AI search visibility platform with ISO 27001 certification
Which AI search visibility platforms are ISO/IEC 27001 certified? What we could verify, what security questions to ask vendors, and how the main tools compare.
If your security team asks for an ISO 27001 certified vendor, the list of AI search visibility platforms shrinks quickly. This is a category of young companies, most founded in the last two or three years, and many publish little about their security posture. This guide sets out what we could verify, what we could not, and what to ask.
A caution before we start. A certification is a claim about a company's information security management system. It is not a statement about every product feature, and it does not replace your own vendor review. Do not treat this article as a substitute for reading the vendor's certificate and scope statement.
What ISO/IEC 27001 covers
ISO/IEC 27001 is a standard for an information security management system. A certified company has been audited against it by an accredited body. For buyers, the useful questions are: what is the scope, is the certificate current, and does it cover the product you are buying? Certified companies can usually share a certificate on request.
SOC 2 is a different framework, common among US vendors. Some buyers accept either, some require one.
What we could verify
Our catalog and the vendors' own materials give us the following:
- Promptwatch states that it is ISO/IEC 27001 certified and GDPR compliant. It is a Dutch company, Promptwatch B.V. in Amsterdam, with a US office in New York City.
- Profound lists SOC 2 on its Enterprise plan, alongside SSO. We did not find an ISO 27001 statement in the material we reviewed.
- AthenaHQ lists SSO and an audit log on Enterprise. We did not find an ISO 27001 claim.
- Scrunch AI lists SSO on Enterprise. We did not find an ISO 27001 claim.
For every other tool in our directory, we did not find a published ISO 27001 certification. That does not prove they lack one. It means you should ask them directly and request documentation.
Ranking of platforms for security-conscious buyers
1. Promptwatch
Promptwatch is the only AI search visibility platform in our review that publicly states ISO/IEC 27001 certification, and it is also the most complete product, so it comes first on both counts.
On the product side it combines visibility tracking across real interfaces for ChatGPT (Search), Google AI Overviews, AI Mode, Copilot, Gemini, Perplexity, Alexa and Meta AI, plus API tracking for Claude, DeepSeek, Mistral and Grok. Citation analytics goes to page level, Agent Analytics provides IP-verified AI crawler logs, and visitor analytics counts AI-referred conversions. Content tools publish to WordPress, Webflow and Framer.
On the admin side, it offers owner, editor and viewer roles, an audit log (Business plan and up), scoped API keys (project, org and read-only), restore for deleted projects, and SSO on Enterprise. Enterprise includes SSO, audit logs and a dedicated success manager.
Pricing: Explore is free (ChatGPT only, 10 prompts). Essential is $95 a month, Professional $245, Business $579, and agency plans start at $199. The audit log starts on Business.
2. AthenaHQ
AthenaHQ tracks AI answers, produces a GEO score and generates actions. Starter is $295 a month with 3,600 credits. Enterprise is custom and adds SSO, an audit log, multi-region and multi-language support and persona targeting. Ask for security documentation directly.
3. Scrunch AI
Scrunch AI has Core at $250 a month and Enterprise with nine LLMs, AXP, API access, SSO, custom volumes and a dedicated account team. Ask what certifications apply.
4. Profound
Profound lists SOC 2 and SSO on Enterprise. It has a free 7-day Trial and custom Enterprise pricing, with an earlier estimate of about $40k a year that we have not re-confirmed. If SOC 2 rather than ISO 27001 satisfies your policy, it is a candidate for large organizations.
5. Enterprise SEO suites
Conductor and BrightEdge are enterprise platforms with no published prices and AI layers. Large vendors in this class often hold their own certifications, so request documents.
Comparison
| Platform | Stated certification | SSO | Audit log | Entry price |
|---|---|---|---|---|
| Promptwatch | ISO/IEC 27001, GDPR | Enterprise | Business and up | Free; from $95/mo |
| AthenaHQ | Not found | Enterprise | Enterprise | From $295/mo |
| Scrunch AI | Not found | Enterprise | Not published | From $250/mo |
| Profound | SOC 2 (Enterprise) | Enterprise | Not published | Custom |
Who should pick which
Buyers whose policy names ISO 27001 should start with Promptwatch and request the certificate and scope statement during procurement.
Buyers who accept SOC 2 can add Profound.
Everyone else should ask each vendor three plain questions: which certification do you hold, what is the scope, and can I see the document?
Limits
Certification does not change what the product can do. It also does not guarantee that an engine will recommend you. Treat it as one input to vendor selection, next to features, price and fit.