MarsBased is now ISO/IEC 27001:2022 certified

On 11 November 2026, Glocert International Certifications awarded MarsBased ISO/IEC 27001:2022 certification (certificate no. 26ISMS-1290). The decision came after the initial certification audit of our information security management system and a review of the corrective actions we took on the audit's findings.

The certificate is valid until 10 November 2029. Between now and then, an auditor will come back every year for a surveillance audit, so this is a commitment we keep renewing for years to come.

What the certification covers

ISO/IEC 27001 certifies how an organisation manages information security, not a product. Ours covers the way we design, build, deploy and maintain software for clients, on both client-managed and our own cloud infrastructure. It also covers the people, processes, cloud-hosted tools and corporate IT systems behind that work.

In practice, that means documented and audited controls for things like access management, supplier security, incident response, business continuity, secure development and how we onboard and offboard people.

What it means if you work with us

• Security reviews get shorter. If your procurement or security team sends vendor questionnaires, the certificate answers a large share of them, and we can fill in the rest quickly.
• The way we work doesn't change. Most of these practices were already in place. The certification formalises them and has an independent auditor check them against the standard.
• The rest of our compliance posture still applies. We remain GDPR-compliant, EU-based, and happy to sign a DPA or NDA before any data changes hands.

Verify it yourself

You can download the certificate or look us up on IAF CertSearch with the certificate number, 26ISMS-1290.

Thank you

Getting here took most of the year and a lot of work from people whose day job is building software, not writing policies. Thank you to everyone at MarsBased who drafted procedures, gathered evidence, sat through interviews and fixed what the auditors found.

If you followed the process from the start, this is where we left it. If you have questions about how we handle security, get in touch.