How it plays out on a deal
ISO 27001 is often required by European buyers and by banks that use it internally. Where SOC 2 reports on controls over a period, ISO 27001 certifies the management system that chooses and maintains those controls.
The certificate itself is short; the scope statement matters most. Check that it names the data room service and the locations that run it. A certificate that covers only a parent company's head office, or a data center operator, says little about the room you will use.
What to check in a review or demo
- 1Whether the certificate scope names the data room service.
- 2The issuing body, issue date and expiry, and whether it is accredited.
- 3Whether related standards, such as ISO 27017 or 27018 for cloud services, are also held.
ISO 27001: where the reviewed providers stand
Based on the certifications and attestations each provider lists publicly, as recorded in our review data. Ask for the current report or certificate and check its scope before relying on it.
Yes (12)
iDealsSOC 2 and ISO 270019.1/10
DatasiteSOC 2 and ISO 270018.9/10
AnsaradaSOC 2 and ISO 270018.6/10
IntralinksSOC 2 and ISO 270018.6/10
FirmexSOC 2 and ISO 270018.5/10
DroomsSOC 2 and ISO 270018.3/10
SmartRoomSOC 2 and ISO 270018.2/10
BoxSOC 2 and ISO 27001 and HIPAA8.1/10
Citrix ShareFileSOC 2 and ISO 27001 and HIPAA8.0/10
DealRoomSOC 2 and ISO 270018.0/10
ShareVaultSOC 2 and ISO 270017.7/10
Venue by DFINSOC 2 and ISO 270017.2/10
No (6)
ElltySOC 2 Infrastructure9.2/10
CapLinkedSOC 27.7/10
SecureDocsSOC 27.7/10
OnehubSOC 27.5/10
DigifySOC 26.9/10
DocSendSOC 26.6/10
12 of 18 reviewed providers qualify. Each chip shows the provider's overall review score.
Read alongside
- SOC 2An attestation from a licensed CPA firm, under AICPA rules, that a software company's security controls are designed well (Type I) or also worked over several months (Type II).
- GDPRThe EU's privacy law since 2018.
- Data residencyWhich jurisdiction physically hosts a room's files, and whether the customer can pick it, for instance an EU, UK, US or Australian region chosen when the room is created.
- Penetration testingA hired security team tries to break into the platform with the owner's permission, then reports the holes it found so they can be closed.