Skip to content
Start with Identity
Join free
Dataset · CC BY 4.0 · verified 2026-11-05

Identity Vendor Certifications Directory

Which of 155 identity vendors document SOC 2 Type II, ISO 27001, a HIPAA BAA, FedRAMP and PCI DSS, with the exact scope (edition, plan, government-only product) and a link to the vendor's own trust center or an official registry for every cell. Filter by category and by what a vendor must have.

155
identity vendors checked against their own trust pages
76%
document a SOC 2 Type II report
13 of 28
CIAM platforms document SOC 2 Type II, ISO 27001 and a HIPAA BAA
20%
say they sign a HIPAA BAA
Must document (all selected)

155 of 155 vendors

  • 1Kosmos
    MFA · checked 2026-11-05
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001, edition not stated
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP High (1Kosmos Platform within the HRTec FedHIVE authorization)
    Source
    PCI DSS
    Not documented
    ISO 27018
    Data residency: not documented
  • 1Password
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    SAQ A self-assessment and Attestation of Compliance
    Source
    Trust center says 1Password holds TX-RAMP Level 2 (valid through October 2028) rather than FedRAMP.
    ISO 27017ISO 27018ISO 27701CSA STARTISAX
    Data residency: US, CA, EU
  • 1Password Secrets Automation
    Secrets management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (1Password company-wide)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (1Password company-wide)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Secrets Automation runs on the 1Password platform, so these are 1Password's company-wide certifications.
    ISO 27017ISO 27018ISO 27701
    Data residency: US, CA, EU
  • Aembit
    AI identity · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Sensiba LLP, ANAB accredited)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The trust center lists SOC 2 without stating the report type.
    Data residency: not documented
  • Akamai Identity Cloud
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2, separate Identity Cloud report covering all five Trust Services Criteria
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Identity Cloud listed as applicable service)
    Source
    HIPAA BAA
    Yes
    Identity Cloud listed for HIPAA; standard BAA available on request
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    End of sale March 7, 2024; Akamai will decommission Identity Cloud on December 31, 2027.
    ISO 27017ISO 27018ISO 27701
    Data residency: US, EU, AU, SG, JP, CN
  • Akeyless
    Machine identity · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    Hosted in Second Front Systems Game Warden package (FedRAMP Certified, Class D), not a vendor-held authorization (vendor describes as FedRAMP Class D High)
    Source
    PCI DSS
    Yes
    PCI DSS compliance (vendor-stated)
    Source
    FIPS 140
    Data residency: not documented
  • Alloy
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2
    Source
    ISO 27001
    Yes
    ISO 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    GDPR DPA
    Data residency: not documented
  • Amazon Cognito
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 (AWS SOC 1, 2, 3 reports; Amazon Cognito in scope)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Amazon Cognito in scope)
    Source
    HIPAA BAA
    Yes
    HIPAA eligible service under the AWS BAA
    Source
    FedRAMP
    Yes
    FedRAMP High (Class D) in AWS GovCloud (US); Moderate (Class C) in US East/West
    Source
    PCI DSS
    Yes
    PCI DSS, AWS is a Level 1 service provider
    Source
    Per-service scope taken from AWS Services in Scope by Compliance Program pages; regions from the AWS General Reference endpoint list.
    ISO 27017ISO 27018ISO 27701CSA STARHITRUSTBSI C5IRAPISMAPENSGDPR DPA
    Data residency: US, CA, MX, BR, EU, DE, UK, CH, IL, AE, BH, ZA, IN, JP, KR, SG, AU, NZ, HK, ID, MY, TW, TH
  • Amazon Verified Permissions
    Authorization · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 (AWS SOC 1, 2, 3 reports; Amazon Verified Permissions in scope)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Amazon Verified Permissions in scope)
    Source
    HIPAA BAA
    Yes
    HIPAA eligible service under the AWS BAA
    Source
    FedRAMP
    Yes
    FedRAMP High (Class D) in AWS GovCloud (US); Moderate (Class C) in US East/West
    Source
    PCI DSS
    Yes
    PCI DSS, AWS is a Level 1 service provider
    Source
    Per-service scope taken from AWS Services in Scope by Compliance Program pages; regions from the AWS General Reference endpoint list.
    ISO 27017ISO 27018ISO 27701CSA STARHITRUSTBSI C5IRAPGDPR DPA
    Data residency: US, CA, MX, BR, EU, DE, UK, CH, IL, AE, BH, ZA, IN, JP, KR, SG, AU, NZ, HK, ID, MY, TW, TH
  • AppViewX
    PKI · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (KPMG, July 1, 2025 to June 30, 2026)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS v4.0.1
    Source
    Data residency: not documented
  • Astrix Security
    AI identity · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    No trust center found; Astrix is joining Cisco and ended standalone sales of new licenses on June 30, 2026, and its only SOC 2 statement is a July 2022 announcement.
    Data residency: not documented
  • AU10TIX
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO/IEC 27001
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    AU10TIX also lists TX-RAMP, NIST 800-63A and ISO/IEC 30107-3 PAD Levels 1 and 2.
    ISO 27701
    Data residency: not documented
  • Auth0
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II, all five Trust Services Criteria
    Source
    ISO 27001
    Yes
    ISO/IEC 27001 (edition not stated); certificate via Support Center
    Source
    HIPAA BAA
    Yes
    BAA on request; not available on Azure deployments
    Source
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI-compliant deployment models; AOC or SAQ-D on request (level not stated)
    Source
    Okta subsidiary; Okta's FedRAMP listings cover Okta IDaaS clouds, not Auth0.
    ISO 27017ISO 27018CSA STAR
    Data residency: US, EU, UK, AU, CA, JP
  • Authgear
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    An EU region for Authgear Cloud is announced as coming soon.
    GDPR DPA
    Data residency: not documented
  • Authsignal
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: US, AU, EU, CA, UK
  • AuthZed
    Authorization · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (annual report, AuthZed Cloud and Dedicated)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Dedicated runs in the customer's chosen cloud provider and regions; no fixed region list is published.
    Data residency: not documented
  • AWS IAM Identity Center
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 (AWS SOC 1, 2, 3 reports; AWS IAM Identity Center in scope)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (AWS IAM Identity Center in scope)
    Source
    HIPAA BAA
    Yes
    HIPAA eligible service under the AWS BAA
    Source
    FedRAMP
    Yes
    FedRAMP High (Class D) in AWS GovCloud (US); Moderate (Class C) in US East/West
    Source
    PCI DSS
    Yes
    PCI DSS, AWS is a Level 1 service provider
    Source
    Per-service scope taken from AWS Services in Scope by Compliance Program pages; regions from the AWS General Reference endpoint list.
