We recently shared our SOC 2 Type 2 renewal, independently verified controls, an upgraded infrastructure stack, and a live trust page at trust.lamatic.ai. Today we're adding another milestone: Lamatic.ai is now ISO 27001:2022 certified, the global gold standard for information security management.

The attestation and certification work together. SOC 2 proves our specific security controls worked. ISO 27001 demonstrates we have a system in place to continuously improve them, not just during an audit window.

Plain and simple: it means security at Lamatic isn't a checklist. It's a managed program.

ISO 27001 requires us to continuously identify risks, treat them, audit ourselves, and improve, with leadership accountable for every step. The 2022 revision (the version we're certified to) is the most current, and it introduced 11 new controls specifically designed for cloud and SaaS businesses like ours, covering areas like threat intelligence, cloud service security, data masking, and secure coding.

Here's what that looks like in practice for a Lamatic customer:

Your data is covered by a living risk program: not a static policy document from three years ago. We maintain a risk register with named owners and documented treatment decisions, reviewed on a defined schedule.

Full transparency about our controls: ISO 27001 requires a Statement of Applicability that covers all 93 Annex A controls. Every control is documented: whether it applies to Lamatic, how it's implemented, and why anything is excluded. You can request it.

Security is owned at the top: The standard requires leadership to formally own the ISMS rather than delegate it. We run management review meetings with documented decisions on risk trends, incidents, and improvement priorities.

We audit ourselves year-round: Internal audits run as a standing program, not a pre-certification scramble. We track every finding to closure with evidence.

Problems get fixed properly: We log every non-conformity, determine the root cause and close it with documented remediation. Gaps aren't filed and forgotten.

You get documentation that supports your own audits: Our policies across access control, incident response, change management, supplier security, and secure development are available to support your vendor due diligence.

Certification is straightforward if you're willing to build the right habits. Here's what we changed internally that made the difference:

Everyone is part of the audit process: Security compliance isn't owned by a single person or role. Every team member understands the policies relevant to their work, is involved in reviews, and signs off on their responsibilities. When the auditor asks questions, the whole team can answer, not just the person who filed the paperwork.

A centralized, shared policy system: All policies, procedures, and controls live in a single shared workspace accessible to everyone. Nothing lives in someone's personal Drive folder or a stale PDF. When a policy changes, everyone sees it. This sounds simple; it eliminates a surprising number of audit gaps.

Regular drills and incident simulations: We run tabletop exercises and incident response drills on a set schedule. These aren't checkbox activities; they surface real gaps in process and communication that only show up under pressure. Findings feed directly back into the ISMS improvement cycle.

Team security check-ins: We hold recurring security check-ins to review open risks, recent incidents, near-misses, and control gaps as a team. This keeps security visible and shared rather than siloed, and it means issues surface early rather than at the time of audit.

The combination of strong habits and automated tooling is what enables a lean team to run a certification program that holds up under scrutiny and continues to improve after the certificate is issued.

ISO 27001 doesn't certify a document library. It certifies that security is embedded in how your organization actually operates. Getting there required changes on both the human and technical side.

On the automation side, we deployed AI agents to maintain our policy library in Notion, keep the ISMS document index current, and cross-reference our implemented controls against the Statement of Applicability, flagging gaps before the external auditor ever saw them. The SoA itself, 93 controls with rationale, implementation status, and policy links, was maintained as a live database rather than a static spreadsheet. When a vendor changed or a policy was updated, we updated the affected controls accordingly.

The result: a compliance program that runs continuously, not just in the weeks leading up to an audit. This is exactly the workflow we're building into Lamatic for our customers.

Building a rigorous ISO 27001 certification program as a lean team requires the right partners. Here’s who we worked with and what role each played:

Prescient Assurance LLC is our accredited ISO 27001 certification body and independent auditor. They conducted our Stage 1 and Stage 2 ISO 27001:2022 audits, reviewed the design and operating effectiveness of our Information Security Management System (ISMS), and issued our formal certification.

Prescient’s team brought deep experience auditing modern SaaS and cloud-native companies. They validated our risk assessments, control implementations, internal audit program, and management review cycles against ISO 27001 requirements. Their work gave us a globally recognized certificate and a clear roadmap for continual improvement.

Vanta powers our ISO 27001 ISMS, automating control documentation, evidence collection, and continuous monitoring across all in-scope systems. It keeps our control posture current between Prescient’s surveillance audits and makes ongoing compliance sustainable, not a once-a-year scramble.

Our live trust page at trust.lamatic.ai is powered by Vanta and shows real-time control status to customers, partners, and auditors.

Aikido Security is our security testing and continuous control monitoring platform. Beyond vulnerability scanning, Aikido monitors developer devices, code repositories, and infrastructure, flagging issues in real time.

For ISO 27001, Aikido gave Prescient’s auditors a live, verifiable evidence trail for technical security controls (access management, secure development, vulnerability management) instead of point-in-time screenshots. You can request our Aikido security report directly at: app.aikido.dev/audit-report/external/IRDv0g4z5y2nHrcLQg5pqxCD/request

We know procurement checklists are real. Here's what we have ready:

Lamatic.ai is a product of Dinner Technologies, Inc. ISO 27001:2022 certification is issued in accordance with the requirements of ISO/IEC 27001:2022.