ISO/IEC 27017: which cloud and SaaS vendors say they are certified

48 of the 149 vendors whose certification pages we read list ISO/IEC 27017. Here is what each one states: the standard as it writes it, the scope, whether a certificate or report can be seen, and where and when we read it. Last read on 2026-11-09.

Vendor by vendor

"Certificate published": the vendor links the certificate itself. "Report on request": the vendor offers the certificate or audit report to customers or under NDA, usually through its trust centre. "Stated": the vendor names the standard and links nothing behind it.

What ISO/IEC 27017 is

ISO/IEC 27017 is a code of practice for information security controls for cloud services. It builds on the ISO/IEC 27002 controls with guidance for cloud service providers and their customers, and adds controls of its own: how responsibilities are split between provider and customer, removing a customer's assets when a contract ends, separating customers in virtual environments, hardening virtual machines, and monitoring cloud services. It was first published in 2015, jointly with ITU-T as Recommendation X.1631. (ISO)

It is guidance, not a management system standard of its own, so it is not certified alone. A certification body audits its controls as part of an ISO/IEC 27001 certification, and the certificate refers to them.

How it relates to an ISO/IEC 27001 scope

The certification body TÜV Rheinland describes a 27017 certificate as an extension of an ISO/IEC 27001 one (its ISO 27017 page, read on 3 November 2026): "ISO 27001 certification is therefore prerequisite for the extension to the ISO 27017 certificate." Vendors put it the same way. DATEV writes that its ISO 27001 information security management system was extended by ISO 27017: "Das DATEV Informationssicherheitsmanagementsystem nach ISO 27001 wurden erweitert um die ISO 27017 Informationssicherheit für Cloud Dienste" (source). OpenAI, in the note announcing its ISO/IEC 27001:2022 certificate: "Control implementation also conforms to additional control sets of ISO/IEC 27017:2015 and ISO/IEC 27018:2019" (source).

So the scope that matters is the ISO/IEC 27001 scope: which products, services and sites the certificate covers. All 48 vendors here also list ISO/IEC 27001 on the same page, and 42 list ISO/IEC 27018. 23 name the 2015 edition in their listing.

Vendors whose list does not include it

We read the certification pages of these 101 vendors and found no mention of ISO/IEC 27017. That is what their pages say, not proof that no certificate exists: ActiveCampaign, Adyen, Aircall, Airtable, Amplitude, Anthropic, Apollo.io, Atlassian, Attio, Backblaze, Bitwarden, Bleu, Box, Brevo, Calendly, Canva, Cisco Webex, Clay, ClickHouse, CrowdStrike, Cursor, DeepL, Deepgram, Delos Cloud, DigitalOcean, Docker, Docusign, Doodle, Element, Eventbrite, Freshworks, GitHub, Google Analytics, Grafana Labs, Granola, Hetzner, Hostinger, HubSpot, IONOS Cloud, Infomaniak, Intercom, JetBrains, Jotform, Kahoot!, Klaviyo, Langdock, Lovable, Mailchimp, Mailgun, Make, Mapbox, Mentimeter, Miro, Mistral AI, Mixpanel, Mollie, Mural, Netlify, New Relic, Nextcloud, Notion, OVHcloud, OpenRouter, PayPal, Pennylane, Perplexity, Pipedrive, Piwik PRO, Pleo, PostHog, Proton, Retool, Rippling, S3NS, STRATO, Scaleway, Sentry, Shopify, Sinch, Smartsheet, Spendesk, Squarespace, Stripe, Supabase, SurveyMonkey, TeamViewer, Tresorit, Usercentrics, Vanta, Vercel, Vimeo, Vonage, WeTransfer, WhatsApp Business, Wire, Wix, Xero, Zapier, iubenda, n8n, netcup.

Questions

Which SaaS vendors are ISO 27017 certified?

Of the 149 vendors whose certification pages this registry reads, 48 list ISO/IEC 27017: DATEV, Dropbox, Grammarly, OneTrust, Slack, STACKIT, Zendesk, ClickUp, Drata, ElevenLabs, OpenAI, Optimizely, Personio, Qualtrics, Snowflake, Zoho, 1Password, 3DS Outscale, Adobe, Amazon Web Services, Asana, AWS European Sovereign Cloud, Cloudflare, Contentsquare, Databricks, Datadog, Elastic Cloud, Figma, GitLab, Gong, Google Cloud, Google Workspace, KnowBe4, Lusha, Microsoft, monday.com, MongoDB, Okta, Oracle Cloud, Salesforce, T Cloud Public, Twilio, Typeform, Webflow, Workday, Zoom, ZoomInfo, Zscaler. 7 publish the certificate, 9 provide the audit report or certificate on request, and 32 state it without a public document.

How can I check a vendor's ISO 27017 claim?

Ask for the certificate and check three things on it: the certification body and whether it is accredited for ISO/IEC 27017, the scope (which products, sites and processing it covers), and the expiry date. A vendor that publishes its certificate lets you do this before you ask.

Can a vendor be certified to ISO 27017 without ISO 27001?

ISO/IEC 27017 is a set of controls, not a management system, so it is audited within an ISO/IEC 27001 certification. TÜV Rheinland, a certification body, writes: "ISO 27001 certification is therefore prerequisite for the extension to the ISO 27017 certificate." So check the ISO/IEC 27001 certificate too: the ISO 27017 controls apply within its scope. All 48 vendors here also list ISO/IEC 27001 on the same page.

Which vendors list both ISO 27017 and ISO 27018?

42 of the 48: Dropbox, Grammarly, Slack, STACKIT, Zendesk, ClickUp, Drata, ElevenLabs, OpenAI, Optimizely, Qualtrics, Snowflake, Zoho, 1Password, 3DS Outscale, Adobe, Amazon Web Services, Asana, AWS European Sovereign Cloud, Cloudflare, Contentsquare, Databricks, Datadog, Elastic Cloud, Figma, GitLab, Gong, Google Cloud, Google Workspace, KnowBe4, Microsoft, monday.com, MongoDB, Okta, Oracle Cloud, Salesforce, T Cloud Public, Twilio, Typeform, Webflow, Workday, Zscaler. ISO/IEC 27018 covers personal data processed in a public cloud, and is also audited within an ISO/IEC 27001 scope.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “ISO/IEC 27017: what SaaS vendors state”, https://eucsoft.com/en/certifications/iso-27017/, data read up to 2026-11-09.

How this was read

Each week the registry reads every vendor's certification or trust centre page and records each standard it lists, quoted as written, with the scope and any validity date it gives. A listing that changes waits for a person's review before it reaches this page. Other standards: ISO/IEC 42001, ISO/IEC 27701, ISO/IEC 27018, BSI C5, TISAX, SOC 2;SecNumCloud, from ANSSI's list; the other national cloud schemes (C5, ENS, HDS) are on the certifications page. Full method on the methodology page.