    ISO 27017ISO 27018ISO 27701CSA STARHITRUSTBSI C5IRAPISMAPENSGDPR DPA
    Data residency: US, CA, MX, BR, EU, DE, UK, CH, IL, AE, BH, ZA, IN, JP, KR, SG, AU, NZ, HK, ID, MY, TW, TH
  • AWS Secrets Manager
    Secrets management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 (AWS SOC 1, 2, 3 reports; AWS Secrets Manager in scope)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (AWS Secrets Manager in scope)
    Source
    HIPAA BAA
    Yes
    HIPAA eligible service under the AWS BAA
    Source
    FedRAMP
    Yes
    FedRAMP High (Class D) in AWS GovCloud (US); Moderate (Class C) in US East/West
    Source
    PCI DSS
    Yes
    PCI DSS, AWS is a Level 1 service provider
    Source
    Per-service scope taken from AWS Services in Scope by Compliance Program pages; regions from the AWS General Reference endpoint list.
    ISO 27017ISO 27018ISO 27701CSA STARHITRUSTBSI C5IRAPISMAPENSGDPR DPA
    Data residency: US, CA, MX, BR, EU, DE, UK, CH, IL, AE, BH, ZA, IN, JP, KR, SG, AU, NZ, HK, ID, MY, TW, TH
  • Axiad
    MFA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Schellman)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001, edition not stated
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Moderate (Axiad Conductor)
    Source
    PCI DSS
    Not documented
    Data residency: not documented
  • Azure Key Vault
    Secrets management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (Azure report; Key Vault in audit scope)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Azure certificate; Key Vault in audit scope)
    Source
    HIPAA BAA
    Yes
    Covered by the HIPAA BAA in the Microsoft Product Terms
    Source
    FedRAMP
    Yes
    FedRAMP High in Azure (public) and Azure Government; DoD IL2 to IL5 in Azure Government
    Source
    PCI DSS
    Yes
    PCI DSS v4.0, Azure is a Level 1 service provider
    Source
    Key Vault and Managed HSM share one audit-scope entry in the Azure Compliance Offerings appendix.
    ISO 27017ISO 27018ISO 27701CSA STARHITRUSTBSI C5ENSGDPR DPA
    Data residency: US, CA, MX, BR, CL, EU, DE, FR, IT, ES, SE, NO, DK, PL, AT, BE, CH, UK, IL, QA, AE, ZA, IN, JP, KR, SG, HK, AU, NZ, ID, MY, TW, CN
  • Beyond Identity
    MFA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The compliance page lists FedRAMP and PCI DSS as requirements it helps customers meet, not as held authorizations.
    Data residency: not documented
  • BeyondTrust
    PAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 for specific cloud products (Entitle, Identity Security Insights, EPM Linux, Secure Remote Access on AWS; EPM Cloud and Password Safe Cloud on Azure)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (SoA includes ISO 27017 and 27018 controls)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class C (Rev5, Agency): BeyondTrust Identity Security For Government
    Source
    PCI DSS
    Not documented
    SOC 2 Type 2 coverage is product-specific rather than company-wide; a TX-RAMP certification is also listed.
    ISO 27701FIPS 140
    Data residency: not documented
  • Bitdefender Password Manager
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Bitdefender company-level)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Bitdefender company-level)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Certifications are listed for Bitdefender as a company; the Password Manager product is not named in scope.
    ISO 27017ISO 27018
    Data residency: not documented
  • Bitwarden
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (plus SOC 3)
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    In progress
    FedRAMP High (Class D), actively pursuing
    Source
    PCI DSS
    Not documented
    Bitwarden says it is HIPAA compliant with annual third-party audits but does not state that it signs a BAA.
    Data residency: US, EU
  • C1 (formerly ConductorOne)
    IGA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (2026 report)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Cato Networks
    Zero trust · checked 2026-11-05
    SOC 2 Type II
    Yes
    SOC 2 (type not stated in site footer)
    Source
    ISO 27001
    Yes
    ISO 27001
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    No public trust center found; certifications are listed in the catonetworks.com site footer only.
    Data residency: not documented
  • Cerbos
    Authorization · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (first report announced January 2024)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    GDPR DPA
    Data residency: not documented
  • cidaas
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Yes
    ISO 27001 (edition not stated), cidaas and its infrastructure partners
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: EU
  • CLEAR
    Identity verification · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    In progress
    FedRAMP In Process, Class C (Rev5, Agency): CLEAR1 Gov
    Source
    PCI DSS
    Not documented
    No public trust center or certification page found on clearme.com.
    Data residency: not documented
  • Clerk
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II since May 2022; report on Business plan and above
    Source
    ISO 27001
    No
    Clerk states it is not ISO 27001 certified
    Source
    HIPAA BAA
    Yes
    BAA on Enterprise plan
    Source
    FedRAMP
    Not documented
    PCI DSS
    No
    Not applicable; Clerk states it stores no cardholder data and makes no PCI DSS claim
    Source
    Clerk states it offers no regional data residency; data is hosted in the US.
    GDPR DPA
    Data residency: US
  • Cloudflare Zero Trust
    Zero trust · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Security, Confidentiality, Availability)
    Source
    ISO 27001
    Yes
    ISO 27001:2022
    Source
    HIPAA BAA
    Not documentedSource
    FedRAMP
    Yes
    FedRAMP Certified, Class D (Rev5, Agency): Cloudflare for Government; FedRAMP Certified, Class C (Rev5, Agency): Cloudflare for Government (vendor describes as FedRAMP High)
    Source
    PCI DSS
    Yes
    PCI DSS 4.0 AOC
    Source
    States HIPAA compliance but documents no BAA, so recorded as not documented.
    ISO 27017ISO 27018ISO 27701StateRAMP / GovRAMPCSA STARBSI C5IRAPISMAPENS
    Data residency: not documented
  • Clutch Security
    AI identity · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Corbado
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (security, availability, confidentiality)
    Source
    ISO 27001
    Yes
    ISO 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Shared cloud runs in AWS Frankfurt; dedicated instances can run in a customer-chosen AWS region.
    Data residency: DE
  • CrowdStrike Falcon Identity Protection
    ITDR · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (Falcon platform)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class D (Rev5, Agency): CrowdStrike Falcon Platform for Government; FedRAMP Certified, Class D (Rev5, Agency): CrowdStrike Falcon Platform IL5 SaaS (vendor describes as FedRAMP High)
    Source
    PCI DSS
    Yes
    PCI DSS v4 (Coalfire QSA report and AOC)
    Source
    Certifications are stated for the CrowdStrike Falcon platform, which hosts Falcon Identity Protection; a Coalfire HIPAA assessment is listed but no BAA is documented.
    ISO 42001CSA STARBSI C5IRAPENSTISAX
    Data residency: not documented
  • CyberArk Conjur Cloud / Secrets Hub
    Secrets management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (CyberArk company-wide; product scope not stated)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS v4.0.1 (level and product scope not stated)
    Source
    Now part of Palo Alto Networks (Idira); the trust center lists SOC 2 (PwC) without a report type, and FedRAMP High only for Endpoint Privilege Manager and Workforce Identity.
