Compliance Assurance and Cloud Attestation
Register market (cloud-security attestation registers; attested providers counted, levels as per-edge signals). The Kin Score Market layer reads each provider in its market: who it integrates with, how deep those integrations go, and where the market publishes its own structure. Methodology.
Where this market publishes its structure
- CSA STAR Registry (cloudsecurityalliance.org/star/registry, server-rendered org + service pages) machine-readable, 2,843 organisations, 3,486 services; 573 providers linked by filed domain; 76 domain holders failed the name check (review); 97 Level-2 product entries (28 lapsed)
- EU Cloud Code of Conduct public register (eucoc.cloud list of adherent services) machine-readable, 36 adherent services; 16 linked; 4 name-failed (Cisco/Webex, Epignosis, Microsoft/Azure, Huawei/Sparkoo)
- PCI SSC listings (listings.pcisecuritystandards.org) not machine-readable: every list sits behind a click-through List Access Agreement; not accepted on Kin's behalf by a sweep -- awaits his decision (2026-10-20)
- ISO/IEC 27001 certificates (IAF CertSearch) not machine-readable: account required; certification-body registers are per body
- HITRUST not machine-readable: no public register (marketing directory behind a form)
Own = declares at least one integration itself; covered = visible only because an aggregator, standards body, regulator or partner contract names it; distribution-only = listed only on cloud marketplaces it sells through, a channel reported beside, never counted as its own declared integrations; undeclared = nothing we can read, so no number; declares_compatibility = providers with a `compatible` shape vote, report only (kin, 2026-10-13): never counted as own, never in depth or position.
Taxonomy how this market maps onto apis.io
Derived 2026-10-23 from the 21 providers in this market we could resolve in the catalog. The percentage is the share of those providers carrying each one; it describes the market, not the tag or industry. Tag groups have no page of their own yet, so they are listed unlinked.
| Tags | Compliance 81%, Risk Management 71%, GRC 62%, Security 52%, Audit 38%, Third-Party Risk Management 33%, SOC 2 33%, Cybersecurity 29%, ISO 27001 24% |
|---|---|
| Tag groups | Security 95%, Audit 67%, Third-Party Risk Management 48% |
| Industries | Legal & Compliance Tech 95%, Cybersecurity & Identity 76%, Artificial Intelligence 24% |
| Areas | Security 52% |
| Capabilities | Compliance Management 24%, SaaS Trust & Service Compliance Management 24%, Cybersecurity Management 24% |
share of resolved cohort carrying it; tags >=0.20 & >=3 members (max 12, junk dropped), tag_groups >=0.20 (cooccurrence, non-cross-cutting; max 8), industries >=0.20 (max 6), areas >=0.10 (max 6; areas are keyword-matched and sparse), capabilities L1 >=0.20 (max 8); derive-market-taxonomy.py
Leaders by position (provisional)
Provisional: grouped by position, depth compared within a position only. Distribution (cloud marketplaces) and iPaaS bridges are counted beside position, never inside it. Unknown-builder listings are left out of position shares and counted here.
builds-on 9 · publishes apps on other platforms' stores
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| anecdotes | 53.9 | 3 | 0 / 3 | 0 | 0 | 0 | standard 33%, builds-on-platform 67% |
| Drata | 51.8 | 14 | 0 / 14 | 0 | 2 | 2 | ipaas-bridge 14%, standard 14%, builds-on-platform 57%, distribution 14% |
| Vanta | 51.7 | 7 | 0 / 7 | 0 | 0 | 0 | standard 43%, builds-on-platform 57% |
| BitSight | 51.2 | 7 | 0 / 7 | 0 | 1 | 0 | standard 29%, builds-on-platform 57%, distribution 14% |
| Loopio | 42.9 | 5 | 0 / 5 | 0 | 0 | 1 | ipaas-bridge 20%, standard 20%, builds-on-platform 60% |
| Hyperproof | 40.7 | 4 | 0 / 4 | 0 | 0 | 1 | ipaas-bridge 25%, builds-on-platform 75% |
| Secureframe | 40.7 | 4 | 0 / 4 | 0 | 0 | 1 | ipaas-bridge 25%, standard 25%, builds-on-platform 50% |
| AuditBoard | 17.2 thin | 1 | 0 / 1 | 0 | 0 | 0 | builds-on-platform 100% |
| Thoropass | 17.2 thin | 1 | 0 / 1 | 0 | 0 | 0 | builds-on-platform 100% |
standard 6 · listed by a voluntary standard's own directory
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| SecurityScorecard | 48.8 | 9 | 0 / 9 | 0 | 2 | 0 | contract 11%, standard 44%, builds-on-platform 22%, distribution 22% |
| RegScale | 36.4 | 3 | 0 / 3 | 0 | 3 | 0 | standard 25%, distribution 75% |
| ComplyAdvantage | 34.5 | 4 | 0 / 4 | 0 | 3 | 0 | standard 25%, distribution 75% |
| RiskRecon | 19.4 thin | 1 | 0 / 1 | 0 | 0 | 0 | standard 100% |
| Scytale | 17.2 thin | 1 | 0 / 1 | 0 | 0 | 0 | standard 100% |
| Whistic | 17.2 thin | 1 | 0 / 1 | 0 | 0 | 0 | standard 100% |
mixed 3 · no single mode dominates
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| OneTrust | 43.4 | 9 | 0 / 9 | 0 | 2 | 1 | ipaas-bridge 11%, contract 11%, standard 22%, covered 11%, builds-on-platform 22%, distribution 22% |
| UpGuard | 41.3 | 3 | 0 / 3 | 0 | 0 | 1 | ipaas-bridge 33%, contract 33%, standard 33% |
| LogicGate | 37.0 | 3 | 0 / 3 | 0 | 0 | 1 | ipaas-bridge 33%, standard 33%, builds-on-platform 33% |
distribution 1 · only sells through cloud marketplaces
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| Sprinto | 9.6 thin | 1 | 0 / 1 | 0 | 1 | 0 | distribution 100% |
undeclared 2 · declares nothing we can read: no number
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|---|---|---|---|---|---|---|
| Archer | undeclared | - | - | - | - | - | |
| Tugboat Logic | undeclared | - | - | - | - | - |
Generated 2026-10-24 from API Evangelist's own files; nothing on this page is a model's judgement. Provisional and unweighted; not part of the Kin Score composite or agent readiness. Read the Market layer methodology. Disagree with an edge? Every edge cites its evidence and can be corrected through the normal correction path.