ISO 27701

Privacy management system

Status todayPlanned

The privacy extension of our ISO 27001 work; not certified.

ISO/IEC 27701 is the international standard for a privacy information management system. Since its 2025 edition it can be certified on its own, but it is most often added on top of ISO 27001. It checks how an organisation handles personal data as a controller and as a processor, and it maps closely to the GDPR.

Where we are

Vaulty is not ISO 27701 certified, and the audit is not yet scheduled. For the data inside your systems, we act as your processor: we process it only on your instructions, and we do not use it to train AI models. Connections are read-only, and access to personal data follows the roles and departments you set.

What is planned

Once our ISO 27001 work is in place, we will extend it to privacy. That means a record of the processing we carry out for each client, a public list of subprocessors with advance notice of changes, documented retention and deletion on request, help with your data subject requests and impact assessments, and controls on international transfers. We will then ask our certification body to audit the extension. This card will change only when that audit has been passed.

Last updated: 2026-10-31

The other standards

GDPRThe EU's personal data law, and how we handle your data as your processor. ISO 27001The international standard for running information security as a managed, audited system. ISO 42001The international standard for governing how a company builds and uses AI. AIUC-1A security and safety standard written specifically for AI agents and their tools. SOC 2 Type IIAn independent audit of how a provider protects customer data over a period of months. CCPACalifornia's privacy law for residents' personal information, and what it means for us.