Key takeaways
- In an October 26, 2026 check of 17 AI visibility and SEO platforms (published by Promptwatch, so treat it as first-party), Promptwatch was the only AI-native platform with its own ISO 27001 certificate. BrightEdge, Conductor and Similarweb also showed one, and Ahrefs was reported as certified by a third party.
- Promptwatch's certificate is ISO/IEC 27001:2022, issued by ProCertify (accredited by the Dutch RvA), number 27001 26102026.2, valid until October 26, 2029.
- "Not found" means not found on public pages. It does not prove a vendor lacks the certificate, and many vendors lead with SOC 2 instead.
- Read the scope line on any certificate before you trust it. "Aligned with ISO 27001" is not the same as certified.
Why ISO 27001 matters when you buy an AI visibility tool
An AI visibility platform holds a surprising amount of sensitive material: the prompts you track (which reveal your strategy), competitor lists, collected AI answers, and sometimes server logs. For a bank, insurer or hospital group, that is enough to trigger a security review.
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It does not certify a product feature. It certifies that a company identifies risks, applies controls from the standard's Annex A (93 controls across organizational, people, physical and technological themes), and gets audited on it. A Stage 1 audit reviews documentation, a Stage 2 audit tests the controls, and the certificate then runs three years with annual surveillance audits.
Procurement timing is the practical reason to care. At larger companies, security sign-off can take several weeks. An audited certificate you can hand over beats answering a questionnaire from scratch.
Which AI visibility platforms are ISO 27001 certified?
The table below comes from the check published by Promptwatch on October 26, 2026. Remember who wrote it. I have not independently verified every row, and the original post said 17 platforms were checked while its visible table listed 16, so one platform is unaccounted for.
| Platform | Own ISO 27001 certificate found | Public evidence |
|---|---|---|
| Promptwatch | Yes | Own certificate, ISO/IEC 27001:2022, ProCertify |
| BrightEdge | Yes | Listed on its own trust page |
| Conductor | Yes | Listed on its own enterprise pages |
| Similarweb | Yes | Third-party security directory listing |
| Ahrefs | Reported | Third-party case study only |
| Profound | Not found | Nothing on public security pages |
| Scrunch | Not found | Described elsewhere as SOC 2 Type II |
| AthenaHQ | Not found | Nothing on public security pages |
| Brandlight | Not found | Nothing on public security pages |
| Goodie | Not found | Nothing on public security pages |
| Otterly | Not found | Cites AWS certifications |
| Rankscale | Not found | Cites Google Cloud certifications |
| Semrush | Not found | Nothing on public security pages |
| SE Ranking | Not found | No public certification found |
| Evertune | Not found | No public certification found |
| Bluefish | Not found | No public certification found |
The pattern is clear. Outside Promptwatch, ISO 27001 sits mostly with larger SEO and web analytics suites that added AI visibility features. Most AI-native tools lead with SOC 2 or cite their cloud host's certifications, which is a different claim entirely.
The platforms, one by one
Promptwatch
Promptwatch is the only AI-native platform in the check with its own certificate. Certified company is Promptwatch B.V. in Amsterdam, under ISO/IEC 27001:2022 + Amd1:2024, issued by ProCertify B.V. (Apeldoorn), accredited by the RvA under registration C 707. The scope covers the ISMS for development, implementation and customer support of the Promptwatch SaaS platform. The Statement of Applicability is version 1.0, dated September 14, 2026.
The data in scope is the data you would worry about: tracked prompts, collected AI answers and citations, and crawler log records limited to 10 fields per bot request. You can request a copy of the certificate from your Promptwatch contact or support.
Capability-wise, it is more than a tracker. It monitors real interfaces of ChatGPT, Google AI Overviews, Gemini, Perplexity, Copilot and others, adds IP-verified crawler logs and visitor analytics, and has a Content Agent that writes and publishes to your CMS. Plans start with a free Explore tier and Essential at $95/mo; confirm on promptwatch.com/pricing.
One caveat: the certificate is new (October 2026), so there is no multi-year track record yet. Annual surveillance audits are what will keep it meaningful.
BrightEdge
BrightEdge lists ISO 27001 on its own trust page. It is an enterprise SEO suite with AI search intelligence, so it fits large organizations that already run BrightEdge for traditional SEO and want AI tracking under the same security umbrella. It is heavier and more expensive than AI-native trackers.
Conductor
Conductor lists ISO 27001 on its enterprise pages. A third-party article (SearchEye) also credits it with SOC 2 Type II and ISO 42001, the AI management standard, though I did not verify those. Strong choice if your security team wants AI governance credentials alongside ISO 27001.
Similarweb
Similarweb shows up in a third-party security directory with ISO 27001, and SearchEye says it also documents SOC 2 Type 2 and SOC 3. Its AI brand visibility product sits inside a broader digital intelligence suite.
