ISO/IEC 27701: which SaaS vendors say they are certified

48 of the 148 vendors whose certification pages we read list ISO/IEC 27701. Here is what each one states: the standard as it writes it, the scope, whether a certificate or report can be seen, and where and when we read it. Last read on 2026-11-09.

Vendor by vendor

"Certificate published": the vendor links the certificate itself. "Report on request": the vendor offers the certificate or audit report to customers or under NDA, usually through its trust centre. "Stated": the vendor names the standard and links nothing behind it. 16 of the vendors still name the 2019 edition.

What ISO/IEC 27701 is

ISO/IEC 27701 specifies a privacy information management system (PIMS): how an organisation that processes personal data, as a controller, a processor or both, governs that processing. Its first edition, from 2019, was an extension to an ISO/IEC 27001 information security management system. The 2025 edition is a management system standard in its own right. (ISO)

It is not a GDPR certification. Certifications under Article 42 GDPR are approved by data protection authorities or the EDPB, which keeps the register of them; ISO/IEC 27701 is not on it. A certificate is still evidence a processor can offer for its Article 28 duties, within its scope.

Vendors whose list does not include it

We read the certification pages of these 100 vendors and found no mention of ISO/IEC 27701. That is what their pages say, not proof that no certificate exists: 3DS Outscale, ActiveCampaign, Adobe, Adyen, Aircall, Amplitude, Anthropic, Apollo.io, Atlassian, Attio, Backblaze, Bitwarden, Bleu, Box, Brevo, Calendly, Canva, Cisco Webex, Clay, CrowdStrike, Cursor, DeepL, Deepgram, Delos Cloud, DigitalOcean, Docusign, Doodle, Drata, Elastic Cloud, Element, Eventbrite, GitHub, GitLab, Google Analytics, Grafana Labs, Granola, Hetzner, Hostinger, HubSpot, IONOS Cloud, Infomaniak, JetBrains, Jotform, Kahoot!, Klaviyo, Langdock, Lovable, Mailchimp, Mailgun, Make, Mapbox, Mentimeter, Miro, Mollie, MongoDB, Mural, Netlify, New Relic, Nextcloud, Okta, OpenRouter, Optimizely, PayPal, Pennylane, Perplexity, Personio, Piwik PRO, Pleo, PostHog, Proton, Retool, Rippling, S3NS, STACKIT, STRATO, Scaleway, Sentry, Shopify, Sinch, Snowflake, Spendesk, Squarespace, Stripe, Supabase, T Cloud Public, TeamViewer, Tresorit, Twilio, Typeform, Vanta, Vercel, Vonage, WeTransfer, Webflow, WhatsApp Business, Wix, Xero, Zapier, iubenda, n8n.

Questions

Which SaaS vendors are ISO 27701 certified?

Of the 148 vendors whose certification pages this registry reads, 48 list ISO/IEC 27701: DATEV, Dropbox, Grammarly, KnowBe4, netcup, OneTrust, Slack, Zendesk, ClickHouse, ClickUp, Docker, ElevenLabs, Mistral AI, Mixpanel, OpenAI, Qualtrics, Usercentrics, Vimeo, Zoho, 1Password, Airtable, Amazon Web Services, Asana, AWS European Sovereign Cloud, Cloudflare, Contentsquare, Databricks, Datadog, Figma, Freshworks, Gong, Google Cloud, Google Workspace, Intercom, Lusha, Microsoft, monday.com, Notion, Oracle Cloud, OVHcloud, Pipedrive, Smartsheet, SurveyMonkey, Wire, Workday, Zoom, ZoomInfo, Zscaler. 8 publish the certificate, 11 provide the audit report or certificate on request, and 29 state it without a public document.

How can I check a vendor's ISO 27701 claim?

Ask for the certificate and check three things on it: the certification body and whether it is accredited for ISO/IEC 27701, the scope (which products, sites and processing it covers), and the expiry date. A vendor that publishes its certificate lets you do this before you ask.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “ISO/IEC 27701: what SaaS vendors state”, https://eucsoft.com/en/certifications/iso-27701/, data read up to 2026-11-09.

How this was read

Each week the registry reads every vendor's certification or trust centre page and records each standard it lists, quoted as written, with the scope and any validity date it gives. A listing that changes waits for a person's review before it reaches this page. Other standards: ISO/IEC 42001, ISO/IEC 27017, ISO/IEC 27018, BSI C5, TISAX, SOC 2;SecNumCloud, from ANSSI's list; the other national cloud schemes (C5, ENS, HDS) are on the certifications page. Full method on the methodology page.