3)", "source_url": "https://trust.sailpoint.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.sailpoint.com/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://trust.sailpoint.com/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://trust.sailpoint.com/", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701", "source_url": "https://trust.sailpoint.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class C (Rev5, Agency): SailPoint Identity Security Cloud", "source_url": "https://www.fedramp.gov/marketplace/products/FR2001938710A/", "evidence": "official-registry" }, { "id": "stateramp", "status": "yes", "scope": "GovRAMP", "source_url": "https://trust.sailpoint.com/", "evidence": "trust-center" }, { "id": "pci-dss", "status": "unknown" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 2", "source_url": "https://trust.sailpoint.com/", "evidence": "trust-center" }, { "id": "c5", "status": "yes", "scope": "C5", "source_url": "https://trust.sailpoint.com/", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP", "source_url": "https://trust.sailpoint.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "ciam/salesforce-identity", "vendor": "Salesforce Identity", "trust_center_url": "https://compliance.salesforce.com/en", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Salesforce Services incl. Lightning Platform and Experience Cloud)", "source_url": "https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-security-privacy-and-architecture.pdf", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Salesforce Services)", "source_url": "https://compliance.salesforce.com/en/services/salesforce-services-hyperforce", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on request; Lightning Platform and Experience Cloud are HIPAA Covered Services", "source_url": "https://www.salesforce.com/company/legal/business-associate-addendum-restrictions", "evidence": "docs" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP High (Government Cloud Plus only)", "source_url": "https://compliance.salesforce.com/en/services/salesforce-government-cloud-plus-hyperforce", "evidence": "trust-center" }, { "id": "pci-dss", "status": "yes", "scope": "Level 1 AoC for Salesforce Services (PAN must use Platform or Classic Encryption)", "source_url": "https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-security-privacy-and-architecture.pdf", "evidence": "docs" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015 (Salesforce Services)", "source_url": "https://compliance.salesforce.com/en/services/salesforce-services-hyperforce", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019 (Salesforce Services)", "source_url": "https://compliance.salesforce.com/en/services/salesforce-services-hyperforce", "evidence": "trust-center" }, { "id": "hitrust", "status": "yes", "scope": "HITRUST CSF certification (Salesforce Services, listed exclusions)", "source_url": "https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-security-privacy-and-architecture.pdf", "evidence": "docs" }, { "id": "c5", "status": "yes", "scope": "BSI C5 (Salesforce Services, listed exclusions)", "source_url": "https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-security-privacy-and-architecture.pdf", "evidence": "docs" }, { "id": "ismap", "status": "yes", "scope": "ISMAP (Lightning Platform, Experience Cloud and other listed services)", "source_url": "https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-security-privacy-and-architecture.pdf", "evidence": "docs" }, { "id": "ens", "status": "yes", "scope": "ENS High (Salesforce Services, listed exclusions)", "source_url": "https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-security-privacy-and-architecture.pdf", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "Salesforce Identity runs on Lightning Platform and Experience Cloud, so these records reflect the Salesforce Services scope that covers them." }, { "vendor_key": "ciam/sap-customer-data-cloud", "vendor": "SAP Customer Data Cloud", "trust_center_url": "https://www.sap.com/about/trust-center.html", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (SAP Customer Data Solutions: CDC and CDP; period Apr 2024 to Mar 2025)", "source_url": "https://www.sap.com/about/trust-center/certification-compliance/sap-customer-data-solutions-soc-2-2025-h1.html", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "EU", "AU" ], "data_residency_source": "https://www.sap.com/about/trust-center/certification-compliance/sap-customer-data-solutions-soc-2-2025-h1.html", "notes": "Latest SOC 2 page found covers a period ending March 2025; SAP's compliance finder blocked automated reads, so other certificates were not confirmed." }, { "vendor_key": "iga/saviynt", "vendor": "Saviynt", "trust_center_url": "https://trust.saviynt.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (2025 audit) and SOC 1 Type II", "source_url": "https://trust.saviynt.