--- title: "AhaSend is ISO 27001 certified" description: "AhaSend is now certified against ISO/IEC 27001:2022, the international standard for information security management. The certification audit took place in September and was carried out by Procertify, was issued on 16 October 2026 and is valid for three years; it is published in our Trust Center." url: https://ahasend.com/blog/ahasend-iso-27001-certified markdown_url: https://ahasend.com/blog/ahasend-iso-27001-certified.md lang: en type: blog_post published: 2026-11-02 updated: 2026-11-02 author: "Mark Kraakman" category: "Compliance and Security" image: https://cms.ahasend.com/sites/default/files/2026-11/iso-27001.png --- # AhaSend is ISO 27001 certified _By Mark Kraakman, November 2, 2026, in Compliance and Security_ ![AhaSend is ISO 27001 certified](https://cms.ahasend.com/sites/default/files/2026-11/iso-27001.png) AhaSend is now certified against ISO/IEC 27001:2022, the international standard for information security management. The certification audit took place in September and was carried out by [Procertify](https://www.procertify.nl/), was issued on 16 October 2026 and is valid for three years; it is published in our [Trust Center](https://trust.ahasend.com/). We announced in March that we had started this process. Seven months, a lot of documents and one audit later, it is done. This post explains what the certificate covers, what the auditor actually looked at, and what it changes for you.2 ![Procertify](https://cms.ahasend.com/sites/default/files/styles/cke_media_resize_large/public/2026-11/logo-27001-voor-op-website-kopie.jpeg?itok=a5BsQ6wG) ## The scope: everything The first thing to check on any ISO 27001 certificate is the scope statement, because a certificate can be narrower than the company behind it. A provider can certify its office IT and leave the product out, or certify one data centre and not the others. Ours covers the whole of AhaSend: the email platform and every component that handles your mail, from the API and SMTP endpoints through our mail servers to delivery; the dashboard; the infrastructure in all five of our European sites; the people who build and operate it; and the processes around all of that, from access control and change management to incident response and supplier management. There is no part of the service that sits outside the certified system. ## What the auditor looked at ISO 27001 is not a checklist you fill in. It requires an information security management system, a documented way of deciding what the risks are, which controls address them, and how you check that those controls keep working. The auditor reviews the documentation, then asks for evidence that the controls are applied in practice: access logs, change records, incident tickets, supplier assessments, training records, the results of our own internal audits. A few of the things that were tested rather than described: who can reach production systems and how that access is granted and revoked; how changes to the platform are reviewed and deployed; how we detect and handle security incidents; how encryption is applied to data in transit and at rest; how we evaluate the datacentre providers we depend on; and how we make sure the controls do not quietly decay between audits. Running our own platform in European datacentres made part of this simpler, because there are fewer parties and fewer assumptions to document. It also meant more of the controls were ours to prove rather than a hyperscaler's to attest. ## What it changes for you For your email, nothing. It is delivered the way it was last month. What changes is what you can show. If your company runs vendor reviews, you can now point to the certificate in the [Trust Center](https://trust.ahasend.com/) instead of asking us to fill in a questionnaire from scratch. The Trust Center also lists our controls and their current status, our sub-processors and our policies, so most of the questions a security team asks are answered before they are asked. Together with our ready-to-sign [DPA](https://ahasend.com/dpa) and the fact that all processing stays within the EU and EEA, this is the set most reviewers need. If you build a product that sends email for your own customers, as a SaaS platform, an agency or a hosting provider, their security questions become your security questions. Being able to say that your email provider is ISO 27001 certified, with a scope that covers the service you actually use, answers a question that your customers increasingly put to you. And if you are a developer who picked AhaSend for the API and the European hosting, this is confirmation from an outside party that the security story behind it holds up. ## What is next ISO 27001 certification is not a one-off. The certificate runs for three years, with a surveillance audit by Procertify after twelve months and again after twenty-four, followed by a full recertification audit in 2029. So the system has to keep working rather than look good once. Questions about the certificate, the scope, or how we handle your data? The [Trust Center](https://trust.ahasend.com/) has the documents, and support@ahasend.com reaches the people who wrote them.