Skip to content
Start with Identity
Join free
Ranking · segment · 8 min

Compliant CIAM Platforms: SOC 2 Type II, ISO 27001 and HIPAA

Customer identity platforms with strong compliance posture for regulated buyers.

By SWI Community Team · Updated 2026-11-05Scored on our 10-dimension rubric

As of November 2026, Auth0 is the most complete compliant CIAM platform we could verify: its own documentation states an annual SOC 2 Type 2 audit, an annual ISO 27001/27017/27018 audit and a HIPAA Business Associate Agreement on request. MojoAuth claims the same three on its own pages. Only Ping Identity names ISO 27001:2022 specifically. We checked every claim below against the vendor's own trust or security page on 5 November 2026; where a page did not say it, the table says so. To filter 28 CIAM platforms and 127 other identity vendors by SOC 2 Type II, ISO 27001, HIPAA BAA, FedRAMP and PCI DSS, with the source behind every cell, use the Identity Vendor Certifications Directory.

Vendor SOC 2 ISO 27001 HIPAA / BAA Source
Auth0 Type 2, audited annually 27001/27017/27018 audited annually, edition not stated BAA on request for covered entities; not on Azure deployments. Also PCI DSS (level not stated) and CSA STAR; no FedRAMP documented Auth0 docs
Stytch Type II; report in Twilio Trust Center Certificate in Twilio Trust Center, edition not stated BAA on Enterprise plan docs, pricing
MojoAuth Type II, "Certified" "Certified", edition not stated BAA on Enterprise plans HIPAA page
WorkOS Type 2 Not stated BAA on enterprise plans security page
Ping Identity Type 2; separate Ping and ForgeRock reports under NDA ISO 27001:2022, all products "Meet HIPAA requirements"; no BAA documented security page, PingOne AIC compliance
Clerk Type 2 since 6 May 2022 Not certified (Clerk's own FAQ) HIPAA listed as held; BAA on Enterprise plan security page
SSOJet "SOC 2 compliant", report type not stated "Aligned", not certified BAA on Enterprise plan security page
Frontegg Type II Stated, edition not stated; also ISO 27701 BAA on Enterprise plan trust center, pricing

For regulated buyers, a CIAM platform's compliance posture is a gating requirement, not a nice-to-have. This ranking weighs the certifications and attestations that come up most in enterprise security review: SOC 2 Type II, ISO 27001:2022, and HIPAA readiness (a Business Associate Agreement for protected health information).

An important caveat: certifications, scopes, and HIPAA BAA availability change, and some are tied to specific plan tiers. Treat this as a starting shortlist, then request the current SOC 2 report and ISO certificate directly from each vendor under NDA before you rely on them. Remember too that a vendor's compliance covers their service, not your application; you remain responsible for your own program.

How to verify a CIAM vendor's claims

Three checks catch most problems. First, ask for the SOC 2 Type II report itself and read the audit period and any exceptions, not the trust-centre badge. Second, check scope: some vendors list SOC 2, ISO 27001 or HIPAA as attributes of a specific plan or private-cloud deployment rather than as attestations the company holds. SSOJet, for example, offers a BAA on its Enterprise plan and says it is "SOC 2 compliant" and ISO 27001 "aligned", but names no report type and publishes no certificate, so ask for documentation before relying on it. Third, for health data, confirm the Business Associate Agreement is available on the plan you will buy.

For US healthcare specifically, see HIPAA-ready CIAM for healthcare; for the wider market, best CIAM platforms and vendors. Scores reflect our 10-dimension rubric and editorial judgment about compliance posture. Each pick links to a full vendor profile. See also our compliance guides on SOC 2, HIPAA, and ISO 27001, and the identity regulations by country directory.

For a deeper, vendor-neutral CIAM capability matrix across 48 platforms, see CIAM Compass by Deepak Gupta.

1
Auth04.6/5 overall

The broadest compliance coverage in CIAM, backed by Okta.

