{"updated_at":"2026-11-03","note":"On-demand list prices in USD, read weekly from each vendor's public price list. For planning: not live prices, not contracted or discounted prices, and no tax.","data":{"note":"Which compliance programs each vendor names on its own compliance pages. A program named here is the vendor's claim, linked to its page. It does not say which services or regions are covered; that is on the vendor's page for each program, and it is the part to check before relying on it.","programs":[{"id":"iso-27001","name":"ISO/IEC 27001","kind":"certification","about":"An international standard for managing information security."},{"id":"iso-27017","name":"ISO/IEC 27017","kind":"certification","about":"Security controls specific to cloud services."},{"id":"iso-27018","name":"ISO/IEC 27018","kind":"certification","about":"Protection of personal data in public clouds."},{"id":"soc-1","name":"SOC 1","kind":"attestation","about":"An auditor's report on controls relevant to customers' financial reporting."},{"id":"soc-2","name":"SOC 2","kind":"attestation","about":"An auditor's report on security, availability and related controls."},{"id":"soc-3","name":"SOC 3","kind":"attestation","about":"A public summary of a SOC 2 style report."},{"id":"pci-dss","name":"PCI DSS","kind":"standard","about":"The payment card industry's data security standard, for systems that handle card data."},{"id":"hipaa","name":"HIPAA","kind":"regulation","about":"US rules for health information. A cloud can support HIPAA workloads; the customer still has to configure and operate them correctly."},{"id":"gdpr","name":"GDPR","kind":"regulation","about":"The EU's data protection law. It is a law to follow, not a certificate a cloud holds; vendors publish how they support customers' compliance."},{"id":"fedramp","name":"FedRAMP","kind":"authorization","about":"The US federal government's cloud security authorization program."},{"id":"csa-star","name":"CSA STAR","kind":"registry","about":"The Cloud Security Alliance's registry of cloud security assessments."},{"id":"meity","name":"MeitY (India)","kind":"guidelines","about":"India's IT ministry security guidelines for government use of cloud services."},{"id":"irap","name":"IRAP (Australia)","kind":"assessment","about":"Australian government security assessments of cloud services."},{"id":"c5","name":"C5 (Germany)","kind":"attestation","about":"Germany's BSI cloud security criteria catalogue."},{"id":"hitrust","name":"HITRUST CSF","kind":"certification","about":"A security framework used mainly in US healthcare."},{"id":"ens","name":"ENS (Spain)","kind":"certification","about":"Spain's national security scheme for public-sector systems."}],"clouds":{"aws":{"index_url":"https://aws.amazon.com/compliance/programs/","verified_on":"2026-11-03","how":"Read from AWS's compliance programs page. Cells link to that page, since a program page per entry was not checked."},"azure":{"index_url":"https://learn.microsoft.com/en-us/azure/compliance/","verified_on":"2026-11-03","how":"Read from Microsoft's Azure compliance documentation page, which links each offering."},"gcp":{"index_url":"https://cloud.google.com/security/compliance/offerings","verified_on":"2026-11-03","how":"Google's offerings page loads its list with scripts, so each program was confirmed from its own page on cloud.google.com, which each cell links to."},"oci":{"index_url":"https://www.oracle.com/corporate/cloud-compliance/","verified_on":"2026-11-03","how":"Read from Oracle's cloud compliance page. Cells link to that page."}},"entries":{"aws":{"iso-27001":{"url":"https://aws.amazon.com/compliance/programs/"},"iso-27017":{"url":"https://aws.amazon.com/compliance/programs/"},"iso-27018":{"url":"https://aws.amazon.com/compliance/programs/"},"soc-1":{"url":"https://aws.amazon.com/compliance/programs/"},"soc-2":{"url":"https://aws.amazon.com/compliance/programs/"},"soc-3":{"url":"https://aws.amazon.com/compliance/programs/"},"pci-dss":{"url":"https://aws.amazon.com/compliance/programs/"},"hipaa":{"url":"https://aws.amazon.com/compliance/programs/"},"gdpr":{"url":"https://aws.amazon.com/compliance/programs/"},"fedramp":{"url":"https://aws.amazon.com/compliance/programs/"},"csa-star":{"url":"https://aws.amazon.com/compliance/programs/"},"meity":{"url":"https://aws.amazon.com/compliance/programs/"},"irap":{"url":"https://aws.amazon.com/compliance/programs/"},"c5":{"url":"https://aws.amazon.com/compliance/programs/"},"hitrust":{"url":"https://aws.amazon.com/compliance/programs/"},"ens":{"url":"https://aws.amazon.com/compliance/programs/"}},"azure":{"iso-27001":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-iso-27001"},"iso-27017":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-iso-27017"},"iso-27018":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-iso-27018"},"soc-1":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-soc-1"},"soc-2":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-soc-2"},"soc-3":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-soc-3"},"pci-dss":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-pci-dss"},"hipaa":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us"},"gdpr":{"url":"https://learn.microsoft.com/en-us/compliance/regulatory/gdpr"},"fedramp":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-fedramp"},"csa-star":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-csa-star-certification","note":"Azure lists CSA STAR attestation, certification and self-assessment as separate offerings."},"meity":{"url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-meity-india"},"irap":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-australia-irap"},"c5":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-germany-c5"},"hitrust":{"url":"https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hitrust"},"ens":{"url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-ens-spain"}},"gcp":{"iso-27001":{"url":"https://cloud.google.com/security/compliance/iso-27001"},"iso-27017":{"url":"https://cloud.google.com/security/compliance/iso-27017"},"iso-27018":{"url":"https://cloud.google.com/security/compliance/iso-27018"},"soc-1":{"url":"https://cloud.google.com/security/compliance/soc-1"},"soc-2":{"url":"https://cloud.google.com/security/compliance/soc-2"},"soc-3":{"url":"https://cloud.google.com/security/compliance/soc-3"},"pci-dss":{"url":"https://cloud.google.com/security/compliance/pci-dss"},"hipaa":{"url":"https://cloud.google.com/security/compliance/hipaa-compliance"},"gdpr":{"url":"https://cloud.google.com/privacy/gdpr"},"fedramp":{"url":"https://cloud.google.com/security/compliance/fedramp"},"csa-star":{"url":"https://cloud.google.com/security/compliance/csa-star"},"meity":{"url":"https://cloud.google.com/security/compliance/meity-india"},"irap":{"url":"https://cloud.google.com/security/compliance/irap"},"c5":{"url":"https://cloud.google.com/security/compliance/bsi-c5","note":"Google's page is titled BSI C5:2020."},"hitrust":{"url":"https://cloud.google.com/security/compliance/hitrust"},"ens":{"url":"https://cloud.google.com/security/compliance/ens"}},"oci":{"iso-27001":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"iso-27017":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"iso-27018":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"soc-1":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"soc-2":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"soc-3":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"pci-dss":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"hipaa":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"gdpr":{"url":"https://www.oracle.com/corporate/cloud-compliance/","note":"Oracle names GDPR on its list and publishes guidance as an advisory document."},"fedramp":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"csa-star":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"meity":{"url":"https://www.oracle.com/corporate/cloud-compliance/","note":"Oracle names the MeitY IT Security Guidelines."},"irap":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"c5":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"hitrust":{"url":"https://www.oracle.com/corporate/cloud-compliance/"},"ens":{"url":"https://www.oracle.com/corporate/cloud-compliance/"}}}}}