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.saviynt.com/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://trust.saviynt.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class D (Rev5, Agency): Saviynt High Security Identity Platform; FedRAMP Certified, Class C (Rev5, Agency): Saviynt Enterprise Identity Cloud (EIC)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2623840126/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0 AOC (2024) for Saviynt EIC; Saviynt does not process cardholder data", "source_url": "https://trust.saviynt.com/", "evidence": "trust-center" }, { "id": "cyber-essentials-plus", "status": "yes", "scope": "Cyber Essentials Plus", "source_url": "https://trust.saviynt.com/", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP", "source_url": "https://trust.saviynt.com/", "evidence": "trust-center" }, { "id": "fips-140", "status": "yes", "scope": "FIPS 140-3 (listed on trust center)", "source_url": "https://trust.saviynt.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "Saviynt says the platform offers data residency in 25+ regions but does not list them publicly." }, { "vendor_key": "ciam/scalekit", "vendor": "Scalekit", "trust_center_url": "https://www.scalekit.com/trust-center", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://www.scalekit.com/trust-center", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated)", "source_url": "https://www.scalekit.com/trust-center", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA offered", "source_url": "https://www.scalekit.com/enterprise", "evidence": "docs" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "EU", "US" ], "data_residency_source": "https://www.scalekit.com/trust-center", "notes": "Dedicated clusters in Frankfurt (EU) and Los Angeles (NA)." }, { "vendor_key": "mfa/secret-double-octopus", "vendor": "Secret Double Octopus", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://doubleoctopus.com/dpa/", "evidence": "docs" }, { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "The DPA says SDO runs its ISMS in line with ISO 27001 but does not claim certification." }, { "vendor_key": "pki/sectigo", "vendor": "Sectigo", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "The ISO/IEC 27001:2022 certificate Sectigo publishes (MSECB CERT-001083) was valid until 2026-10-09 and no renewed certificate was posted at check time, so ISO 27001 is recorded as unknown." }, { "vendor_key": "iam/secureauth", "vendor": "SecureAuth", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://secureauth.com/our-story", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001, edition not stated", "source_url": "https://secureauth.com/our-story", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "itdr/semperis", "vendor": "Semperis", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "No trust center or certification page found on semperis.com." }, { "vendor_key": "authorization/sgnl", "vendor": "SGNL", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Acquired by CrowdStrike in February 2026; sgnl.ai now redirects to CrowdStrike and no SGNL-specific certification scope is published." }, { "vendor_key": "itdr/silverfort", "vendor": "Silverfort", "trust_center_url": "https://trust.silverfort.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.silverfort.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "The trust center lists a SOC 2 report without stating its type." }, { "vendor_key": "pki/smallstep", "vendor": "Smallstep", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 for SaaS and Hybrid (Step CA Pro) deployments; type not stated on this page", "source_url": "https://smallstep.com/deployment-options/", "evidence": "docs" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "fips-140", "status": "yes", "scope": "Cloud keys in FIPS 140-2 or 140-3 compliant HSMs (vendor-stated)", "source_url": "https://smallstep.com/deployment-options/", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "The Run Anywhere self-hosted model lists an optional FedRAMP configuration, which is not a FedRAMP authorization." }, { "vendor_key": "identity-verification/socure", "vendor": "Socure", "trust_center_url": "https://trust.socure.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2", "source_url": "https://trust.socure.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.socure.com/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://trust.socure.com/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2025", "source_url": "https://trust.socure.com/", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2025", "source_url": "https://trust.socure.