    ISO 27017ISO 27018ISO 42001
    Data residency: not documented
  • Cyera
    AI identity · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    Annual SOC 2 Type 2 audit
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documentedSource
    FedRAMP
    Yes
    FedRAMP Certified, Class D (Rev5, Agency): Cyera for Government (vendor describes as FedRAMP High)
    Source
    PCI DSS
    Yes
    PCI DSS
    Source
    States HIPAA compliance but documents no BAA, so recorded as not documented.
    ISO 27017ISO 27018ISO 42001BSI C5IRAPENS
    Data residency: not documented
  • Dashlane
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Encrypted data is hosted in AWS data centers in Ireland per Dashlane's security one-pager.
    Data residency: EU
  • Delinea
    PAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (plus SOC 1 Type 2)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    Hosted in UberEther IAM Advantage package (FedRAMP Certified, Class D), not a vendor-held authorization: Delinea Secret Server
    Source
    PCI DSS
    Yes
    PCI DSS v4.0.1
    Source
    The trust center does not map certifications to individual products.
    Data residency: not documented
  • Delinea DevOps Secrets Vault
    Secrets management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Delinea company-wide; DSV not named on trust center)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Delinea company-wide)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS v4.0.1 (level and product scope not stated)
    Source
    Trust center certifications are listed at company level without naming DevOps Secrets Vault.
    GDPR DPA
    Data residency: US, EU, AU
  • Descope
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated)
    Source
    HIPAA BAA
    Yes
    BAA on Growth plan and above
    Source
    FedRAMP
    Yes
    FedRAMP High via Palantir FedStart (PFCS-SS boundary, FedRAMP instance only)
    Source
    PCI DSS
    Yes
    PCI DSS SAQ-D AOC for service providers
    Source
    FedRAMP High is inherited from Palantir's PFCS-SS authorization (FR2315464863), not a separate Descope package.
    CSA STAR
    Data residency: US, EU, UK, CA, SG, AU, BR
  • Devolutions Hub
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Devolutions Cloud incl. Hub Business; 2024 report)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001 (edition not stated)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    ISO 27701
    Data residency: US, CA, FR, AU
  • Didit
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (July 2026 report, March 9 to July 1, 2026 period)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Didit also lists iBeta Level 1 (ISO 30107-3) liveness testing and offers in-country processing for enterprise customers without listing regions.
    ISO 27017ISO 27018GDPR DPA
    Data residency: not documented
  • DigiCert
    PKI · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (report under NDA)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 for CA and trust services (announced October 26, 2026; audit by MSECB)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    In progress
    Initial Implementation, class not yet listed (20x, Program): DigiCert for Government
    Source
    PCI DSS
    Not documented
    DigiCert also holds WebTrust for CAs, Baseline Requirements, EV and Code Signing, plus ETSI audits for qualified trust services.
    Data residency: not documented
  • Doppler
    Secrets management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Vanta trust center could not be read without JavaScript.
    GDPR DPA
    Data residency: not documented
  • Duo Security
    MFA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (Duo commercial)
    Source
    ISO 27001
    Yes
    ISO 27001, edition not stated (Duo commercial)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Moderate (Duo Federal); FedRAMP High via Cisco Security Cloud for Government package
    Source
    PCI DSS
    Yes
    PCI DSS self-assessment questionnaire (SAQ), Duo commercial
    Source
    Certifications taken from Cisco's Compliant Cloud Portfolio (last updated May 8, 2026) linked from the Cisco Trust Portal.
    ISO 27017ISO 27018CSA STARBSI C5ENSISMAPIRAPStateRAMP / GovRAMP
    Data residency: US, CA, EU, UK, AU, DE, IN, SG, JP
  • Entrust
    Workforce IAM · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Entrust's compliance pages returned HTTP 403 to automated checks, so no IDaaS certification could be confirmed.
    Data residency: not documented
  • Footprint
    Identity verification · checked 2026-11-05
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS
    Source
    No trust center page found; certifications appear in the site footer.
    Data residency: not documented
  • Frontegg
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated)
    Source
    HIPAA BAA
    Yes
    BAA on Enterprise plan
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    ISO 27701GDPR DPA
    Data residency: EU, US, AU, CA
  • FusionAuth
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated)
    Source
    HIPAA BAA
    Yes
    BAA offered to select customers
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Says it can be deployed in FedRAMP-compliant infrastructure, which is not a FedRAMP authorization.
    Data residency: not documented
  • GitGuardian
    Secrets management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (audited by Prescient Assurance)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Vanta trust center could not be read without JavaScript.
    Data residency: US, EU
  • GlobalSign
    PKI · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Yes
    ISO/IEC 27001 (GMO GlobalSign K.K. certificate covers CA and TrustLogin operations, ISO/IEC 27001:2022)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    As a public CA, GlobalSign publishes WebTrust audit reports and an eIDAS conformity certificate in its repository; no SOC 2 report is listed.
    ISO 27017ISO 27701
    Data residency: not documented
  • Google Cloud Identity Platform
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 (Google Cloud SOC 1, 2, 3 reports; service in scope)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (service in scope)
    Source
    HIPAA BAA
    Yes
    Covered under the Google Cloud BAA
    Source
    FedRAMP
    Yes
    FedRAMP High P-ATO and DoD IL2 (Google Cloud)
    Source
    PCI DSS
    Yes
    PCI DSS v4.0.1 (service in scope of Google Cloud QSA assessment)
    Source
    Google does not document a selectable data location for Identity Platform user data.
    ISO 27017ISO 27018ISO 27701CSA STARBSI C5IRAPISMAPGDPR DPA
    Data residency: not documented
  • Google Cloud Secret Manager
    Secrets management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 (Google Cloud SOC 1, 2, 3 reports; service in scope)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (service in scope)
    Source
    HIPAA BAA
    Yes
    Covered under the Google Cloud BAA
    Source
    FedRAMP
    Yes
    FedRAMP High P-ATO and DoD IL2 to IL5 (excludes global secrets)
    Source
    PCI DSS
    Yes
    PCI DSS v4.0.1 (service in scope of Google Cloud QSA assessment)
    Source
    Regional secrets keep data in the chosen location; FedRAMP scope excludes global secrets.
