TISAX: which SaaS vendors say they hold a label

25 of the 148 vendors whose certification pages we read list TISAX. Here is what each one states: the standard as it writes it, the scope, whether a certificate or report can be seen, and where and when we read it. Last read on 2026-11-09.

Vendor by vendor

"Certificate published": the vendor links the certificate itself. "Report on request": the vendor offers the certificate or audit report to customers or under NDA, usually through its trust centre. "Stated": the vendor names the standard and links nothing behind it.

What TISAX is

TISAX (Trusted Information Security Assessment Exchange) is the automotive industry's information security assessment, run by the ENX Association and based on the VDA ISA catalogue of the German Association of the Automotive Industry. Carmakers ask it of the suppliers and service providers that handle their information. (ENX Association)

The outcome is a label, not a certificate. ENX states that labels are valid for three years and that results are not publicly available: the assessed company shares them with the participants it chooses. A vendor's statement is therefore usually all a non-participant can see.

Vendors whose list does not include it

We read the certification pages of these 123 vendors and found no mention of TISAX. That is what their pages say, not proof that no certificate exists: 1Password, AWS European Sovereign Cloud, ActiveCampaign, Adyen, Aircall, Airtable, Amplitude, Anthropic, Apollo.io, Asana, Attio, Backblaze, Bitwarden, Bleu, Box, Brevo, Calendly, Canva, Cisco Webex, Clay, ClickHouse, ClickUp, Cloudflare, Contentsquare, Cursor, DATEV, DeepL, Deepgram, Delos Cloud, DigitalOcean, Docker, Docusign, Doodle, Drata, Dropbox, Element, ElevenLabs, Eventbrite, Freshworks, GitHub, GitLab, Gong, Google Analytics, Google Cloud, Google Workspace, Grafana Labs, Grammarly, Granola, Hetzner, Hostinger, HubSpot, IONOS Cloud, Infomaniak, Intercom, JetBrains, Jotform, Kahoot!, Klaviyo, KnowBe4, Langdock, Lovable, Lusha, Mailchimp, Mailgun, Make, Mentimeter, Miro, Mistral AI, Mixpanel, Mollie, Mural, Netlify, Nextcloud, Notion, OVHcloud, OpenAI, OpenRouter, PayPal, Pennylane, Perplexity, Personio, Pipedrive, Piwik PRO, Pleo, PostHog, Proton, Retool, Rippling, S3NS, STRATO, Scaleway, Sentry, Shopify, Sinch, Smartsheet, Snowflake, Spendesk, Squarespace, Stripe, Supabase, SurveyMonkey, Tresorit, Twilio, Typeform, Vanta, Vimeo, Vonage, WeTransfer, Webflow, WhatsApp Business, Wire, Wix, Workday, Xero, Zapier, Zendesk, Zoho, Zoom, ZoomInfo, iubenda, monday.com, n8n, netcup.

Questions

Which SaaS vendors are TISAX certified?

Of the 148 vendors whose certification pages this registry reads, 25 list TISAX: OneTrust, CrowdStrike, Optimizely, Qualtrics, Slack, STACKIT, Usercentrics, 3DS Outscale, Adobe, Amazon Web Services, Atlassian, Databricks, Datadog, Elastic Cloud, Figma, Mapbox, Microsoft, MongoDB, New Relic, Okta, Oracle Cloud, T Cloud Public, TeamViewer, Vercel, Zscaler. 1 publish the certificate, 6 provide the audit report or certificate on request, and 18 state it without a public document.

How can I check a vendor's TISAX claim?

Ask the vendor to share its assessment result through the ENX exchange platform, which is where TISAX results are shared; they are not published.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “TISAX: what SaaS vendors state”, https://eucsoft.com/en/certifications/tisax/, data read up to 2026-11-09.

How this was read

Each week the registry reads every vendor's certification or trust centre page and records each standard it lists, quoted as written, with the scope and any validity date it gives. A listing that changes waits for a person's review before it reaches this page. Other standards: ISO/IEC 42001, ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, BSI C5, SOC 2;SecNumCloud, from ANSSI's list; the other national cloud schemes (C5, ENS, HDS) are on the certifications page. Full method on the methodology page.