Auth0 maintains SOC 2 Type II and ISO 27001/27017/27018, signs a HIPAA BAA on request, offers PCI-compliant deployment models and holds CSA STAR. It does not document a FedRAMP authorization of its own. The depth of its trust program is a major reason large, regulated buyers standardize on it.

Best for: Regulated enterprises that need broad, well-documented compliance coverage

Watch out: Some certifications and HIPAA support are tied to higher plan tiers

Read the full Auth0 review →
2
Stytch4.4/5 overall

Modern platform with SOC 2 Type II, ISO 27001, and HIPAA support.

Stytch publishes a SOC 2 report, ISO 27001 certificate and PCI DSS document through the Twilio Trust Center and lists a HIPAA BAA on its Enterprise plan, pairing a strong compliance posture with API-first, passwordless authentication. A good fit for regulated products that also want modern developer ergonomics.

Best for: Regulated, engineering-led teams that want compliance and modern auth

Watch out: The BAA is Enterprise-plan only and the PCI DSS level is not stated

Read the full Stytch review →
3
MojoAuth4.2/5 overall

Compliance-ready passwordless CIAM with a privacy-conscious posture.

MojoAuth states it maintains SOC 2 and ISO 27001 practices and supports HIPAA needs, alongside a privacy-conscious, minimal-data-retention design that limits the sensitive data it holds. An efficient option for regulated teams standardizing on passwordless.

Best for: Regulated teams prioritizing passwordless with a lean data footprint

Watch out: As an emerging vendor, confirm current attestations and BAA availability directly

Read the full MojoAuth review →
4
WorkOS4.4/5 overall

Enterprise-readiness layer with SOC 2 Type II, ISO 27001, and HIPAA support.

WorkOS states SOC 2 Type 2 and signs a HIPAA BAA on enterprise plans, which matters because it often sits in the enterprise-onboarding path where compliance is scrutinized. Clean audit logging further supports customers' own compliance.

Best for: B2B products that must pass enterprise security review to close deals

Watch out: No ISO 27001 claim on its security page; an enterprise-readiness layer, not a full consumer CIAM

Read the full WorkOS review →
5
Ping Identity4.4/5 overall

Deep compliance and assurance for the most regulated industries.

Ping is certified to ISO 27001:2022 across all products, documents SOC 2 Type II and CSA STAR Level 2, reaches FedRAMP High through UberEther's IAM Advantage package, and supports high-assurance and open-banking-grade requirements, making it a frequent choice in finance, healthcare, and government where compliance obligations are heaviest and orchestration is needed.

Best for: Heavily regulated enterprises in finance, healthcare, and government

Watch out: No HIPAA BAA documented; FedRAMP only via the UberEther government package

Read the full Ping Identity review →
6
Clerk4.2/5 overall

Developer-first CIAM with SOC 2 Type II and HIPAA support.

Clerk maintains SOC 2 Type II and offers HIPAA support with a BAA, so teams that adopt it for its excellent developer experience can still meet common compliance requirements for regulated applications.

Best for: Developer-led teams that want strong DX without sacrificing compliance

Watch out: Clerk says it is not ISO 27001 certified; the BAA is Enterprise-plan only

Read the full Clerk review →
7
SSOJet4.1/5 overall

Enterprise SSO and SCIM layer; ask for its compliance evidence.

SSOJet focuses on the enterprise SSO and SCIM features that gate B2B deals. Its security page offers a BAA on the Enterprise plan and says it is SOC 2 compliant and ISO 27001 aligned, but it names no SOC 2 report type and publishes no certificate.

Best for: B2B products adding enterprise SSO that must clear security questionnaires

Watch out: No SOC 2 report type or ISO certificate published; request documentation before relying on it

Read the full SSOJet review →
8
Frontegg4.1/5 overall

B2B CIAM with SOC 2 Type II, ISO 27001 and a BAA on Enterprise.

