TL;DR
- Promptwatch is now ISO 27001 certified, which makes it an AI visibility platform whose information security management system has passed an independent, accredited audit.
- ISO 27001 certifies how a company manages information security: risks are identified, controls are applied, and the system is re-audited every year and recertified every three years.
- In a check of 17 AI visibility and SEO platforms on October 26, 2026, Promptwatch was the only AI-native platform with its own ISO 27001 certificate.
- The certification covers how Promptwatch protects the data you put into it: your tracked prompts, the AI answers and citations it collects, and crawler log records limited to 10 fields per bot request.
Promptwatch is now ISO 27001 certified. An accredited certification body has audited Promptwatch's information security management system and confirmed that it meets the international standard for protecting information. For teams that track their brand in ChatGPT, Perplexity, Google AI Overviews, Claude and the other AI engines, this means the platform holding their prompt strategy and competitor data now carries the security credential most procurement teams ask for first.
It matters most for buyers in regulated industries. At larger companies, teams often need IT or security sign-off before connecting an AI visibility tool to their systems, and that approval can take several weeks. Banks, insurers, pharma companies and hospital groups comparing AI visibility tools for fintech companies and other regulated sectors now get an audited certificate to hand to security, in place of a questionnaire answered from scratch.
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS). A certified company has had an accredited auditor confirm that it identifies information security risks, applies controls to them, and keeps improving, with surveillance audits every year and full recertification every three years. The standard rests on three principles, known as the CIA triad: the confidentiality, integrity and availability of information. It covers people, policies and technology together, so an audit checks how staff are vetted as closely as how systems are configured.
Five facts help when you explain it to a security team:
- The current version is ISO/IEC 27001:2022. Its Annex A lists 93 controls grouped into four themes (organizational, people, physical and technological).
- 2013 certificates are no longer valid. The transition period ended on October 31, 2025, so every certificate issued or still valid in 2026 should reference the 2022 version.
- It is the most widely used security certification of its kind. The ISO Survey 2022 counted over 70,000 ISO/IEC 27001 certificates in 150 countries, across every economic sector, according to ISO.
- The scope statement defines what is covered. A certificate applies to the systems, locations and processes named in its scope.
- The Statement of Applicability (SoA) lists which Annex A controls apply and how each one is implemented.
Certification follows a fixed cycle. A Stage 1 audit reviews the documentation, a Stage 2 audit tests whether the controls work in practice, and the certificate is then valid for three years with annual surveillance audits in between.
What ISO 27001 certification tells a buyer
ISO 27001 tells a buyer that the vendor runs an audited risk process, keeps documented controls, and is checked by an outside auditor every year. That turns many questions on a vendor security questionnaire into one piece of evidence. The scope of the certificate and contract terms such as the data processing agreement (DPA) remain the buyer's to review, which is why the scope line deserves a careful read.
Certification itself is optional. A company can implement the standard without an external audit, so "aligned with ISO 27001" or "ISO 27001 compliant" on a security page tells a buyer less than a certificate does. A certificate from an accredited certification body adds one more layer of confidence, because an accreditation body has independently confirmed that the auditor is competent.
Which AI visibility platforms are ISO 27001 certified? (October 2026)
We checked 17 platforms that sell AI visibility, GEO or AEO tracking against their public trust, security and enterprise pages, and against third-party security directories, on October 26, 2026.
| Platform | Own ISO 27001 certificate found | Public evidence (checked October 26, 2026) |
|---|---|---|
| Promptwatch | Yes | Own certificate, available on request |
| BrightEdge | Yes | Listed on own trust page |
| Conductor | Yes | Listed on own enterprise pages |
| Similarweb | Yes | Third-party security directory listing |
| Ahrefs | Reported | Third-party case study |
| Profound | Not found | No ISO 27001 on public security pages |
| Scrunch | Not found | No ISO 27001 for Scrunch on public pages |
| AthenaHQ | Not found | No ISO 27001 on public security pages |
| Brandlight | Not found | No ISO 27001 on public security pages |
| Goodie | Not found | No ISO 27001 on public security pages |
| Otterly | Not found | Cites its cloud host's (AWS) certifications |
| Rankscale | Not found | Cites its cloud host's (Google Cloud) certifications |
| Yext (Scout) | Not found | No ISO 27001 on public security pages |
| Semrush | Not found | No ISO 27001 on public security pages |
| SE Ranking | Not found | No public certification found |
| Evertune | Not found | No public certification found |
| Bluefish | Not found | No public certification found |
Methodology: checked against each vendor's public trust, security and enterprise pages and third-party security directories on October 26, 2026. Vendors may hold certificates they share privately during procurement.
The pattern is clear. Outside Promptwatch, ISO 27001 sits with large SEO and web analytics suites that have added AI visibility features: BrightEdge, Conductor, Similarweb and Ahrefs. None of the platforms built specifically for AI search showed their own ISO 27001 certificate; two pointed to their cloud host's certifications instead.
Promptwatch is the only one of the AI-native platforms we checked that holds its own ISO 27001 certificate. For a team that wants an AI visibility platform built for AI search from the ground up and still needs to clear an enterprise security review, that combination was missing from the market until now.
