Key takeaways
- Very few GEO and AI visibility platforms publish their own ISO 27001 certificate. SOC 2 Type II is far more common, so many enterprise shortlists quietly drop the ISO requirement.
- Promptwatch, Conductor and BrightEdge are the clearest cases of own-certificate claims in the research. seoClarity and Similarweb also show signals that need checking against primary documents.
- "Aligned with" or "compliant with" ISO 27001 is not certification. Ask for the certificate, scope, Statement of Applicability and accrediting body.
- A certificate inherited from AWS or Google Cloud covers the data center, not the vendor's own information security management system (ISMS).
- SSO, SCIM and audit logs often sit behind enterprise tiers, so certification alone does not tell you what your team will get.
Why ISO 27001 matters for GEO tools
GEO platforms are not harmless dashboards. They store thousands of prompts that reveal your product strategy, competitor lists, brand claims, and sometimes server log data from your own site. Procurement and security teams at banks, insurers, healthcare groups and large SaaS companies will ask about this before anyone signs.
ISO/IEC 27001 is the international standard for an information security management system. The current version is ISO/IEC 27001:2022, which has 93 Annex A controls in four themes. The transition period for 2013 certificates ended on October 31, 2025, so any certificate you are shown today should reference the 2022 version. Amendment 1:2024 adds a climate-change consideration, which is a useful detail for spotting a current document.
A certificate is valid for three years, with annual surveillance audits. Stage 1 is a documentation review. Stage 2 tests whether the controls actually work. That is a harder bar than a marketing badge, and it is why the certificate itself, not the logo, is the thing to ask for.
How ISO 27001 differs from SOC 2
Most published enterprise GEO comparisons grade vendors on SOC 2 Type II. NoGood's May 2026 guide, for example, gives enterprise readiness 20% of its score and lists SOC 2 Type II for Goodie, Scrunch and Profound (Profound also has a HIPAA assessment). It lists no ISO 27001 for any tool.
That is useful context, not a flaw. SOC 2 is an attestation report popular with US buyers. ISO 27001 is a certification issued by an accredited body and is the more common requirement in Europe, the Middle East and Asia, and in any procurement process that follows an international vendor questionnaire. If your RFP says ISO 27001, SOC 2 alone will not satisfy it.
Which GEO tools hold ISO 27001?
Here is the honest state of the evidence. I could not verify most of this on the vendors' own trust pages, and no independent registry data (such as IAF CertSearch) turned up for these companies. Treat the table as a starting point for your own due diligence.
One more caveat. The most detailed source on this topic is a first-party October 2026 post from Promptwatch, which is itself in the comparison. It checked 17 platforms on October 26, 2026 against public trust pages and third-party security directories. I have cross-checked what I could with other sources and flagged the rest.
| Platform | ISO 27001 status found | Other security signals | Confidence |
|---|---|---|---|
| Promptwatch | Own certificate, issued Oct 26, 2026 | GDPR, EU-based company | Vendor-published, certificate details available |
| Conductor | Own certificate (ISO 27001:2022) | SOC 2 Type II, ISO 42001, SAML SSO, annual pen tests | Own security center plus third-party summaries |
| BrightEdge | Own certificate on trust page | SOC 2, ISO 27701, ISO 42001 | Trust page plus third-party summary |
| seoClarity | Trust page reportedly references ISO 27001:2022 | ISO 42001, ISO 27701, SOC 2 status conflicting | Verify before relying |
| Similarweb | Third-party directory listing | Not covered here | Verify |
| Addlly AI | Press release claims SOC 2 and ISO 27001 | Lesser-known vendor | Vendor claim only |
| Ahrefs | Reported in a third-party case study | Not covered here | Reported only |
| Profound | Not found on public pages | SOC 2 Type II, HIPAA assessment, SAML/OIDC SSO, SCIM, audit logs | No ISO evidence |
| Scrunch | Not found on public pages | SOC 2 Type II, audit logs, public trust center | No ISO evidence |
| AthenaHQ | Not found on public pages | Says "SOC II", type not stated | No ISO evidence |
| Otterly | Lists AWS data-center certifications | Hosted on AWS Frankfurt, SAML on Enterprise | Inherited only |
| Peec AI | Not found | GDPR-first, SAML 2.0, Google Cloud (Ireland) | No ISO evidence |
| Semrush | Not found on public pages | SOC 2 on enterprise page, PCI DSS Level 1 | No ISO evidence |
Not finding a certificate on a public page does not prove it does not exist. It means you should ask. Several of these vendors may be mid-audit.