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class C (Rev5, Agency): Socure for Government (SocureGov)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2334936522/", "evidence": "official-registry" }, { "id": "stateramp", "status": "yes", "scope": "GovRAMP (plus TX-RAMP Level 2)", "source_url": "https://trust.socure.com/", "evidence": "trust-center" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "ciam/ssojet", "vendor": "SSOJet", "trust_center_url": "https://ssojet.com/security/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on Enterprise plan", "source_url": "https://ssojet.com/security/", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://ssojet.com/legal/data-processing-addendum/", "evidence": "docs" } ], "data_residency": [ "US", "EU", "IE", "DE", "NL", "SG" ], "data_residency_source": "https://ssojet.com/enterprise/", "notes": "Says SOC 2 compliant without a report type and ISO 27001 aligned, not certified; residency is Enterprise only." }, { "vendor_key": "open-source/stack-auth", "vendor": "Stack Auth (now Hexclave)", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Stack Auth now operates as Hexclave and publishes no compliance certifications or trust center." }, { "vendor_key": "password-management/sticky-password", "vendor": "Sticky Password", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Security white paper says the cloud back end runs on Amazon AWS; no compliance certifications are published." }, { "vendor_key": "identity-verification/stripe-identity", "vendor": "Stripe Identity", "trust_center_url": "https://docs.stripe.com/security", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 1 and SOC 2 Type II (annual, on request)", "source_url": "https://docs.stripe.com/security", "evidence": "docs" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI Service Provider Level 1", "source_url": "https://docs.stripe.com/security", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "Certifications are stated for Stripe as a whole, not Identity specifically." }, { "vendor_key": "ciam/strivacity", "vendor": "Strivacity", "trust_center_url": "https://security.strivacity.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II, annual audit by Schellman", "source_url": "https://security.strivacity.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA offered to customers storing PHI", "source_url": "https://security.strivacity.com/", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS SAQ-D AOC for service providers, annual, Schellman", "source_url": "https://security.strivacity.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "Docs say data can reside in any AWS region, plus Alibaba Cloud Shanghai for China, without a country list in text." }, { "vendor_key": "ciam/stytch", "vendor": "Stytch", "trust_center_url": "https://security.twilio.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II; Stytch report in Twilio Trust Center", "source_url": "https://stytch.com/blog/announcing-our-soc-2-type-ii/", "evidence": "press-release" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated); Stytch certificate in Twilio Trust Center", "source_url": "https://stytch.com/docs/resources/policies/security-and-trust/compliance/overview", "evidence": "docs" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on Enterprise plan", "source_url": "https://stytch.com/pricing", "evidence": "pricing-page" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "Stytch PCI DSS document in Twilio Trust Center (level not stated)", "source_url": "https://stytch.com/docs/resources/policies/security-and-trust/compliance/overview", "evidence": "docs" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (Twilio DPA)", "source_url": "https://stytch.com/docs/resources/policies/security-and-trust/compliance/data-compliance", "evidence": "docs" } ], "data_residency": [ "US" ], "data_residency_source": "https://stytch.com/docs/resources/policies/security-and-trust/compliance/data-compliance", "notes": "Acquired by Twilio in November 2025; Stytch compliance documents sit in the Twilio Trust Center." }, { "vendor_key": "identity-verification/sumsub", "vendor": "Sumsub", "trust_center_url": "https://sumsub.com/sumsub-trust-center/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (plus SOC 1 Type 1)", "source_url": "https://sumsub.com/sumsub-trust-center/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001", "source_url": "https://sumsub.com/sumsub-trust-center/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017", "source_url": "https://sumsub.com/sumsub-trust-center/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018", "source_url": "https://sumsub.com/sumsub-trust-center/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS certificate and AoC", "source_url": "https://sumsub.com/sumsub-trust-center/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "Sumsub also lists ETSI 119/319 eIDAS conformity, iBeta Levels 1 to 3 and ISO/IEC 29115 and 29003." }, { "vendor_key": "open-source/supabase-auth", "vendor": "Supabase Auth (Supabase platform)", "trust_center_url": "https://trust.supabase.io/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Supabase platform)", "source_url": "https://supabase.