Who holds which certification
SOC, ISO, FedRAMP, HIPAA and more for 64 cloud, data and AI vendors. Every square links to its evidence.
Squares run SOC, ISO, AI governance, US government, Health, Payments, Privacy, Cloud security, Regional. Tap a vendor for names.
From public trust centers and registries on the date shown. Confirm scope with the vendor. Logos via logo.dev; trademarks belong to their owners.
Latest changes
All changesRemovedGoogle CloudFedRAMPGoogle Cloud VMware Engine (GCVE)
UpgradedCloudflareFedRAMP HighCloudflare for Government - High
AddedAsanaFedRAMP ModerateAsana
AddedIBMFedRAMP ModerateGO.gov
RemovedSplunkFedRAMPSplunk Observability Cloud for FedRAMP Moderate
AddedStripeData Privacy FrameworkCovered entity of Stripe, LLC
RemovedPalantirFedRAMPPalantir Federal Cloud Service – Moderate
RemovedDatadogFedRAMPDatadog for Government
AddedGitLabData Privacy FrameworkGitLab
Questions
What is Attested?
Attested is a grid of which certifications and attestations data, AI, cloud and developer-tool vendors hold: SOC 1, 2 and 3, ISO 27001, 27017, 27018, 27701 and 42001, HIPAA, HITRUST, PCI DSS, FedRAMP, DoD Impact Levels, GovRAMP, CJIS, the Data Privacy Framework, CSA STAR, IRAP, C5, ISMAP and TISAX. Every cell links to the evidence and the date it was captured.
Where does the data come from?
From public registries where they exist (the FedRAMP Marketplace data, the CSA STAR Registry and the Data Privacy Framework List) and otherwise from each vendor's own compliance or trust-center page. Registry entries are authoritative; vendor-page entries record the sentence the vendor published.
How often is it updated?
A run every Wednesday at 10:00 UTC re-reads the FedRAMP data and status history, the STAR Registry, the DPF List and a rotating set of vendor pages. What changed goes into the change log with its date.
Which AI vendors are FedRAMP authorized?
Filter the grid by FedRAMP: OpenAI (ChatGPT Enterprise and API Platform, FedRAMP 20x Moderate), Perplexity (20x Low), Scale AI and Palantir (High), and Google's Gemini for Government (20x Low) are listed in the FedRAMP Marketplace. Claude reaches federal agencies through AWS GovCloud and Google Cloud authorizations.
Which companies are ISO 42001 certified?
Open the ISO/IEC 42001 page: it lists every tracked vendor that names the AI management system certification on its compliance page or in the CSA STAR Registry, including Microsoft, AWS, Google Cloud, Anthropic, OpenAI, Snowflake and Workday.
Is HIPAA a certification?
No. There is no HIPAA certificate. The HIPAA column records whether a vendor says it supports HIPAA-regulated data and signs a Business Associate Agreement, and for which products; confirm the BAA scope with the vendor.
Does a SOC 2 listing mean I can see the report?
No. SOC 1 and SOC 2 reports are shared under NDA through the vendor's trust center. SOC 3 is the public summary. Attested records that the vendor states it has the report, with a link to where to request it.