Question 1

What is Compliance (compliance.fru.dev)?

Accepted Answer

It answers which certifications and attestations cloud, data, AI and developer-tool vendors hold: SOC 1, 2 and 3, ISO 27001 and its family, ISO 42001, FedRAMP, GovRAMP, DoD Impact Levels, FIPS 140, CMMC, HIPAA, HITRUST, GxP, 21 CFR Part 11, PCI DSS, DORA, the Data Privacy Framework, CSA STAR, C5, IRAP, ISMAP and more. Pick up to three and get the vendors that hold all of them, each linked to its evidence and the date it was captured.

Question 2

Is this about certifications people earn?

Accepted Answer

No. This site tracks the certifications companies hold (SOC 2, ISO 27001, FedRAMP and the rest). For exams and certifications people take, see Certifications (certifications.fru.dev).

Question 3

Where does the data come from?

Accepted Answer

From public registries where they exist (the FedRAMP Marketplace data, the CSA STAR Registry, the Data Privacy Framework List, the NIST CMVP list of validated FIPS 140 modules and the GovRAMP product list) and otherwise from each vendor's own compliance or trust-center page. Registry entries are authoritative; vendor-page entries record the sentence the vendor published, and matches nobody has confirmed show Unverified.

Question 4

How often is it updated?

Accepted Answer

A run every Wednesday at 10:00 UTC re-reads every registry and a rotating set of vendor pages. What changed goes into the change log with its date.

Question 5

Which vendors support GxP and 21 CFR Part 11?

Accepted Answer

Pick GxP and 21 CFR Part 11 on the home page. There is no GxP certificate: the list shows vendors whose compliance pages publish GxP qualification guidance or Part 11 and Annex 11 mappings, such as AWS, Microsoft and Google Cloud, each with the page that says so.

Question 6

Which AI vendors are FedRAMP authorized?

Accepted Answer

Filter the grid by FedRAMP: OpenAI (ChatGPT Enterprise and API Platform, FedRAMP 20x Moderate), Perplexity (20x Low), Scale AI and Palantir (High), and Google's Gemini for Government (20x Low) are listed in the FedRAMP Marketplace. Claude reaches federal agencies through AWS GovCloud and Google Cloud authorizations.

Question 7

Which companies are ISO 42001 certified?

Accepted Answer

Open the ISO/IEC 42001 page: it lists every tracked vendor that names the AI management system certification on its compliance page or in the CSA STAR Registry, including Microsoft, AWS, Google Cloud, Anthropic, OpenAI, Snowflake and Workday.

Question 8

Is HIPAA a certification?

Accepted Answer

No. There is no HIPAA certificate. The HIPAA column records whether a vendor says it supports HIPAA-regulated data and signs a Business Associate Agreement, and for which products; confirm the BAA scope with the vendor.

Question 9

Does a SOC 2 listing mean I can see the report?

Accepted Answer

No. SOC 1 and SOC 2 reports are shared under NDA through the vendor's trust center. SOC 3 is the public summary. Compliance records that the vendor states it has the report, with a link to where to request it.

Who holds which certification

What to do

Most certified

What to do

Certifications

What changed