ISO 27001
Information security management
We are building the management system; the certification audit is not booked yet.
ISO/IEC 27001 is the international standard for an information security management system: a documented, risk-based way of running security, audited by an accredited certification body and checked again every year of the three-year certificate cycle.
Where we are
Vaulty is not ISO 27001 certified. We are building the management system around controls the product already has. Vaulty reads your ERP, CRM, accounting, files and mail through read-only connections, and any write is a separate action that a person approves. The AI model runs on Microsoft Azure OpenAI in the EU data zone, on your own Azure, or as an open model on your own hardware. A Vaulty node can run on your server, so the full copy of your data stays on your premises and only what a question needs is sent out. Credentials are encrypted for each company, access follows roles and departments, sign-in uses one-time email codes instead of passwords, and an audit log records each question and query.
What is planned
A risk assessment and Statement of Applicability, written policies, supplier reviews, tested backups and incident response, an internal audit and a management review, then the Stage 1 and Stage 2 audits. We will show a certificate number here only once it has been issued.
Last updated: 2026-10-31