The shortlist
Promptwatch
Promptwatch is the one platform in this group where I can point to a specific certificate. According to its own October 2026 post, it holds ISO/IEC 27001:2022 + Amd1:2024, certificate number 27001 26102026.2, issued by ProCertify B.V. (Apeldoorn), which is accredited by the Dutch Accreditation Council (RvA, registration C 707). It was first issued October 26, 2026 and is valid until October 26, 2029, with annual surveillance audits. The scope covers the ISMS for development, implementation and customer support of the Promptwatch SaaS platform, against a Statement of Applicability v1.0 dated September 14, 2026.
Two things make this more than a badge. First, the scope is for the vendor's own platform, not a hosting provider's. Second, it covers the data a GEO tool actually holds: tracked prompts, collected AI answers and citations, and crawler log records limited to 10 fields per bot request. The company is also GDPR compliant and handled by an EU-based company, which helps with European procurement.
The security story would be irrelevant if the product were thin, so here is what you get. Promptwatch tracks ChatGPT, Gemini, Claude, Perplexity, Google AI Overviews, Google AI Mode, Copilot and other engines from the real interfaces, then goes past monitoring: IP-verified AI crawler logs, a Content Agent that writes and publishes to WordPress, Webflow or Framer, an Action Board, and visitor analytics to measure what AI traffic converts. Roles (owner, editor, viewer), scoped API keys and an organization audit log are available, with SSO and a white-label client portal on Enterprise. The audit log starts on the Business plan at $579/mo.
The reasonable skepticism: the claim that it is the only AI-native platform of the 17 with its own certificate comes from Promptwatch itself, and the certificate is only days old as of this writing. Ask for the PDF and the SoA like you would from anyone else. Confirm current pricing at promptwatch.com/pricing, then start with the 7-day free trial or book a demo and send your security questionnaire in parallel.
Conductor
Conductor's security center lists SOC 2 Type II, ISO 27001:2022, ISO 42001, SAML SSO and annual third-party penetration tests. That is the most complete public security stack in this comparison, and it comes from an established enterprise SEO vendor. The trade-off is that Conductor's roots are in traditional enterprise SEO and content workflows, so evaluate its AI engine coverage and pricing on their own merits. Pricing is typically custom.
BrightEdge
BrightEdge lists an ISO 27001 certificate on its own trust page, and Qvery's summary adds SOC 2, ISO 27701 and ISO 42001. One flag from Qvery: BrightEdge's pages do not name Google AI Mode, so check engine coverage against your priority surfaces before you assume parity with AI-native tools.
seoClarity
seoClarity's trust page reportedly references ISO/IEC 42001, ISO 27001:2022 and ISO 27701. The SOC 2 picture conflicts: one search snippet said SOC 2 was "in progress but not yet complete," while the scraped page showed a "SOC 2 Audit Compliant" badge. I would not state either as fact. Ask for the report date and the certificate.
Similarweb
Similarweb appears with an ISO 27001 listing in a third-party directory. That is a lead, not proof. It is a broad market intelligence platform rather than a specialist GEO tool, which may or may not fit your use case.
Strong tools without public ISO 27001 evidence
These vendors may still pass your security review. They just do not show an ISO 27001 certificate on public pages that I could find.
Profound
Profound has the deepest published enterprise controls in the AI-native group: SOC 2 Type II, a HIPAA assessment, SAML or OIDC SSO on Enterprise, customer audit logs (added August 7, 2026) and SCIM (added August 21, 2026). One wrinkle: some pages say SOC 2 "compliant" and others say "certification," so ask which it is. G2 shows 4.5 from 1,130 reviews as of late September 2026. If your requirement is SOC 2 and HIPAA rather than ISO, this is a strong candidate. The head-to-head is at Promptwatch vs Profound.
Scrunch
Scrunch holds SOC 2 Type II, has four user roles, audit logs and a public trust center. SAML and OIDC are Enterprise-only. Sitecore announced its acquisition of Scrunch in June 2026, so ask how that changes hosting, certification scope and data processing agreements. Core starts at $250 with five seats, per Qvery. See Promptwatch vs Scrunch.
AthenaHQ
AthenaHQ says "SOC II" without stating the type. That distinction matters, since Type I is a point-in-time snapshot and Type II covers a period. Get the report.
Otterly and Peec AI
Otterly lists the certifications of its AWS data centers (SOC 1, SOC 2, ISO 27001) alongside its own materials, which is the inherited-certificate pattern described below. It is hosted in AWS Frankfurt, with SAML on Enterprise. Peec AI is GDPR-first, hosted on Google Cloud through Google Ireland, supports SAML 2.0 only, and states no SOC 2 or ISO certification. Both are good for focused monitoring, but neither will satisfy a strict ISO 27001 requirement today.
Semrush
Semrush mentions SOC 2 on its enterprise page only, has PCI DSS Level 1, pen tests and DPAs, and offers SAML on the Guru and Business plans. No ISO 27001 certificate surfaced on public pages.