    ISO 27017ISO 27018ISO 27701CSA STARBSI C5IRAPISMAPGDPR DPA
    Data residency: US, CA, MX, BR, CL, EU, DE, FR, IT, ES, NL, BE, PL, FI, SE, CH, UK, IL, QA, SA, ZA, IN, JP, KR, SG, HK, TW, ID, TH, AU
  • Hanko Cloud
    Open source (managed) · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    In progress
    ISO 27001 in progress (edition not stated)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    GDPR DPA
    Data residency: DE
  • HashiCorp Boundary
    PAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 (available under NDA; type not stated on the page)
    Source
    ISO 27001
    Yes
    ISO 27001 (IBM Boundary and Boundary Self-Managed in scope)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS v4.0.1 Level 1 Service Provider (HCP Boundary)
    Source
    ISO 27017ISO 27018TISAX
    Data residency: not documented
  • HashiCorp Vault
    Machine identity · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 (available under NDA; type not stated on the page)
    Source
    ISO 27001
    Yes
    ISO 27001 (IBM Vault, Vault Self-Managed, other HashiCorp products)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS v4.0.1 Level 1 Service Provider (HCP Vault Dedicated, Vault Radar, Boundary)
    Source
    ISO 27017ISO 27018ENSTISAXFIPS 140
    Data residency: not documented
  • HYPR
    MFA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001, edition not stated (A-LIGN)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    ISO 27017ISO 27018CSA STARGDPR DPA
    Data residency: not documented
  • IBM Verify
    Workforce IAM · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Yes
    ISO 27001, edition not stated (Bureau Veritas certification badge)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Moderate (IBM Verify for Government, under the IBM Platform Services for Government package)
    Source
    PCI DSS
    Yes
    PCI DSS, level not stated
    Source
    IBM's Verify product page shows SOC 2 and HIPAA badges without stating the SOC 2 type or a BAA offer.
    Data residency: not documented
  • ID.me
    Identity verification · checked 2026-11-05
    SOC 2 Type II
    Yes
    Annual SOC 2 Type II audit
    Source
    ISO 27001
    Yes
    ISO 27001 certified
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class C (Rev5, Agency): ID.me Identity Gateway
    Source
    PCI DSS
    Not documented
    ID.me also holds Kantara NIST 800-63-3 IAL2/AAL2 approval (since 2018).
    Data residency: not documented
  • Idira (formerly CyberArk)
    PAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 (type not stated on the trust center) and SOC 3
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documentedSource
    FedRAMP
    Yes
    FedRAMP Certified, Class D (Rev5, Agency): Idira Identity Security Government Services Platform; FedRAMP Certified, Class D (Rev5, Agency): Idira Endpoint Privilege Manager for Government (vendor describes as FedRAMP High)
    Source
    PCI DSS
    Yes
    PCI DSS v4.0.1
    Source
    FedRAMP packages are now listed under Palo Alto Networks with Idira product names; the trust center does not map certifications to products; states HIPAA compliance but documents no BAA, so recorded as not documented.
    ISO 27017ISO 27018ISO 42001CSA STARCyber Essentials PlusIRAP
    Data residency: not documented
  • IDnow
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Yes
    ISO 27001:2022 (cert I-12353/25), all four IDnow group entities
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    IDnow is also a qualified trust service provider under eIDAS 2.0 and lists ISAE 3402 Type 2 for VideoIdent.
    TISAXGDPR DPA
    Data residency: EU
  • Illumio
    Zero trust · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class C (Rev5, Agency): Illumio Government Cloud
    Source
    PCI DSS
    Not documented
    A PCI DSS report is listed among trust center documents but not as a certification, so PCI is left unknown.
    ISO 27701ISO 42001FIPS 140
    Data residency: not documented
  • Incode
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documentedSource
    FedRAMP
    In progress
    Agency Authorization In Process, Class C (Rev5, Agency): Incode Platform (vendor trust center lists FedRAMP Moderate; marketplace shows Agency Authorization In Process)
    Source
    PCI DSS
    Not documented
    Incode also lists ISO/IEC 30107-3:2023 and a Kantara IAL2 trust mark; states HIPAA compliance but documents no BAA, so recorded as not documented.
    ISO 42001
    Data residency: not documented
  • Infisical
    Secrets management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Infisical Cloud)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Homepage says HIPAA compliant but does not state that a BAA is offered; Vanta trust center could not be read without JavaScript.
    Data residency: US, EU
  • Jumio
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2
    Source
    ISO 27001
    Yes
    ISO 27001
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS 4.0.1
    Source
    The trust center lists SOC 2 without stating the report type.
    Data residency: not documented
  • JumpCloud
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (open directory platform); report under NDA
    Source
    ISO 27001
    Yes
    ISO 27001, edition not stated (open directory platform)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    GDPR DPA
    Data residency: US, EU, IN
  • Keeper Security
    PAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2
    Source
    ISO 27001
    Yes
    ISO 27001
    Source
    HIPAA BAA
    Not documentedSource
    FedRAMP
    Yes
    FedRAMP Certified, Class D (Rev5, Agency): Keeper ICAM & Identity Security Platform for Government (vendor describes as FedRAMP High)
    Source
    PCI DSS
    Yes
    PCI DSS Level 1
    Source
    Keeper also runs a separate US Government Cloud region; states HIPAA compliance but documents no BAA, so recorded as not documented.
    ISO 27017ISO 27018StateRAMP / GovRAMPFIPS 140
    Data residency: US, EU, AU, JP, CA
  • Keyfactor
    PKI · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (EJBCA SaaS and PKIaaS) and SOC 3
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (2026 annual certificate)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class C (Rev5, Agency): Keyfactor for Government
    Source
    PCI DSS
    Not documented
    Keyfactor also lists CMMC and Common Criteria.
    ISO 42001
    Data residency: not documented
  • Keytos
    MFA · checked 2026-11-05
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001, edition not stated
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Reports are available to customers from the Trust Center page inside the product portal.
    Data residency: AU, EU
  • Kinde
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (attested by AssuranceLab)
    Source
    ISO 27001
    Yes
    ISO 27001:2022 (certified by Compass Assurance Services)
    Source
    HIPAA BAA
    Yes
    BAA on request
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: AU, US, CA, EU, UK
  • LastPass
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (plus SOC 3)
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    ISO 27701BSI C5IRAP
    Data residency: not documented
  • LexisNexis Risk Solutions
    Identity verification · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    In progress
    FedRAMP In Process, Class C (Rev5, Agency): LexisNexis Risk Enterprise Platform
    Source
    PCI DSS
    Not documented
    No public certification list found on risk.lexisnexis.com.
    Data residency: not documented
  • LoginRadius
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (audited by A-LIGN)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (certified by BSI)
    Source
    HIPAA BAA
    Yes
    BAA offered (plan terms not stated)
    Source
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS compliant (level and role not stated)
    Source
    ISO 27017ISO 27018
    Data residency: US, CA, BR, CL, ZA, UK, EU, IE, BE, NL, FR, DE, CH, PL, SE, FI, ES, IT, BH, AE, QA, SA, IL, HK, TW, IN, SG, ID, JP, KR, AU
  • Logto Cloud
    Open source (managed) · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Logto Cloud)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Yes
    BAA on Enterprise plan
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Trust center returned HTTP 429 during checks.