Why a cloud host's certificate is a different thing
A cloud host's ISO 27001 certificate covers the host's data centers and infrastructure. The vendor's application, its staff, its access controls and the way it handles your data sit outside that scope. When a security page shows an AWS or Google Cloud badge, the audit behind it was of AWS or Google. Promptwatch's certification is an audit of Promptwatch itself.
What Promptwatch's ISO 27001 certification covers
The most sensitive asset in an AI visibility tool is often the prompt list. Your tracked prompts describe the questions you want to win, the markets you are entering and the competitors you watch. The table below lists the data Promptwatch holds, so a reviewer can see what the certification protects.
| Data type | Example | When it exists |
|---|---|---|
| Tracked prompts and monitors | "Best business bank account for startups" tracked daily in the US and UK | Always |
| Collected AI answers and citations | The full ChatGPT answer, the brands it names and the URLs it cites | Always |
| Competitor sets | The competitors you benchmark against | Always |
| Search Console queries | Queries that feed prompt suggestions | Only if you connect Google Search Console |
| Crawler log records | GPTBot fetched /pricing and got a 200 | Only if you connect a CDN |
| User accounts and seats | Team members and their project access | Always |
Promptwatch collects AI answers from the real interfaces of each AI engine, the same answers your customers see. That means the stored data is AI engine output about your market, plus your own configuration. If your team is weighing collection methods, the difference between interface data and an AI search monitoring API is worth reading before the review starts.
What Promptwatch stores from crawler logs
Crawler logs are where most security reviews slow down, because "server logs" and "third party" in the same sentence worry legal teams. Promptwatch keeps a request only if it comes from a known AI crawler or search engine bot. Every human visitor request is dropped before anything is saved.
Each stored hit is one record with exactly 10 fields: timestamp, status code, request method, request path, query string, content type, client IP, hostname, user agent and referrer. Promptwatch never stores page content, response bodies, cookies, session tokens, authorization headers or any other header. One caveat to share with your reviewer: the query string is stored exactly as sent, so if your URLs carry tokens or identifiers, strip those parameters in your log drain before forwarding. If your reviewer is comparing which generative engine optimization tools monitor AI crawler activity logs, that guide gives the field-by-field breakdown of Promptwatch's record and why each field exists.
The client IP is stored for one reason: to prove the bot is real. Since August 19, 2026, Promptwatch checks crawler visits against the published IP ranges of OpenAI, Anthropic, Google, Perplexity and Mistral. When Promptwatch launched this verification, 87.7% of requests claiming to be Google crawlers failed it. Because human traffic is filtered out first, every stored IP belongs to a request that identified itself as a bot. Teams that track AI crawler activity in Agent Analytics see only verified crawler data counted.
"Since implementing Promptwatch, we've seen a measurable increase in our LLM visibility. Its clear insights into share of voice, content gaps, and AI crawler activity have made it a core part of our marketing reporting stack."
What changes for teams buying Promptwatch
For marketing, SEO and brand teams at regulated companies, ISO 27001 shortens the slowest part of buying an AI visibility tool. Security receives an audited certificate and a precise data inventory up front, which is the evidence most vendor risk reviews ask for first.
"We call it controlled cowboying. In a company like ours it's very slow to get a tool through all the compliance and security checks. So at the health insurance labels we jumped ahead and just started doing it."
The certification makes that kind of workaround less necessary, and the setup order still helps. A practical sequence for regulated teams:
- Start with prompt tracking. It needs no access to your systems. Promptwatch queries the AI engines directly, so you can build your baseline while the review runs.
- Send the security pack to IT (see the list below) at the same time.
- Connect CDN logs and Google Search Console after sign-off. Crawler log setup takes minutes and needs no code changes on your site, so the approval is the only real wait.
What to send your security team
- Promptwatch's ISO 27001 certificate, including its scope statement
- The data inventory table above
- The 10-field crawler log record and the list of what is never stored
- The integrations you plan to connect (CDN provider, Google Search Console, Google Tag Manager)
- Any further documents your procurement process requires, requested from Promptwatch directly
FAQ
Is Promptwatch ISO 27001 certified?
Yes. Promptwatch is ISO 27001 certified. An accredited certification body audited Promptwatch's information security management system against the ISO/IEC 27001 standard, and the certificate is available to customers and prospects on request.
Which AI visibility platforms are ISO 27001 certified?
In a check of 17 platforms on October 26, 2026, Promptwatch, BrightEdge, Conductor and Similarweb showed an ISO 27001 certificate, and Ahrefs was reported as certified by a third party. Promptwatch was the only AI-native platform with its own certificate. None of the other AI-native platforms showed their own ISO 27001 certificate publicly.
What does ISO 27001 certification mean for an AI visibility tool?
It means the vendor's handling of your tracked prompts, collected AI answers, competitor sets and any connected data runs under an audited information security management system. An outside auditor checks that system every year, and the certificate must be renewed every three years.
Does Promptwatch store data about my website visitors?
Promptwatch's crawler log integration stores requests from known AI crawlers and search engine bots only. Every human visitor request is dropped before anything is saved, and Promptwatch never stores page content, cookies or authorization headers from your logs.