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (Supabase platform)", "source_url": "https://trust.supabase.io/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on Team and Enterprise plans", "source_url": "https://supabase.com/security", "evidence": "trust-center" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS listed on trust center (level and role not stated)", "source_url": "https://trust.supabase.io/", "evidence": "trust-center" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://supabase.com/legal/dpa", "evidence": "docs" }, { "id": "fedramp", "status": "unknown" } ], "data_residency": [ "US", "CA", "EU", "UK", "CH", "IN", "SG", "JP", "KR", "AU", "BR" ], "data_residency_source": "https://supabase.com/docs/guides/platform/regions" }, { "vendor_key": "ciam/supertokens", "vendor": "SuperTokens", "trust_center_url": "https://security.supertokens.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown", "source_url": "https://supertokens.com/pricing", "evidence": "pricing-page" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Pricing page lists SOC 2 compliance for the managed service without naming the report type, and the Vanta trust center lists controls only." }, { "vendor_key": "zero-trust/tailscale", "vendor": "Tailscale", "trust_center_url": "https://tailscale.com/security", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Security, Availability, Confidentiality)", "source_url": "https://tailscale.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "no", "scope": "Tailscale states no services are in scope for HIPAA because it stores only metadata", "source_url": "https://tailscale.com/security", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "pam/teleport", "vendor": "Teleport", "trust_center_url": "https://trust.goteleport.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (2026 report, includes HIPAA)", "source_url": "https://trust.goteleport.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.goteleport.com/", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701:2019", "source_url": "https://trust.goteleport.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown", "scope": "", "source_url": "https://trust.goteleport.com/", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS 4.0", "source_url": "https://trust.goteleport.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "The Teleport Beams product has its own SOC 2 Type II report (June to August 2026 period); states HIPAA compliance but documents no BAA, so recorded as not documented." }, { "vendor_key": "itdr/tenable-identity-exposure", "vendor": "Tenable Identity Exposure", "trust_center_url": "https://www.tenable.com/trust/assurance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 report for the Tenable cloud platform (type not stated; on request under MNDA)", "source_url": "https://docs.tenable.com/other/service-description-guide/Content/cloudplatform/certs-and-support.htm", "evidence": "docs" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2013 (corporate ISMS functions)", "source_url": "https://docs.tenable.com/other/service-description-guide/Content/cloudplatform/certs-and-support.htm", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class C (Rev5, Agency): Tenable Government Solutions", "source_url": "https://www.fedramp.gov/marketplace/products/FR1814276801/", "evidence": "official-registry" }, { "id": "stateramp", "status": "yes", "scope": "StateRAMP Authorized (Tenable One Vulnerability Management)", "source_url": "https://docs.tenable.com/other/service-description-guide/Content/cloudplatform/certs-and-support.htm", "evidence": "docs" }, { "id": "pci-dss", "status": "unknown" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR member (Tenable One Vulnerability Management)", "source_url": "https://docs.tenable.com/other/service-description-guide/Content/cloudplatform/certs-and-support.htm", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "Tenable certifications are platform-wide; Tenable does not say whether Identity Exposure is in each scope, and the FedRAMP listing covers Tenable Government Solutions rather than Identity Exposure." }, { "vendor_key": "iam/thales-safenet", "vendor": "Thales SafeNet Trusted Access", "trust_center_url": "https://cpl.thalesgroup.com/access-management/certifications-standards", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (OneWelcome, SafeNet Trusted Access, IdCloud)", "source_url": "https://cpl.thalesgroup.com/access-management/certifications-standards", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001, edition not stated (OneWelcome, SafeNet Trusted Access, IdCloud)", "source_url": "https://cpl.thalesgroup.com/access-management/certifications-standards", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 1 and Level 2 per Thales (SafeNet Trusted Access, IdCloud)", "source_url": "https://cpl.thalesgroup.com/access-management/certifications-standards", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "ai-identity/token-security", "vendor": "Token