ISO/IEC 27018: which cloud and SaaS vendors say they are certified
46 of the 149 vendors whose certification pages we read list ISO/IEC 27018. Here is what each one states: the standard as it writes it, the scope, whether a certificate or report can be seen, and where and when we read it. Last read on 2026-11-09.
Vendor by vendor
| Vendor | As listed | What can be seen | Scope, as written | Valid until | Read |
|---|---|---|---|---|---|
| Dropbox | ISO 27018 | Certificate published | Dropbox Standard, Advanced, Enterprise and Education | — | 2026-10-05 |
| Grammarly | ISO/IEC 27018:2019 | Certificate published | protection of personally identifiable information (PII) in the cloud | — | 2026-11-09 |
| Netlify | ISO/IEC 27018:2019 | Certificate published | Certified controls for protecting personal data in public cloud services. | — | 2026-11-02 |
| Slack | ISO/IEC 27018 | Certificate published | Protection of Personally Identifiable Information (PII) | — | 2026-10-04 |
| STACKIT | ISO 27018 | Certificate published | data protection (PII) | — | 2026-10-19 |
| Zendesk | ISO 27018:2019 | Certificate published | not stated | — | 2026-10-05 |
| ClickUp | ISO 27018:2019 | Report on request | not stated | — | 2026-10-08 |
| Drata | ISO/IEC 27018:2025 | Report on request | not stated | — | 2026-11-09 |
| ElevenLabs | ISO 27018:2019 | Report on request | not stated | — | 2026-10-25 |
| OpenAI | ISO/IEC 27018:2019 | Report on request | additional control sets, per the ISO/IEC 27001 certificate for OpenAI’s API, ChatGPT Enterprise, and ChatGPT Edu services | — | 2026-10-05 |
| Optimizely | ISO/IEC 27018: 2019 | Report on request | Content Management System (CMS), Commerce Connect, Web & Feature Experimentation Services | — | 2026-11-09 |
| Qualtrics | 27018 | Report on request | not stated | — | 2026-10-25 |
| Rippling | ISO 27018 | Report on request | not stated | — | 2026-11-09 |
| Snowflake | 27018 | Report on request | not stated | — | 2026-10-04 |
| Zoho | ISO/IEC 27018 | Report on request | All Cloud Services of Zoho, ManageEngine, Qntrl, Ulaa Browser, Arattai and TrainerCentral. | 2028-08-21 | 2026-10-08 |
| 1Password | 27018:2019 | Stated | not stated | — | 2026-11-09 |
| 3DS Outscale | ISO 27018 | Stated | protection measures for personal data processed in the cloud | — | 2026-10-08 |
| Adobe | ISO 27018 | Stated | not stated | — | 2026-10-09 |
| Amazon Web Services | 27018:2019; ISO 27018; SNI 27018 | Stated | not stated | — | 2026-11-09 |
| Asana | ISO/IEC 27018:2019 | Stated | Code of practice for protecting personally identifiable information (PII) | — | 2026-10-05 |
| Atlassian | ISO 27018 | Stated | not stated | — | 2026-10-19 |
| AWS European Sovereign Cloud | ISO 27018 | Stated | not stated | — | 2026-11-09 |
| Cloudflare | ISO 27018:2019 | Stated | not stated | — | 2026-10-26 |
| Contentsquare | ISO 27018 | Stated | not stated | — | 2026-10-08 |
| Databricks | ISO 27018 | Stated | not stated | — | 2026-11-09 |
| Datadog | ISO/IEC 27018:2019 | Stated | not stated | — | 2026-10-05 |
| Elastic Cloud | ISO/IEC 27018 | Stated | not stated | — | 2026-10-08 |
| Figma | ISO/IEC 27018:2019 | Stated | its product and services | — | 2026-10-04 |
| GitLab | ISO/IEC 27018:2019 | Stated | GitLab software-as-a-service (SaaS) subscriptions, GitLab.com and GitLab Dedicated | — | 2026-10-05 |
| Gong | ISO/IEC 27018; ISO/IEC 27018:2019 | Stated | covering cloud security and the protection of PII in cloud environments | — | 2026-10-25 |
| Google Cloud | ISO/IEC 27018 | Stated | GLOBAL | — | 2026-10-05 |
| Google Workspace | ISO/IEC 27018 | Stated | not stated | — | 2026-10-05 |
| KnowBe4 | International Organization for Standardization 27018:2019 Standard | Stated | protecting PII in the public cloud for data processors | — | 2026-10-08 |
| Microsoft | ISO 27018 | Stated | not stated | — | 2026-10-05 |
| monday.com | ISO/IEC 27018:2019 | Stated | not stated | — | 2026-10-05 |
| MongoDB | ISO 27018 | Stated | not stated | — | 2026-10-04 |
| Notion | ISO 27018 | Stated | privacy by design across the data lifecycle | — | 2026-10-19 |
| Okta | ISO/IEC 27018:2019 | Stated | not stated | — | 2026-10-05 |
| Oracle Cloud | ISO/IEC 27018 | Stated | not stated | — | 2026-10-08 |
| Salesforce | ISO/IEC 27018:2019 | Stated | Salesforce Services (First Party) | — | 2026-11-09 |
| T Cloud Public | ISO 27018 | Stated | T Cloud Public | — | 2026-10-08 |
| Twilio | ISO/IEC 27018:2019 | Stated | not stated | — | 2026-10-05 |
| Typeform | 27018; ISO 27018:2019 | Stated | ISO/IEC 27018; scheduled surveillance audit | — | 2026-10-05 |
| Webflow | ISO 27018 | Stated | not stated | — | 2026-10-09 |
| Workday | ISO/IEC 27018:2019 | Stated | Information Security Scope (ISO 27001, 27017, 27018): Adaptive Planning, Analytics and Reporting, Contract Lifecycle Management (CLM) and Contract & Document Intelligence, Financial Management, HiredScore, Human Capital Management, Payroll, Peakon, Platform and Product Extensions, Spend Management, Student, Talent Management, Workforce Management, and Sana (Core/Enterprise, Learn, Agents). | — | 2026-10-08 |
| Zscaler | ISO/IEC 27018:2019 | Stated | not stated | — | 2026-11-09 |
"Certificate published": the vendor links the certificate itself. "Report on request": the vendor offers the certificate or audit report to customers or under NDA, usually through its trust centre. "Stated": the vendor names the standard and links nothing behind it.