Inherited certificates are the biggest trap
This is the most common mistake I see in security reviews of SaaS tools. A vendor hosted on AWS or Google Cloud can truthfully say its infrastructure is ISO 27001 certified. That certificate covers the data center and the cloud provider's own ISMS. It says nothing about how the vendor handles access control, change management, incident response or employee offboarding.
Otterly's pages list its AWS data centers' certifications, and the Rework comparison confirms this. That is honest as far as it goes. It is just not the same as holding your own certificate.
Similar fuzzy language to watch for:
- "Aligned with ISO 27001"
- "Compliant with ISO 27001"
- "Built on ISO 27001 principles"
- "In progress" or "pursuing"
None of those is a certification. The Promptwatch post makes the same point, and it is correct whoever is saying it.
Buyer checklist for a GEO security review
Ask every vendor on your shortlist for these, in this order:
- The ISO 27001 certificate itself, with the 2022 version and the accredited certification body named.
- The scope statement. Does it cover the SaaS platform you will use, and the support function that will see your data?
- The Statement of Applicability and its date.
- The latest penetration test summary.
- The data processing agreement and the hosting region.
- SSO, SCIM, RBAC and audit log availability by plan tier. Many vendors lock these behind Enterprise, and pricing is often custom.
- What data is stored. Prompts, responses, citations and crawler logs carry different risk, and you should know which ones the vendor retains and for how long.
Check the accreditation body as well. A certificate from an accredited body like the Dutch RvA is verifiable. One from an unknown issuer is worth a second look. The ISO Survey 2022 counted over 70,000 certificates in 150 countries, so verification is routine for security teams.
Also check where buyers will look. Promptwatch's October 2026 software citation data (Sep 28 to Oct 4, 2026) shows documentation and help centers have the largest source-type share in ChatGPT's software answers at 2.64%, ahead of vendor sites at 2.01%. G2, Gartner, Capterra and Software Advice together earn 1.57%. In practice, a vendor's trust page and G2 profile are likely where your own buyers and your own security team start. Verify any claim there against the primary certificate.
How to read published "best enterprise GEO" lists
Be a little cynical here. The Meikai, Botric and ziptie.ai guides are published by vendors that rank themselves, and NoGood's list comes from an agency that implements these tools for clients. Ziptie states that it ranks itself first. None of that makes the information wrong, but it means rankings reflect the author's interests. Use them to find candidates, then verify security claims yourself.
Meikai's own framing is worth borrowing: public capability pages are useful shortlist evidence, but they cannot establish data quality, implementation fit or how a platform will work inside your organization. The same applies to security pages.
Which tool for which requirement
| Your requirement | Best starting point | Why |
|---|---|---|
| ISO 27001 certificate from an AI-native GEO platform | Promptwatch | Own certificate, AI-native platform with content execution |
| ISO 27001 plus a broader enterprise SEO suite | Conductor or BrightEdge | Both publish ISO claims on their own pages |
| SOC 2 Type II plus HIPAA | Profound | Published HIPAA assessment, SSO, SCIM, audit logs |
| SOC 2 Type II with AI-ready content serving | Scrunch | Public trust center, audit logs |
| Focused monitoring, GDPR-first | Peec AI | EU hosting, simple analytics |
| Existing SEO suite and procurement relationship | Semrush or seoClarity | Easier vendor onboarding, verify certificates |
If you need to widen the net beyond these names, the GEO software directory at bestgeosoftware.com lists many more platforms, and you can run each through the same checklist.
Beyond certification: does the tool do the job?
A certificate gets a vendor through the security gate. It does not tell you whether the product moves your visibility. Once a tool clears the checklist, test it on three things.
First, data source. Some tools collect answers through APIs, which can differ from what users see in the actual interface. Real-UI collection matters for citations and shopping recommendations.
Second, diagnosis. Can the tool separate a crawl-access problem from a content problem? IP-verified crawler logs answer that question, and many monitoring tools lack them entirely.
Third, execution. Does the platform help you fix gaps, or just report them? Most dashboards stop at reporting. If your team is small, that gap is where the budget goes.
A practical procurement plan
- Write your hard requirements down first: ISO 27001, SOC 2 Type II, HIPAA, EU data residency, SSO. Separate must-haves from nice-to-haves.
- Pick four or five vendors that plausibly meet them, using the table above.
- Send the checklist before any demo. Vendors who answer quickly with documents are telling you something.
- Run a two-week pilot on a single monitor with 30 to 50 real prompts, in the markets you care about.
- Reconfirm the certificate's validity dates and scope at contract signature, and ask for the next surveillance audit date.
One last honest note: I could not verify any of these claims on the vendors' trust pages directly, and the certificate landscape here is moving fast. A vendor that has nothing today may have a certificate by the time your contract is up for renewal. Ask again then.
For teams that want a human partner to run the vendor evaluation and the optimization work itself, 1001 SEO Media is the agency behind this site and works with Promptwatch for AI visibility.