AI vendors with CSA STAR certification

AI vendors listed in the Cloud Security Alliance STAR Registry, a free public registry of cloud-vendor security attestations based on the Cloud Controls Matrix.

The Cloud Security Alliance (CSA) STAR Registry is a public registry of cloud-vendor security assessments based on the CSA Cloud Controls Matrix (CCM). Three levels: Level 1 Self-Assessment (publicly self-attested CAIQ questionnaire), Level 2 Third-Party Assessment (independent audit, equivalent to SOC 2 or ISO 27001), and Level 3 Continuous Auditing (in development). STAR is widely respected in cloud security circles and complements rather than replaces SOC 2 / ISO 27001.

Vendors with CSA STAR

Buyer checklist

• Verify the vendor's STAR registry listing directly — anyone can self-assert, the registry shows what level they're at.
• For Level 1, the CAIQ questionnaire response is a starting point for diligence — not a substitute for it.
• For Level 2, confirm which attestation backed the registration (CSA STAR Attestation vs Certification).
• Cross-reference the CCM control coverage with your specific risk concerns.
• STAR is most useful in cloud-native procurement; less relevant for traditional on-prem AI deployments.