What ISO/IEC 27018 is
ISO/IEC 27018 is a code of practice for public cloud providers that process personally identifiable information as processors. It adds guidance for that role to the ISO/IEC 27002 controls. The current edition is from 2025 and replaced the 2019 edition. (ISO)
It is guidance, not a management system standard of its own, so a provider is normally audited to ISO/IEC 27001 with the 27018 controls included in the scope. That is why vendors often list it next to ISO/IEC 27001 and 27017.
Vendors whose list does not include it
We read the certification pages of these 103 vendors and found no mention of ISO/IEC 27018. That is what their pages say, not proof that no certificate exists: ActiveCampaign, Adyen, Aircall, Airtable, Amplitude, Anthropic, Apollo.io, Attio, Backblaze, Bitwarden, Bleu, Box, Brevo, Calendly, Canva, Cisco Webex, Clay, ClickHouse, CrowdStrike, Cursor, DATEV, DeepL, Deepgram, Delos Cloud, DigitalOcean, Docker, Docusign, Doodle, Element, Eventbrite, Freshworks, GitHub, Google Analytics, Grafana Labs, Granola, Hetzner, Hostinger, HubSpot, IONOS Cloud, Infomaniak, Intercom, JetBrains, Jotform, Kahoot!, Klaviyo, Langdock, Lovable, Lusha, Mailchimp, Mailgun, Make, Mapbox, Mentimeter, Miro, Mistral AI, Mixpanel, Mollie, Mural, New Relic, Nextcloud, OVHcloud, OneTrust, OpenRouter, PayPal, Pennylane, Perplexity, Personio, Pipedrive, Piwik PRO, Pleo, PostHog, Proton, Retool, S3NS, STRATO, Scaleway, Sentry, Shopify, Sinch, Smartsheet, Spendesk, Squarespace, Stripe, Supabase, SurveyMonkey, TeamViewer, Tresorit, Usercentrics, Vanta, Vercel, Vimeo, Vonage, WeTransfer, WhatsApp Business, Wire, Wix, Xero, Zapier, Zoom, ZoomInfo, iubenda, n8n, netcup.
Questions
Which SaaS vendors are ISO 27018 certified?
Of the 149 vendors whose certification pages this registry reads, 46 list ISO/IEC 27018: Dropbox, Grammarly, Netlify, Slack, STACKIT, Zendesk, ClickUp, Drata, ElevenLabs, OpenAI, Optimizely, Qualtrics, Rippling, Snowflake, Zoho, 1Password, 3DS Outscale, Adobe, Amazon Web Services, Asana, Atlassian, AWS European Sovereign Cloud, Cloudflare, Contentsquare, Databricks, Datadog, Elastic Cloud, Figma, GitLab, Gong, Google Cloud, Google Workspace, KnowBe4, Microsoft, monday.com, MongoDB, Notion, Okta, Oracle Cloud, Salesforce, T Cloud Public, Twilio, Typeform, Webflow, Workday, Zscaler. 6 publish the certificate, 9 provide the audit report or certificate on request, and 31 state it without a public document.
How can I check a vendor's ISO 27018 claim?
Ask for the certificate and check three things on it: the certification body and whether it is accredited for ISO/IEC 27018, the scope (which products, sites and processing it covers), and the expiry date. A vendor that publishes its certificate lets you do this before you ask.
Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “ISO/IEC 27018: what SaaS vendors state”, https://eucsoft.com/en/certifications/iso-27018/, data read up to 2026-11-09.
How this was read
Each week the registry reads every vendor's certification or trust centre page and records each standard it lists, quoted as written, with the scope and any validity date it gives. A listing that changes waits for a person's review before it reaches this page. Other standards: ISO/IEC 42001, ISO/IEC 27701, ISO/IEC 27017, BSI C5, TISAX, SOC 2;SecNumCloud, from ANSSI's list; the other national cloud schemes (C5, ENS, HDS) are on the certifications page. Full method on the methodology page.