AI search visibility platform with ISO 27001 certification: a practitioner's note
Why security review matters when you pick an AI search visibility platform, what to ask vendors about ISO 27001, and why we run client work on Promptwatch.
Sooner or later, a client's security team gets involved. It happens most with larger companies, banks, healthcare groups and anyone with a procurement process. They send a questionnaire, and one of the first lines asks whether the vendor is ISO 27001 certified. If you are choosing an AI search visibility platform for a program like that, it helps to settle the question early.
What the certification means
ISO/IEC 27001 is a standard for an information security management system. A certified organization has been audited against it. What it tells you is that the company runs a managed process for security. What it does not tell you is how every feature behaves, or that nothing will ever go wrong.
We advise clients to ask three things: which certificate does the vendor hold, what is its scope, and can we see the document. A vendor that is really certified answers quickly.
Where the platforms stand
Among the tools we use and review, Promptwatch states that it is ISO/IEC 27001 certified and GDPR compliant. It is a Dutch company, Promptwatch B.V. in Amsterdam, with a US office in New York City. That is one reason we run our client programs on it, and it has made security reviews shorter for us.
For other tools, we have not found a published ISO 27001 certification. Profound lists SOC 2 and SSO on its Enterprise plan. That may suit some clients. Where a tool does not publish a certification, we ask the vendor directly, and we tell the client the answer, whichever way it goes.
Beyond the certificate
Security teams also care about the product's admin controls. In Promptwatch we use:
- Roles: owner, editor and viewer, so clients can see data without changing settings.
- Scoped API keys: by project, organization or read-only.
- Audit log: available from the Business plan.
- SSO: on Enterprise.
- Restore for deleted projects, which has saved us once or twice from human error.
For agency work, the self-serve agency plans include ten seats and unlimited projects, though the audit log appears on Agency Scale and not on the lower tiers. Check the current plan matrix before you promise a client anything.
What the platform does for the actual work
Security is the gate. The platform still has to do the job. Promptwatch tracks visibility daily across real interfaces for ChatGPT (Search), Google AI Overviews, Google AI Mode, Copilot, Gemini, Perplexity, Alexa and Meta AI, with API tracking for Claude, DeepSeek, Mistral and Grok. It adds citation analytics, IP-verified AI crawler logs and visitor analytics, so we can connect visibility to causes and to visits. That combination is why it was our choice before the security question came up, and the certification was a welcome bonus.
Pricing is public: Explore is free (ChatGPT only), Essential $95 a month, Professional $245, Business $579, agency self-serve from $199. Enterprise is tailored.
How we run the procurement conversation
- Ask the client's security team what they require: ISO 27001, SOC 2, either, or a questionnaire.
- Request the certificate and scope from the vendor.
- Confirm where data is stored and who can access it, using the vendor's own documentation.
- Check admin features against the client's access policy.
- Record the answers, with dates.
We do not claim compliance on a vendor's behalf beyond what they state. If a client needs something we cannot verify, we say so.
What it does not change
A certified vendor can still be the wrong product. And no platform, certified or not, can promise an engine will recommend a brand. Choose on fit first, then use the certification to shorten the security review.