Aleph Archives Is Now ISO/IEC 27001:2022 Certified
We are pleased to announce that the Information Security Management System (ISMS) of Aleph Archives Sàrl has been independently assessed and found to conform to the requirements of ISO/IEC 27001:2022, the international standard for information security management.
For more than fifteen years, our customers have trusted us with something unusual: a legally defensible record of what their websites said, showed, and promised at a given moment. That record only has value if it is protected. ISO/IEC 27001 certification gives our customers, their auditors, and their regulators independent assurance that the controls protecting that record are designed, operated, and reviewed to an internationally recognised standard.
Why ISO 27001 Matters for a Web Archive
A web archive is not ordinary data. When a compliance officer answers a regulator, or a litigator produces evidence in court, the archive has to demonstrate three things: that it is complete, that it has not been altered, and that it was available when it was needed. Those are the same three properties – confidentiality, integrity, and availability – that sit at the heart of ISO/IEC 27001.
Our customers in financial services, healthcare, insurance, government, and legal departments already ask detailed questions during vendor due diligence. Who can access the archive? How are changes controlled? How are incidents handled? How is the platform tested? An ISO/IEC 27001 certificate does not replace those questions, but it answers many of them with evidence an independent auditor has already examined.
What the Certificate Covers
The scope of our certification is the following:
The Information Security Management System of Aleph Archives Sàrl covers the design, development, operation, hosting, and support of web archiving and digital services, including the capture, storage, and long-term retention of web content with evidential integrity.
The ISMS applies in accordance with our Statement of Applicability (SoA) v1.0, dated 19 September 2026.
- Organisation: Aleph Archives Sàrl, Lausanne, Switzerland
- Standard: ISO/IEC 27001:2022
- Certification body: GCAI, accredited by the International Accreditation Service (IAS)
- Certificate number: GCAI-ISMS-ZA67
- Initial certification date: 13 October 2026
- Expiry date: 12 October 2029
The certificate can be independently verified on IAF CertSearch.
How We Got There
Certification is the outcome of a programme, not a single audit. We worked with three partners, each with a distinct and independent role.
Sprinto: Building and Running the ISMS
We used Sprinto, a compliance automation platform, to build and operate our ISMS. Sprinto helped us map our existing practices to the ISO/IEC 27001:2022 controls, formalise our policies, monitor controls continuously across our infrastructure, and collect the evidence auditors need in one place. The result is an ISMS that runs every day, not one that is assembled once a year for the audit.
Astra Security: Independent Penetration Testing
A management system is only as good as the security of the platform it protects. We engaged Astra Security to perform an independent penetration test of our web archiving platform.
Astra’s team delivered precise findings, each with a reproducible proof of concept and a concrete remediation path. Our engineers remediated the findings, and Astra’s re-test confirmed that every Critical, High, and Medium issue was resolved. The engagement concluded with an A+ grade and an Astra security certificate.
“Clear, reproducible findings and a fast re-test loop helped us resolve every Critical, High, and Medium issue and reach an A+ result. Astra delivered a rigorous and business-aware assessment that directly supported our ISO 27001 effort.”
– Younès Hafri, Ph.D, CTO & Founder, Aleph Archives
GCAI: Independent Certification Audit
The certification audit itself was conducted by GCAI, an independent certification body accredited by the International Accreditation Service (IAS). GCAI’s auditors examined our ISMS, our Statement of Applicability, and the evidence supporting each applicable control before issuing the certificate.
Independence matters here. The organisation that helps you build an ISMS should not be the one that certifies it, and the organisation that certifies it should itself be accredited. That separation is what gives an ISO/IEC 27001 certificate its weight with customers and regulators.
What This Means for Our Customers
For organisations that rely on Aleph Archives to preserve their web presence, certification brings practical benefits:
- Faster vendor due diligence. Our certificate and Statement of Applicability can support your security questionnaires and third-party risk assessments.
- Independent assurance. The controls protecting your archives have been reviewed by an accredited third party, not only described by us.
- Stronger evidential value. Archives captured in WARC format aligned with ISO 28500, with cryptographic hash verification, are now held within a certified ISMS – one more element supporting the integrity of your records when they are challenged.
- Ongoing oversight. ISO/IEC 27001 is not a one-off. Our certification is subject to annual surveillance audits and full recertification, so the controls you rely on today will keep being tested.
Customers and prospects who need a copy of the certificate for their compliance files can contact us.
What Comes Next
ISO/IEC 27001 is a milestone, not a finish line. We are already working with the same partners on our SOC 2 Type II assessment, which will complement this certification with an independent report on how our controls operate over time.
We would like to thank the teams at Sprinto, Astra Security, and GCAI for their rigour and collaboration, and our own engineering and IT teams for the work behind this result.
About Aleph Archives
Aleph Archives has been archiving the web since 2010. Our platform captures websites and their subdomains in native WARC format aligned with ISO 28500, on immutable storage with cryptographic hash verification, and replays them exactly as they appeared on the capture date. Legal, compliance, and IT teams in regulated industries use Aleph Archives to meet record-keeping obligations and to produce defensible evidence when it matters – now within an ISMS certified to ISO/IEC 27001:2022.