    Data residency: EU, US, AU, JP
  • Lumos
    IGA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (plus SOC 1 Type II)
    Source
    ISO 27001
    Yes
    ISO 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    GDPR DPA
    Data residency: not documented
  • Microsoft Defender for Identity
    ITDR · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    In scope of the Azure SOC 2 Type 2 attestation report
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    Listed as Azure Advanced Threat Protection (the former name of Defender for Identity) inside Microsoft Azure Government (FedRAMP Certified, Class D, Rev5, JAB)
    Source
    PCI DSS
    Not documented
    Microsoft publishes certifications per cloud and lists in-scope services; Defender for Identity is not named on the ISO 27001 or PCI DSS offering pages.
    Data residency: not documented
  • Microsoft Entra External ID
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP High and DoD IL2 in Azure public cloud (Entra ID authorization applies to External ID)
    Source
    PCI DSS
    Not documented
    External ID is not named separately in the Azure audit-scope appendix (Entra ID and Azure AD B2C are), so only FedRAMP is confirmed.
    GDPR DPA
    Data residency: US, EU, APAC, AU, JP
  • Microsoft Entra ID
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (Azure report; Microsoft Entra ID (Free and Premium P1 + P2) in audit scope)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Azure certificate; Microsoft Entra ID (Free and Premium P1 + P2) in audit scope)
    Source
    HIPAA BAA
    Yes
    Covered by the HIPAA BAA in the Microsoft Product Terms
    Source
    FedRAMP
    Yes
    FedRAMP High in Azure (public) and Azure Government; DoD IL2 to IL5 in Azure Government
    Source
    PCI DSS
    Yes
    PCI DSS v4.0, Azure is a Level 1 service provider
    Source
    Tenant data stays in the geo chosen at creation (North America, EMEA, Asia/Pacific, Australia, Japan); APAC is the Asia/Pacific geo.
    ISO 27017ISO 27018ISO 27701CSA STARHITRUSTBSI C5ENSGDPR DPA
    Data residency: US, EU, APAC, AU, JP
  • Middesk
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The trust center did not render for automated checks; the SOC 2 claim comes from the Middesk homepage.
    Data residency: not documented
  • miniOrange
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Yes
    ISO/IEC 27001, edition not stated (certification badge)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The SOC 2 report miniOrange links to is AWS's, not its own.
    Data residency: US, EU, AU
  • MojoAuth
    CIAM · checked 2026-11-05
    SOC 2 Type II
    Yes
    SOC 2 Type II (listed on vendor HIPAA page; no public report)
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated; listed on vendor HIPAA page)
    Source
    HIPAA BAA
    Yes
    BAA on Enterprise plan
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Also lists an Asia-Pacific residency option without naming a country.
    Data residency: US, EU
  • Netskope
    Zero trust · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 report (type not stated on page)
    Source
    ISO 27001
    Yes
    ISO 27001
    Source
    HIPAA BAA
    Not documentedSource
    FedRAMP
    Yes
    FedRAMP Certified, Class D (Rev5, Agency): Netskope NewEdge Government.
    Source
    PCI DSS
    Not documented
    States HIPAA compliance but documents no BAA, so recorded as not documented.
    CSA STARBSI C5IRAP
    Data residency: not documented
  • Nevis
    CIAM · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Nevis Security AG; secure software development and SaaS product operation and support; valid to 2027-11-17)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Nok Nok Labs
    MFA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Acquired by OneSpan in June 2025; OneSpan's certification list does not name the Nok Nok product.
    Data residency: not documented
  • NordPass
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    NordPass's site and trust center could not be read by our checker on 2026-11-05, so its stated certifications await manual verification.
    Data residency: not documented
  • Oasis Security
    AI identity · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Okta
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Workforce Identity, Customer Identity and Auth0 platforms)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Yes
    BAA available for core identity cloud services
    Source
    FedRAMP
    Yes
    FedRAMP Moderate (Okta for Government Moderate) and FedRAMP High (Okta for Government High only)
    Source
    PCI DSS
    Yes
    PCI DSS v4.0 ROC; core IDaaS in scope as a supporting service provider
    Source
    FedRAMP Marketplace lists Okta IDaaS Regulated Cloud (Moderate) and Okta IDaaS Government High Cloud (High).
    ISO 27017ISO 27018CSA STARBSI C5IRAPStateRAMP / GovRAMPENSTISAXGDPR DPA
    Data residency: US, EU, JP, AU, CA, IN
  • Omada
    IGA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (bridge letter to September 30, 2026) and public SOC 3
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (certificate downloadable)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • OneLogin
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The One Identity trust center is JavaScript-rendered and gated, so no certification could be confirmed from a public first-party page.
    Data residency: not documented
  • OneSpan
    MFA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Digital Agreements and Cybersecurity SaaS)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (MSECB, valid to 2028-08-19)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Moderate (OneSpan Sign only)
    Source
    PCI DSS
    Not documented
    HIPAA is listed for Digital Agreements without a stated BAA; Canada and Australia hosting apply to OneSpan Sign only.
    ISO 27017ISO 27018FIPS 140
    Data residency: US, EU, CA, AU
  • Oracle OCI IAM (identity domains)
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP High (Oracle US Government Cloud regions; IAM with identity domains offered there)
    Source
    PCI DSS
    Not documented
    Oracle lists OCI attestations at line-of-business level only; per-service scope sits in the OCI Console Compliance Documents service.
    Data residency: US, CA, MX, BR, CL, CO, EU, DE, FR, IT, NL, ES, SE, CH, RS, UK, IL, SA, AE, ZA, MA, IN, JP, KR, SG, ID, AU
  • Orca Security
    CIEM · checked 2026-11-05
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO/IEC 27001
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class C (Rev5, Agency): Orca Cloud Security Platform
    Source
    PCI DSS
    Yes
    PCI SAQ-D (self-assessment)
    Source
    Badges are in the orca.security site footer; no standalone trust center page was found.
    ISO 27017ISO 27018ISO 27701CSA STARIRAP
    Data residency: not documented
  • Ory Network
    Open source (managed) · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Ory Network)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Ory Network)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS v4.0.1 SAQ D for Service Providers (Ory Network)
    Source
    GDPR DPA
    Data residency: EU, US
  • Oso
    Authorization · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Oso says it is SOC 2 certified without stating the report type; Oso was acquired by Tiny in October 2026.
    GDPR DPA
    Data residency: not documented
  • P0 Security
    AI identity · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Advantage Partners)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Palo Alto Prisma Access
    Zero trust · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    Prisma Access operations team and service are SOC 2 certified (vendor FAQ; type not stated)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class D (Rev5, Program): GCS-HIGH; FedRAMP Certified, Class C (Rev5, Agency): Palo Alto Networks Government Cloud Services
    Source
    PCI DSS
    Not documented
    The Palo Alto Networks certifications page lists ISO, PCI DSS, C5, IRAP, ISMAP, ENS High and others company-wide without mapping them to Prisma Access.