Security", "trust_center_url": "https://trust.token.security/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2", "source_url": "https://trust.token.security/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.token.security/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "ciam/transmit-security", "vendor": "Transmit Security", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (Data Protection Addendum for Cloud Services)", "source_url": "https://transmitsecurity.com/legal/data-protection-addendum-for-cloud-services", "evidence": "docs" } ], "data_residency": [ "US", "EU", "CA", "AU", "JP" ], "data_residency_source": "https://developer.transmitsecurity.com/guides/deployment/understand_environments_regions_tenants", "notes": "No public trust center or certification page found; the website blocks automated requests." }, { "vendor_key": "identity-verification/trulioo", "vendor": "Trulioo", "trust_center_url": "https://www.trulioo.com/security", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2", "source_url": "https://www.trulioo.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (certified since 2015)", "source_url": "https://www.trulioo.com/security", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "mfa/trusona", "vendor": "Trusona", "trust_center_url": "https://trust.trusona.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type1", "status": "yes", "scope": "SOC 2 Type I (Sensiba, November 2025)", "source_url": "https://trust.trusona.com/", "evidence": "trust-center" }, { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Trust center says SOC 2 Type II is on the roadmap for Q2/Q3 2026." }, { "vendor_key": "mfa/twilio-verify", "vendor": "Twilio Verify", "trust_center_url": "https://security.twilio.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (Twilio platform; Twilio notes credentials do not apply to every product)", "source_url": "https://www.twilio.com/en-us/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001 (Twilio; edition not stated in trust center)", "source_url": "https://security.twilio.com/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015 (Twilio)", "source_url": "https://security.twilio.com/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019 (Twilio)", "source_url": "https://security.twilio.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on Security Edition or Enterprise Edition; Verify and Verify Push are HIPAA eligible", "source_url": "https://www.twilio.com/content/dam/twilio-com/global/en/other/hipaa/pdf/HIPAA-Eligible-Services.pdf", "evidence": "docs" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1 AOC; Level 1 listed (product coverage not stated)", "source_url": "https://security.twilio.com/", "evidence": "trust-center" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://www.twilio.com/en-us/legal/data-protection-addendum", "evidence": "docs" }, { "id": "fedramp", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Certifications are held at the Twilio platform level; Twilio states they do not apply to every product." }, { "vendor_key": "zero-trust/twingate", "vendor": "Twingate", "trust_center_url": "https://trust.twingate.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (annual audit)", "source_url": "https://www.twingate.com/docs/twingate-security", "evidence": "docs" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "The trust center requires a request to access; Twingate says it is hosted in multiple Google Cloud Platform data centers but does not list customer-selectable regions." }, { "vendor_key": "password-management/uniqkey", "vendor": "Uniqkey", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "EU" ], "data_residency_source": "https://www.uniqkey.eu/migrate-to-uniqkey", "notes": "Uniqkey says its data centre is ISO 27001 certified, which is a hosting certification rather than one held by Uniqkey." }, { "vendor_key": "ciam/userfront", "vendor": "Userfront", "trust_center_url": "https://userfront.com/solutions/security-compliance", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2, all five Trust Services Criteria (Ernst & Young)", "source_url": "https://userfront.com/solutions/security-compliance", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "machine-identity/venafi", "vendor": "Venafi (now Palo Alto Networks)", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "The Certificate Manager (formerly Venafi TLS Protect) product page names no certifications, and the Palo Alto Networks certifications page does not map certifications to it." }, { "vendor_key": "mfa/veridium", "vendor": "Veridium", "trust_center_url": null, "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "unknown" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "No public trust center or certification statement found on veridiumid.com." }, { "vendor_key": "identity-verification/veriff", "vendor": "Veriff", "trust_center_url": "https://trust.veriff.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://trust.veriff.