Frontegg maintains SOC 2 Type II, ISO 27001 and ISO 27701, offers a HIPAA BAA on its Enterprise plan, and provides the audit logging and admin controls that regulated B2B SaaS needs, so its complete customer identity layer supports both product velocity and enterprise compliance.

Best for: Regulated B2B SaaS that wants tenancy, admin, and compliance together

Watch out: Focused on B2B multi-tenancy; the BAA is Enterprise-plan only

Read the full Frontegg review →

At a glance

#VendorScoreBest for
1Auth04.6/5Regulated enterprises that need broad, well-documented compliance coverage
2Stytch4.4/5Regulated, engineering-led teams that want compliance and modern auth
3MojoAuth4.2/5Regulated teams prioritizing passwordless with a lean data footprint
4WorkOS4.4/5B2B products that must pass enterprise security review to close deals
5Ping Identity4.4/5Heavily regulated enterprises in finance, healthcare, and government
6Clerk4.2/5Developer-led teams that want strong DX without sacrificing compliance
7SSOJet4.1/5B2B products adding enterprise SSO that must clear security questionnaires
8Frontegg4.1/5Regulated B2B SaaS that wants tenancy, admin, and compliance together

Frequently asked questions

Which CIAM platforms are SOC 2, ISO 27001, and HIPAA compliant?
Checked on each vendor's own pages on 5 November 2026: Auth0 and MojoAuth state all three (a SOC 2 Type 2 or Type II audit, ISO 27001, and a HIPAA BAA, on request at Auth0 and on Enterprise plans at MojoAuth). Stytch publishes a SOC 2 report and ISO 27001 certificate in the Twilio Trust Center and lists a BAA on its Enterprise plan. Frontegg states SOC 2 Type II and ISO 27001 and lists a BAA on its Enterprise plan. Ping Identity is certified to ISO 27001:2022 and documents SOC 2 Type II, but documents no BAA. WorkOS and Clerk state SOC 2 Type 2 and a BAA on enterprise plans but no ISO 27001. SSOJet offers a BAA on its Enterprise plan but names no SOC 2 report type and no ISO certificate. The full table for 155 identity vendors is in SWI's Identity Vendor Certifications Directory.
Which CIAM platforms are certified to ISO 27001:2022 specifically?
Of the eight, only Ping Identity's security page names the 2022 edition, covering all its products including PingOne and PingOne Advanced Identity Cloud. Auth0, Stytch, MojoAuth and Frontegg state ISO 27001 without a version, so ask for the certificate and check its edition and scope. Okta's trust center lists ISO/IEC 27001:2022 for Okta but does not name Auth0.
Which CIAM platforms will sign a HIPAA BAA?
As of 5 November 2026, by their own documentation: Auth0 (on request, for covered entities storing ePHI in the user profile, not on Azure deployments), MojoAuth, WorkOS, Clerk, Stytch, Frontegg and SSOJet (all on their Enterprise plans). Ping Identity says its products meet HIPAA requirements but documents no BAA. Get the BAA scope in writing for the plan you buy.
What compliance should I require from a CIAM vendor?
At minimum a current SOC 2 Type II report and ISO 27001:2022 certification, plus a HIPAA Business Associate Agreement if you handle protected health information. Depending on your market, also look for regional certifications and data-residency options. Request the actual reports under NDA, not just a badge.
Does SOC 2 or ISO 27001 make my application compliant?
No. Your CIAM vendor's certifications cover their service, not your application. They reduce your due-diligence burden and support your own audits, but you remain responsible for how you configure and use the platform, and for your own compliance program.
What is the difference between SOC 2 Type II and ISO 27001:2022?
SOC 2 Type II is an attestation, by an auditor, that a company's controls operated effectively over a period (usually a year). ISO 27001:2022 is a certification against an international information-security management standard. Many vendors hold both; regulated buyers often ask for both.
Last reviewed By SWI Community TeamSuggest a correctionHow we research
Independent and community-driven, no sponsorship. Rankings reflect ourcapability rubricand editorial judgment. See the fullrankings indexand head-to-head comparisons.