    Data residency: not documented
  • Passbolt
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Passbolt Cloud runs on ISO 27001 certified hosting (GCP Europe, or Luxembourg for Sovereign Cloud), but Passbolt does not state its own ISO 27001 certificate.
    Data residency: EU
  • Permit.io
    Authorization · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (latest renewal January 2026)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Yes
    BAA available where applicable
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Persona
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (2026 report, combined with HIPAA)
    Source
    ISO 27001
    Yes
    ISO 27001
    Source
    HIPAA BAA
    Not documentedSource
    FedRAMP
    Yes
    FedRAMP Certified, Class C (20x Pilot, Program): Persona for Government
    Source
    PCI DSS
    Yes
    PCI DSS certified
    Source
    Persona also lists Kantara IAL2, iBeta and KJM certifications and offers customer-chosen data residency without listing regions on the trust center; states HIPAA compliance but documents no BAA, so recorded as not documented.
    Data residency: not documented
  • Ping Identity
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II; separate Ping and ForgeRock reports under NDA
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022, all products and cloud services
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP High (Ping Government Identity Cloud via UberEther IAM Advantage only)
    Source
    PCI DSS
    Not documented
    Ping says its products meet HIPAA requirements but its security page does not mention signing a BAA.
    ISO 27017ISO 27018CSA STARTISAX
    Data residency: US, CA, EU, AU, SG
  • Plaid Identity Verification
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    Annual SOC 2 Type II report (stated December 2021)
    Source
    ISO 27001
    Yes
    ISO 27001 (announced December 2021)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Plaid publishes no current public certification list; the only vendor statement found is a December 2021 announcement, and audit materials sit in a gated security portal.
    ISO 27701
    Data residency: not documented
  • PlainID
    Authorization · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    PlainID announced ISO 27001 and SOC 2 in a January 2021 release, but no current certificate or report type is published.
    GDPR DPA
    Data residency: not documented
  • PropelAuth
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    GDPR DPA
    Data residency: not documented
  • Proton Pass
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Proton company-wide)
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated; Proton company-wide)
    Source
    HIPAA BAA
    Yes
    BAA available to any Proton user on request
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Certifications are stated for Proton as a whole; Proton Pass is not named separately in scope.
    Data residency: not documented
  • Prove
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Prove links a Vanta trust center that did not render for automated checks, and its public pages name no certification, only annual third-party audits.
    Data residency: not documented
  • Psono
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Yes
    ISO 27001 (edition not stated)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Psono offers SaaS alongside self-hosting, but its SaaS hosting region is not documented publicly.
    Data residency: not documented
  • Push Security
    ITDR · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Linford & Co)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001 (ISOQAR cert 26983ISMS001)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Production data is stored in AWS eu-west-1 (Dublin) with backups in eu-west-3 (Paris); Push holds Cyber Essentials (not Plus).
    ISO 27701GDPR DPA
    Data residency: EU
  • RoboForm
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Publishes a Secfault Security penetration test summary but no compliance certifications.
    Data residency: not documented
  • RSA
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (security, availability, confidentiality); not applicable to FedRAMP environments
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Moderate (RSA ID Plus for Government only)
    Source
    PCI DSS
    Not documented
    CSA STARFIPS 140
    Data residency: not documented
  • SailPoint
    IGA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (plus SOC 1 Type 2 and SOC 3)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class C (Rev5, Agency): SailPoint Identity Security Cloud
    Source
    PCI DSS
    Not documented
    ISO 27017ISO 27018ISO 27701StateRAMP / GovRAMPCSA STARBSI C5IRAP
    Data residency: not documented
  • Salesforce Identity
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Salesforce Services incl. Lightning Platform and Experience Cloud)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Salesforce Services)
    Source
    HIPAA BAA
    Yes
    BAA on request; Lightning Platform and Experience Cloud are HIPAA Covered Services
    Source
    FedRAMP
    Yes
    FedRAMP High (Government Cloud Plus only)
    Source
    PCI DSS
    Yes
    Level 1 AoC for Salesforce Services (PAN must use Platform or Classic Encryption)
    Source
    Salesforce Identity runs on Lightning Platform and Experience Cloud, so these records reflect the Salesforce Services scope that covers them.
    ISO 27017ISO 27018HITRUSTBSI C5ISMAPENS
    Data residency: not documented
  • SAP Customer Data Cloud
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (SAP Customer Data Solutions: CDC and CDP; period Apr 2024 to Mar 2025)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Latest SOC 2 page found covers a period ending March 2025; SAP's compliance finder blocked automated reads, so other certificates were not confirmed.
    Data residency: US, EU, AU
  • Saviynt
    IGA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (2025 audit) and SOC 1 Type II
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class D (Rev5, Agency): Saviynt High Security Identity Platform; FedRAMP Certified, Class C (Rev5, Agency): Saviynt Enterprise Identity Cloud (EIC)
    Source
    PCI DSS
    Yes
    PCI DSS v4.0 AOC (2024) for Saviynt EIC; Saviynt does not process cardholder data
    Source
    Saviynt says the platform offers data residency in 25+ regions but does not list them publicly.
    ISO 27017Cyber Essentials PlusIRAPFIPS 140
    Data residency: not documented
  • Scalekit
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated)
    Source
    HIPAA BAA
    Yes
    BAA offered
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Dedicated clusters in Frankfurt (EU) and Los Angeles (NA).
    Data residency: EU, US
  • Secret Double Octopus
    MFA · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The DPA says SDO runs its ISMS in line with ISO 27001 but does not claim certification.
    GDPR DPA
    Data residency: not documented
  • Sectigo
    PKI · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The ISO/IEC 27001:2022 certificate Sectigo publishes (MSECB CERT-001083) was valid until 2026-10-09 and no renewed certificate was posted at check time, so ISO 27001 is recorded as unknown.
    Data residency: not documented
  • SecureAuth
    Workforce IAM · checked 2026-11-05
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO 27001, edition not stated
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Semperis
    ITDR · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    No trust center or certification page found on semperis.com.
    Data residency: not documented
  • SGNL
    Authorization · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Acquired by CrowdStrike in February 2026; sgnl.ai now redirects to CrowdStrike and no SGNL-specific certification scope is published.
    Data residency: not documented
  • Silverfort
    ITDR · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The trust center lists a SOC 2 report without stating its type.
    Data residency: not documented
  • Smallstep
    PKI · checked 2026-11-05
    SOC 2 Type II
    Yes
    SOC 2 for SaaS and Hybrid (Step CA Pro) deployments; type not stated on this page
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The Run Anywhere self-hosted model lists an optional FedRAMP configuration, which is not a FedRAMP authorization.