Similarweb AI Brand Visibility
Ahrefs
Ahrefs is only "reported" as certified, based on a third-party case study. Its Brand Radar tracks brands across AI search engines. If Ahrefs is on your shortlist, ask them for the certificate directly rather than relying on that report.
Tools where nothing was found
Profound, Scrunch, AthenaHQ, Brandlight, Goodie, Otterly, Rankscale, Semrush, SE Ranking, Evertune and Bluefish showed no ISO 27001 on public pages. That is a statement about public evidence. Some may hold it, hold SOC 2 instead, or be mid-audit. Scrunch, for example, is described as SOC 2 Type II compliant. Ask each one.
ISO 27001 vs SOC 2 vs "cloud host is certified"
These get conflated constantly in vendor marketing.
| Claim | What it actually tells you |
|---|---|
| Own ISO 27001 certificate | An accredited body audited the vendor's ISMS, scoped to specific services |
| SOC 2 Type II | An auditor tested controls over a period; US-centric, report is usually under NDA |
| Cloud host certified (AWS, Google Cloud) | The infrastructure is audited. The vendor's own processes are not |
| "Aligned with" or "compliant with" ISO 27001 | Self-declared. Weaker than an accredited certificate |
Otterly and Rankscale citing AWS and Google Cloud certifications is honest, but it covers the data center, not how the vendor handles your prompts. SOC 2 is a perfectly good credential too. Plenty of buyers accept either. ISO 27001 is simply the one many European and regulated-sector procurement teams ask for first.
How to verify a certificate before you sign
A logo on a footer proves nothing. A short checklist:
- Ask for the certificate PDF and read the scope line first. It should cover the product you are buying, not just a parent company or an office.
- Check the standard version. The 2013 transition period ended October 31, 2025, so any valid certificate in 2026 should reference ISO/IEC 27001:2022.
- Confirm the certification body is accredited (for example, by the RvA in the Netherlands or UKAS in the UK). Unaccredited certifiers exist.
- Check validity dates and whether annual surveillance audits are on schedule.
- Ask for the Statement of Applicability, or at least a summary of excluded controls.
- Review the DPA, subprocessor list and data retention terms. A certificate does not replace these.
- Find out exactly what data the tool stores. Prompts and AI answers are low risk compared with customer data, but crawler logs and analytics events can touch personal data.
Which AI visibility platform should you pick?
Security credentials are a filter, not a ranking. Once a tool passes your security review, judge it on what it does.
| Situation | Where I would look first |
|---|---|
| AI-native platform, own ISO 27001, tracking plus content execution | Promptwatch |
| Already a BrightEdge shop, want AI tracking in the same contract | BrightEdge |
| Need ISO 27001 plus AI governance (ISO 42001) credentials | Conductor |
| Broader web and market intelligence with AI visibility added | Similarweb |
| Need ISO 27001 but vendor has only SOC 2 | Ask the vendor about certification timelines, or accept SOC 2 if your policy allows |
If you do not strictly need ISO 27001, the field opens up a lot. SearchEye's October 2026 comparison covers lower-cost options such as OtterlyAI (from $29/month) and Peec AI, and is worth a read for the non-regulated case.
For wider browsing, the GEO software directory at bestgeosoftware.com lists far more tools than are covered here.
What I would do if I were on the buyer side
Start with the certificate question in your very first vendor email. It saves weeks. Vendors who have it send it within a day. Vendors who do not will usually tell you what they do have (SOC 2, pen test reports, a security whitepaper), and that answer is useful too.
Then be honest about your requirement. If your policy says ISO 27001 or nothing, the shortlist from this check is short: Promptwatch among the AI-native tools, and BrightEdge, Conductor and Similarweb among the suites. If your policy accepts SOC 2 or a vendor security questionnaire, more tools are in play, and you should evaluate them on coverage, data quality and whether they help you act on what you find.
Two honest limitations of everything above. The comparison table is vendor-authored and based on public pages as of October 26, 2026. Security pages change, and certifications get added. Re-check before you finalize a decision, and ask each vendor to confirm in writing.
FAQ
Which AI visibility platforms are ISO 27001 certified?
In the October 26, 2026 check of 17 platforms, Promptwatch, BrightEdge, Conductor and Similarweb showed an ISO 27001 certificate, and Ahrefs was reported as certified by a third party. Promptwatch was the only AI-native platform with its own certificate.
Does "not found" mean a tool is insecure?
No. It means no certificate appeared on public pages. The vendor may hold SOC 2, be mid-audit, or simply not publish it. Ask directly.
Is ISO 27001 mandatory?
No. Certification is optional. It is just the credential many security teams, especially in finance, insurance, pharma and healthcare, ask for first.
How long is the certificate valid?
Three years, with annual surveillance audits. Promptwatch's runs from October 26, 2026 to October 26, 2029.
What does Promptwatch's certificate cover?
The ISMS for development, implementation and customer support of the Promptwatch SaaS platform, including tracked prompts, collected AI answers and citations, and crawler log records limited to 10 fields per bot request.