Markets · bedrock market · provisional
Compliance Assurance and Cloud Attestation
Register market (cloud-security attestation registers; attested providers counted, levels as per-edge signals). The Kin Score Market layer reads each provider in its market:
who it integrates with, how deep those integrations go, and where the market publishes its own structure.
Methodology.
17providers measured
11 (64.7%)declare their own
2 (11.8%)covered by others only
1 (5.9%)distribution only (sell through, not integrations)
3 (17.6%)undeclared
0in-market workflows shown
Provisional. Provisional and unweighted: the Market layer is not part of the composite or agent readiness. Leader lists are read within a position, never as one ranking. A provider that declares nothing we can
read is shown as undeclared, with no number: we never infer integrations.
Where this market publishes its structure
- CSA STAR Registry (cloudsecurityalliance.org/star/registry, server-rendered org + service pages) machine-readable, 2,843 organisations, 3,486 services; 573 providers linked by filed domain; 76 domain holders failed the name check (review); 97 Level-2 product entries (28 lapsed)
- EU Cloud Code of Conduct public register (eucoc.cloud list of adherent services) machine-readable, 36 adherent services; 16 linked; 4 name-failed (Cisco/Webex, Epignosis, Microsoft/Azure, Huawei/Sparkoo)
- PCI SSC listings (listings.pcisecuritystandards.org) not machine-readable: every list sits behind a click-through List Access Agreement; not accepted on Kin's behalf by a sweep -- awaits his decision (2026-10-20)
- ISO/IEC 27001 certificates (IAF CertSearch) not machine-readable: account required; certification-body registers are per body
- HITRUST not machine-readable: no public register (marketing directory behind a form)
Own = declares at least one integration itself; covered = visible only because an aggregator, standards body, regulator or partner contract names it; distribution-only = listed only on cloud marketplaces it sells through, a channel reported beside, never counted as its own declared integrations; undeclared = nothing we can read, so no number; declares_compatibility = providers with a `compatible` shape vote, report only (kin, 2026-10-13): never counted as own, never in depth or position.
Taxonomy how this market maps onto apis.io
Derived 2026-10-20 from the 17 providers in this market we could resolve in the
catalog. The percentage is the share of those providers carrying each one; it describes the market, not the tag or industry. Tag groups have no page of their own yet, so they are listed unlinked.
| Tags | Compliance 76%, Risk Management 76%, GRC 71%, Security 53%, Audit 41%, SOC 2 41%, Cybersecurity 35%, Third-Party Risk Management 35%, ISO 27001 29%, Security Ratings 24% |
|---|
| Tag groups | Security 94%, Audit 71%, Third-Party Risk Management 47% |
|---|
| Industries | Legal & Compliance Tech 94%, Cybersecurity & Identity 76%, Artificial Intelligence 24% |
|---|
| Areas | Security 53% |
|---|
| Capabilities | SaaS Trust & Service Compliance Management 29% |
|---|
share of resolved cohort carrying it; tags >=0.20 & >=3 members (max 12, junk dropped), tag_groups >=0.20 (cooccurrence, non-cross-cutting; max 8), industries >=0.20 (max 6), areas >=0.10 (max 6; areas are keyword-matched and sparse), capabilities L1 >=0.20 (max 8); derive-market-taxonomy.py
Leaders by position (provisional)
Provisional: grouped by position, depth compared within a position only. Distribution (cloud marketplaces) and iPaaS bridges are counted beside
position, never inside it. Unknown-builder listings are left out of position shares and counted here.
builds-on 9 · publishes apps on other platforms' stores
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Vanta |
51.8 |
5 |
0 / 5 |
0 |
0 |
0 |
standard 20%, builds-on-platform 80% |
| BitSight |
47.9 |
6 |
0 / 6 |
0 |
1 |
0 |
standard 17%, builds-on-platform 67%, distribution 17% |
| Drata |
45.0 |
11 |
0 / 11 |
0 |
1 |
2 |
ipaas-bridge 18%, standard 9%, builds-on-platform 64%, distribution 9% |
| SecurityScorecard |
42.5 |
5 |
0 / 5 |
0 |
2 |
0 |
standard 20%, builds-on-platform 40%, distribution 40% |
| Hyperproof |
40.7 |
4 |
0 / 4 |
0 |
0 |
1 |
ipaas-bridge 25%, builds-on-platform 75% |
| Secureframe |
37.0 |
3 |
0 / 3 |
0 |
0 |
1 |
ipaas-bridge 33%, builds-on-platform 67% |
| anecdotes |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
builds-on-platform 100% |
| AuditBoard |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
builds-on-platform 100% |
| Thoropass |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
builds-on-platform 100% |
standard 2 · listed by a voluntary standard's own directory
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Scytale |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
standard 100% |
| Whistic |
17.2 thin |
1 |
0 / 1 |
0 |
0 |
0 |
standard 100% |
mixed 1 · no single mode dominates
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| LogicGate |
37.0 |
3 |
0 / 3 |
0 |
0 |
1 |
ipaas-bridge 33%, standard 33%, builds-on-platform 33% |
long-tail 1 · reached only through iPaaS bridges
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| UpGuard |
2.5 thin |
1 |
0 / 1 |
0 |
0 |
1 |
ipaas-bridge 100% |
distribution 1 · only sells through cloud marketplaces
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Sprinto |
9.6 thin |
1 |
0 / 1 |
0 |
1 |
0 |
distribution 100% |
undeclared 3 · declares nothing we can read: no number
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Archer |
undeclared | - | - | - | - | - | |
| RiskRecon |
undeclared | - | - | - | - | - | |
| Tugboat Logic |
undeclared | - | - | - | - | - | |