    FIPS 140
    Data residency: not documented
  • Socure
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class C (Rev5, Agency): Socure for Government (SocureGov)
    Source
    PCI DSS
    Not documented
    ISO 27017ISO 27018ISO 27701StateRAMP / GovRAMP
    Data residency: not documented
  • SSOJet
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Yes
    BAA on Enterprise plan
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Says SOC 2 compliant without a report type and ISO 27001 aligned, not certified; residency is Enterprise only.
    GDPR DPA
    Data residency: US, EU, IE, DE, NL, SG
  • Stack Auth (now Hexclave)
    Open source (managed) · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Stack Auth now operates as Hexclave and publishes no compliance certifications or trust center.
    Data residency: not documented
  • Sticky Password
    Password management · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Security white paper says the cloud back end runs on Amazon AWS; no compliance certifications are published.
    Data residency: not documented
  • Stripe Identity
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 1 and SOC 2 Type II (annual, on request)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI Service Provider Level 1
    Source
    Certifications are stated for Stripe as a whole, not Identity specifically.
    Data residency: not documented
  • Strivacity
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II, annual audit by Schellman
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Yes
    BAA offered to customers storing PHI
    Source
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS SAQ-D AOC for service providers, annual, Schellman
    Source
    Docs say data can reside in any AWS region, plus Alibaba Cloud Shanghai for China, without a country list in text.
    Data residency: not documented
  • Stytch
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II; Stytch report in Twilio Trust Center
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated); Stytch certificate in Twilio Trust Center
    Source
    HIPAA BAA
    Yes
    BAA on Enterprise plan
    Source
    FedRAMP
    Not documented
    PCI DSS
    Yes
    Stytch PCI DSS document in Twilio Trust Center (level not stated)
    Source
    Acquired by Twilio in November 2025; Stytch compliance documents sit in the Twilio Trust Center.
    GDPR DPA
    Data residency: US
  • Sumsub
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (plus SOC 1 Type 1)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS certificate and AoC
    Source
    Sumsub also lists ETSI 119/319 eIDAS conformity, iBeta Levels 1 to 3 and ISO/IEC 29115 and 29003.
    ISO 27017ISO 27018
    Data residency: not documented
  • Supabase Auth (Supabase platform)
    Open source (managed) · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Supabase platform)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (Supabase platform)
    Source
    HIPAA BAA
    Yes
    BAA on Team and Enterprise plans
    Source
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS listed on trust center (level and role not stated)
    Source
    GDPR DPA
    Data residency: US, CA, EU, UK, CH, IN, SG, JP, KR, AU, BR
  • SuperTokens
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documentedSource
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Pricing page lists SOC 2 compliance for the managed service without naming the report type, and the Vanta trust center lists controls only.
    Data residency: not documented
  • Tailscale
    Zero trust · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Security, Availability, Confidentiality)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    No
    Tailscale states no services are in scope for HIPAA because it stores only metadata
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Teleport
    PAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (2026 report, includes HIPAA)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documentedSource
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS 4.0
    Source
    The Teleport Beams product has its own SOC 2 Type II report (June to August 2026 period); states HIPAA compliance but documents no BAA, so recorded as not documented.
    ISO 27701
    Data residency: not documented
  • Tenable Identity Exposure
    ITDR · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 report for the Tenable cloud platform (type not stated; on request under MNDA)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2013 (corporate ISMS functions)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Yes
    FedRAMP Certified, Class C (Rev5, Agency): Tenable Government Solutions
    Source
    PCI DSS
    Not documented
    Tenable certifications are platform-wide; Tenable does not say whether Identity Exposure is in each scope, and the FedRAMP listing covers Tenable Government Solutions rather than Identity Exposure.
    StateRAMP / GovRAMPCSA STAR
    Data residency: not documented
  • Thales SafeNet Trusted Access
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (OneWelcome, SafeNet Trusted Access, IdCloud)
    Source
    ISO 27001
    Yes
    ISO 27001, edition not stated (OneWelcome, SafeNet Trusted Access, IdCloud)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    CSA STAR
    Data residency: not documented
  • Token Security
    AI identity · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Transmit Security
    CIAM · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    No public trust center or certification page found; the website blocks automated requests.
    GDPR DPA
    Data residency: US, EU, CA, AU, JP
  • Trulioo
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2
    Source
    ISO 27001
    Yes
    ISO 27001 (certified since 2015)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Trusona
    MFA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Trust center says SOC 2 Type II is on the roadmap for Q2/Q3 2026.
    SOC 2 Type I
    Data residency: not documented
  • Twilio Verify
    MFA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (Twilio platform; Twilio notes credentials do not apply to every product)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001 (Twilio; edition not stated in trust center)
    Source
    HIPAA BAA
    Yes
    BAA on Security Edition or Enterprise Edition; Verify and Verify Push are HIPAA eligible
    Source
    FedRAMP
    Not documented
    PCI DSS
    Yes
    PCI DSS v4.0.1 AOC; Level 1 listed (product coverage not stated)
    Source
    Certifications are held at the Twilio platform level; Twilio states they do not apply to every product.
    ISO 27017ISO 27018GDPR DPA
    Data residency: not documented
  • Twingate
    Zero trust · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (annual audit)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The trust center requires a request to access; Twingate says it is hosted in multiple Google Cloud Platform data centers but does not list customer-selectable regions.
    Data residency: not documented
  • Uniqkey
    Password management · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Uniqkey says its data centre is ISO 27001 certified, which is a hosting certification rather than one held by Uniqkey.
    Data residency: EU
  • Userfront
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2, all five Trust Services Criteria (Ernst & Young)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Data residency: not documented
  • Venafi (now Palo Alto Networks)
    Machine identity · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    The Certificate Manager (formerly Venafi TLS Protect) product page names no certifications, and the Palo Alto Networks certifications page does not map certifications to it.
    Data residency: not documented
  • Veridium
    MFA · checked 2026-11-05
    SOC 2 Type II
    Not documented
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    No public trust center or certification statement found on veridiumid.com.
    Data residency: not documented
  • Veriff
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Veriff also lists UK Cyber Essentials, ISO/IEC 30107-3 Level 1 and 2 liveness testing and UKDIATF certification.
    ISO 27017ISO 27018
    Data residency: not documented
  • Warrant (now WorkOS FGA)
    Authorization · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (WorkOS)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Yes
    BAA on enterprise plans (WorkOS)
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Warrant was acquired by WorkOS in 2024 and now runs as WorkOS FGA; certifications are WorkOS's.
