Glossary · Security and compliance
ISO 27001
Also called ISO/IEC 27001
Definition
ISO/IEC 27001 is the international standard for an information security management system. A certified company has been audited against it by an accredited body and is re-audited regularly. For data room buyers it is a baseline: it shows the provider runs security as a managed process, not ad hoc.
Where ISO 27001 comes up
On this site, in our guides and in the conversations we've written up.
Guide How to choose a virtual data room Security and compliance: certifications (ISO 27001, SOC 2), encryption, data residency, and granular permissions. Guide Virtual data room security: what to look for Look for independent, audited certifications rather than self-assessed claims: ISO 27001 (information security management), SOC 2 Type II (operational controls over time), and where relevant ISO 27017/27701, SOC 3, HIPAA and GDPR alignment. Guide Ansarada VDR review: the whole deal in one place, if you need it all Ansarada has ISO 27001 certification and SOC 2 attestation, alongside multi-factor authentication, dynamic watermarking and detailed access controls. 
Video · VirtualData-Room.com Ansarada review: the whole deal, with AI that reads your bidders ISO 27001 certification, SOC 2 attestation, watermarking and folder and document permissions
Remote Doc Destruct revokes access to documents even after download
AIDA answers questions about the data room; AI Predict estimates bidder…
Video · VirtualData-Room.com Ansarada review: the whole deal, with AI that reads your bidders ISO 27001 certification, SOC 2 attestation, watermarking and folder and document permissions
Remote Doc Destruct revokes access to documents even after download
AIDA answers questions about the data room; AI Predict estimates bidder… Related terms
SOC 2 An independent audit report on a service provider's security controls, common in the US. GDPR The EU's data protection law, which governs how personal data, including data in a data room, is handled. Data residency Where a provider physically stores your data, which can matter for regulation and client requirements. Single sign-on Logging in with a company account, such as Microsoft or Okta, instead of a separate password. Two-factor authentication A login that needs a second proof of identity, such as a code on a phone, on top of a password.