From the source
The certificate covers our information security management system across the entire platform, including Database, Auth, Storage, Realtime, Edge Functions, and the Data API.
What ISO 27001 is # ISO/IEC 27001:2022 is the international standard for information security management systems, also known as an ISMS.
An ISMS is the collection of policies, processes, and controls a company uses to manage risk to the information it holds.
The standard defines what an ISMS has to cover, how it has to be documented, and how it has to be maintained.
Certification comes from an accredited third-party auditor.
They review the documentation, test the controls, and decide whether the standard has been met.
A certificate is valid for three years, with a surveillance audit every year in between, and the ISMS has to keep running the whole time.
Controls have to keep working.
If the system drifts, the certificate goes away.
How it relates to SOC 2 # SOC 2 and ISO 27001 cover a lot of the same ground.
Both evaluate how a company protects customer data.
Both look at access controls, change management, incident response, and business continuity.
…