    GDPR DPA
    Data residency: not documented
  • Wiz
    CIEM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II + HIPAA report
    Source
    ISO 27001
    Yes
    ISO 27001
    Source
    HIPAA BAA
    Not documentedSource
    FedRAMP
    Yes
    FedRAMP Certified, Class D (Rev5, Agency): Wiz for U.S. Government
    Source
    PCI DSS
    Yes
    PCI DSS v4.0.1 AOC and ROC
    Source
    States HIPAA compliance but documents no BAA, so recorded as not documented.
    ISO 27017ISO 27018ISO 27701IRAP
    Data residency: not documented
  • WorkOS
    CIAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Yes
    BAA on enterprise plans
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Vanta-hosted trust center is JavaScript-rendered; facts taken from workos.com/security.
    Data residency: not documented
  • WSO2
    Workforce IAM · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (Identity Platform SaaS, the Asgardeo service)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001:2022 (WSO2 Digital Operations function, not product-specific)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    WSO2's PCI DSS and HIPAA BAA scopes list its developer, integration and API cloud products, not Identity Platform SaaS.
    Data residency: US, EU
  • Yoti
    Identity verification · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (annual)
    Source
    ISO 27001
    Yes
    ISO 27001 (ID verification services)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Yoti says it runs two UK data centres (Equinix and Telehouse).
    Data residency: UK
  • Yubico
    MFA · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (YubiEnterprise Delivery and Subscription; Schellman)
    Source
    ISO 27001
    Not documented
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    FIPS 140
    Data residency: not documented
  • ZITADEL Cloud
    Open source (managed) · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (ZITADEL Cloud)
    Source
    ISO 27001
    Yes
    ISO 27001 (edition not stated)
    Source
    HIPAA BAA
    Not documented
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Lists HIPAA among its certifications but does not state that a BAA is offered; Vanta trust center could not be read.
    GDPR DPA
    Data residency: CH, EU
  • Zoho Vault
    Password management · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type II (all Zoho cloud services)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001 (edition not stated; all Zoho cloud services)
    Source
    HIPAA BAA
    Yes
    BAA template on request via legal@zohocorp.com
    Source
    FedRAMP
    Not documented
    PCI DSS
    Not documented
    Zoho lists account data centers in many countries, but Vault-specific hosting regions are not stated.
    ISO 27017ISO 27018ISO 27701
    Data residency: not documented
  • Zscaler
    Zero trust · checked 2026-11-05 · trust center
    SOC 2 Type II
    Yes
    SOC 2 Type 2 (plus SOC 3)
    Source
    ISO 27001
    Yes
    ISO/IEC 27001
    Source
    HIPAA BAA
    Not documentedSource
    FedRAMP
    Yes
    FedRAMP Certified, Class D (Rev5, JAB): Zscaler Internet Access - Government (Secure Web Gateway - vTIC) - High; FedRAMP Certified, Class D (Rev5, JAB): Zscaler Private Access - Government (Zero Trust Networking - VPN Replacement); FedRAMP Certified, Class C (Rev5, Agency): Zscaler Internet Access - Government (Secure Web Gateway - vTIC); FedRAMP Certified, Class C (Rev5, Agency): Zscaler Private Access - Government (Zero Trust Exchange - VPN Replacement)
    Source
    PCI DSS
    Yes
    PCI DSS
    Source
    States HIPAA compliance but documents no BAA, so recorded as not documented.
    ISO 27017ISO 27018ISO 27701HITRUSTCSA STARBSI C5Cyber Essentials PlusIRAPISMAPENSTISAXFIPS 140
    Data residency: not documented

How to read it

Yes means the vendor's own trust center, docs or certificate, or an official registry, says it holds the certification; the line under it gives the scope. Not documented means we could not find it on a public page, which is not the same as "no". No appears only when the vendor says so.

A badge is not a report. Ask for the SOC 2 Type II report and ISO certificate under NDA and check the audit period, the edition and which products are in scope. Download the data as CSV or JSON.

Related

About the directory

Which CIAM platforms are SOC 2 Type II, ISO 27001 and HIPAA compliant?
Of the 28 CIAM platforms in this directory, 13 document all three (a SOC 2 Type II report, ISO 27001 certification and a signed HIPAA Business Associate Agreement) on their own trust center, docs or an official registry, checked 2026-11-05: Akamai Identity Cloud, Amazon Cognito, Auth0, Descope, Frontegg, FusionAuth, Google Cloud Identity Platform, Kinde, LoginRadius, MojoAuth, Salesforce Identity, Scalekit and Stytch. Check the scope column: some BAAs are only on an Enterprise plan, and many vendors do not name the ISO 27001 edition.
Which identity vendors will sign a HIPAA BAA?
31 of 155 vendors (20%) document that they sign a Business Associate Agreement, including 17 of 28 CIAM platforms. A vendor that says it is "HIPAA compliant" without offering a BAA is recorded as not documented, because a covered entity cannot send protected health information to a business associate without one. Filter by "HIPAA BAA" above for the list and the plan each BAA needs.
Which identity providers are FedRAMP authorized?
42 of 155 vendors (27%) have a FedRAMP authorization documented on their own site or the FedRAMP Marketplace, and 29 of those scopes name a government or federal edition or region (for example Okta for Government, RSA ID Plus for Government and Duo Federal) rather than the commercial service. Some vendors reach FedRAMP through a partner's package rather than their own. The Marketplace now lists Certification Classes A to D, which FedRAMP says are not one-for-one replacements for Low, Moderate and High, so check the class, the edition and whether it is the tenant you will use. Filter by FedRAMP above for the list.
Which cloud identity services are PCI DSS Level 1 service providers?
43 vendors document a PCI DSS attestation, but only 12 state Level 1 service provider status in their own scope: Amazon Cognito, Amazon Verified Permissions, AWS IAM Identity Center, AWS Secrets Manager, Azure Key Vault, HashiCorp Boundary, HashiCorp Vault, Keeper Security, Microsoft Entra ID, Salesforce Identity, Stripe Identity and Twilio Verify. Others attest through a self-assessment questionnaire (SAQ) or do not state a level. FAPI is a different thing: it is an OpenID Foundation security profile with a conformance test, not a compliance audit, so it is not tracked here.
How many identity vendors have SOC 2 Type II?
118 of 155 (76%) document a SOC 2 Type II report. 21 vendors (14%) document none of the five core certifications (SOC 2 Type II, ISO 27001, HIPAA BAA, FedRAMP, PCI DSS) on a page we could read. Ask those vendors for their reports directly before relying on them.
How is this directory sourced and can I reuse it?
Every "Yes" links to the vendor's own trust center, documentation, certificate or an official registry such as the FedRAMP Marketplace or the CSA STAR registry, checked on the date shown. "Not documented" means we could not find it, not that the vendor lacks it, and "No" appears only when the vendor says so. The data is CC BY 4.0: download the CSV or JSON, cite the page and link back. Send corrections with a public link through the contact page.