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022", "source_url": "https://trust.veriff.com/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO 27017", "source_url": "https://trust.veriff.com/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO 27018", "source_url": "https://trust.veriff.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Veriff also lists UK Cyber Essentials, ISO/IEC 30107-3 Level 1 and 2 liveness testing and UKDIATF certification." }, { "vendor_key": "authorization/warrant", "vendor": "Warrant (now WorkOS FGA)", "trust_center_url": "https://trust.workos.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (WorkOS)", "source_url": "https://workos.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on enterprise plans (WorkOS)", "source_url": "https://workos.com/security", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published (WorkOS)", "source_url": "https://workos.com/legal/data-processing-addendum", "evidence": "docs" } ], "data_residency": [], "data_residency_source": null, "notes": "Warrant was acquired by WorkOS in 2024 and now runs as WorkOS FGA; certifications are WorkOS's." }, { "vendor_key": "ciem/wiz", "vendor": "Wiz", "trust_center_url": "https://trust.wiz.io/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II + HIPAA report", "source_url": "https://www.wiz.io/trust-center", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001", "source_url": "https://www.wiz.io/trust-center", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO 27017", "source_url": "https://www.wiz.io/trust-center", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO 27018", "source_url": "https://www.wiz.io/trust-center", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO 27701", "source_url": "https://www.wiz.io/trust-center", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown", "scope": "", "source_url": "https://www.wiz.io/trust-center", "evidence": "trust-center" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class D (Rev5, Agency): Wiz for U.S. Government", "source_url": "https://www.fedramp.gov/marketplace/products/FR2308034636A/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS v4.0.1 AOC and ROC", "source_url": "https://www.wiz.io/trust-center", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP assessed at PROTECTED level (August 2025)", "source_url": "https://www.wiz.io/blog/irap-assessment-australia-public-sector", "evidence": "press-release" } ], "data_residency": [], "data_residency_source": null, "notes": "States HIPAA compliance but documents no BAA, so recorded as not documented." }, { "vendor_key": "ciam/workos", "vendor": "WorkOS", "trust_center_url": "https://trust.workos.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II", "source_url": "https://workos.com/security", "evidence": "trust-center" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA on enterprise plans", "source_url": "https://workos.com/security", "evidence": "trust-center" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null, "notes": "Vanta-hosted trust center is JavaScript-rendered; facts taken from workos.com/security." }, { "vendor_key": "iam/wso2", "vendor": "WSO2", "trust_center_url": "https://wso2.com/security/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (Identity Platform SaaS, the Asgardeo service)", "source_url": "https://wso2.com/security/compliance/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001:2022 (WSO2 Digital Operations function, not product-specific)", "source_url": "https://wso2.com/security/compliance/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "US", "EU" ], "data_residency_source": "https://wso2.com/identity-platform/docs/references/data-residency-in-identity-platform/", "notes": "WSO2's PCI DSS and HIPAA BAA scopes list its developer, integration and API cloud products, not Identity Platform SaaS." }, { "vendor_key": "identity-verification/yoti", "vendor": "Yoti", "trust_center_url": "https://www.yoti.com/security/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (annual)", "source_url": "https://www.yoti.com/security/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (ID verification services)", "source_url": "https://www.yoti.com/security/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "UK" ], "data_residency_source": "https://www.yoti.com/security/", "notes": "Yoti says it runs two UK data centres (Equinix and Telehouse)." }, { "vendor_key": "mfa/yubico", "vendor": "Yubico", "trust_center_url": "https://trust.yubico.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (YubiEnterprise Delivery and Subscription; Schellman)", "source_url": "https://www.yubico.com/trust/data-security-and-privacy/", "evidence": "trust-center" }, { "id": "fips-140", "status": "yes", "scope": "FIPS 140-3 Level 2 (Physical Level 3), YubiKey 5 Cryptographic Module (CMVP #5291)", "source_url": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5291", "evidence": "official-registry" }, { "id": "iso27001", "status": "unknown" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [], "data_residency_source": null }, { "vendor_key": "open-source/zitadel", "vendor": "ZITADEL Cloud", "trust_center_url": "https://trust.zitadel.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (ZITADEL Cloud)", "source_url": "https://zitadel.com/gdpr", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO 27001 (edition not stated)", "source_url": "https://zitadel.com/gdpr", "evidence": "trust-center" }, { "id": "gdpr-dpa", "status": "yes", "scope": "DPA published", "source_url": "https://zitadel.com/docs/legal/data-processing-agreement", "evidence": "docs" }, { "id": "hipaa-baa", "status": "unknown" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" } ], "data_residency": [ "CH", "EU" ], "data_residency_source": "https://zitadel.com/gdpr", "notes": "Lists HIPAA among its certifications but does not state that a BAA is offered; Vanta trust center could not be read." }, { "vendor_key": "password-management/zoho-vault", "vendor": "Zoho Vault", "trust_center_url": "https://www.zoho.com/compliance.html", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type II (all Zoho cloud services)", "source_url": "https://www.zoho.com/compliance.html", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001 (edition not stated; all Zoho cloud services)", "source_url": "https://www.zoho.com/compliance.html", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "yes", "scope": "BAA template on request via legal@zohocorp.com", "source_url": "https://www.zoho.com/vault/hipaa-compliance.html", "evidence": "docs" }, { "id": "fedramp", "status": "unknown" }, { "id": "pci-dss", "status": "unknown" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017 (edition not stated; all Zoho cloud services)", "source_url": "https://www.zoho.com/compliance.html", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018 (edition not stated; all Zoho cloud services)", "source_url": "https://www.zoho.com/compliance.html", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701 (edition not stated)", "source_url": "https://www.zoho.com/compliance.html", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "Zoho lists account data centers in many countries, but Vault-specific hosting regions are not stated." }, { "vendor_key": "zero-trust/zscaler", "vendor": "Zscaler", "trust_center_url": "https://compliance.zscaler.com/", "checked_on": "2026-11-05", "certifications": [ { "id": "soc2-type2", "status": "yes", "scope": "SOC 2 Type 2 (plus SOC 3)", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "iso27001", "status": "yes", "scope": "ISO/IEC 27001", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "iso27017", "status": "yes", "scope": "ISO/IEC 27017:2015", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "iso27018", "status": "yes", "scope": "ISO/IEC 27018:2019", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "iso27701", "status": "yes", "scope": "ISO/IEC 27701", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "hipaa-baa", "status": "unknown", "scope": "", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "hitrust", "status": "yes", "scope": "HITRUST", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "fedramp", "status": "yes", "scope": "FedRAMP Certified, Class D (Rev5, JAB): Zscaler Internet Access - Government (Secure Web Gateway - vTIC) - High; FedRAMP Certified, Class D (Rev5, JAB): Zscaler Private Access - Government (Zero Trust Networking - VPN Replacement); FedRAMP Certified, Class C (Rev5, Agency): Zscaler Internet Access - Government (Secure Web Gateway - vTIC); FedRAMP Certified, Class C (Rev5, Agency): Zscaler Private Access - Government (Zero Trust Exchange - VPN Replacement)", "source_url": "https://www.fedramp.gov/marketplace/products/FR2227062482/", "evidence": "official-registry" }, { "id": "pci-dss", "status": "yes", "scope": "PCI DSS", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "csa-star", "status": "yes", "scope": "CSA STAR Level 2", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "c5", "status": "yes", "scope": "C5", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "cyber-essentials-plus", "status": "yes", "scope": "Cyber Essentials Plus", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "irap", "status": "yes", "scope": "IRAP", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "ismap", "status": "yes", "scope": "ISMAP", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "ens", "status": "yes", "scope": "ENS", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "tisax", "status": "yes", "scope": "TISAX", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" }, { "id": "fips-140", "status": "yes", "scope": "FIPS 140-2 and FIPS 140-3", "source_url": "https://compliance.zscaler.com/", "evidence": "trust-center" } ], "data_residency": [], "data_residency_source": null, "notes": "States HIPAA compliance but documents no BAA, so recorded as not documented." } ] }