AcceleratorApp Is Now ISO 27001 Certified: What It Means for Your Innovation Program
When a university accelerator, a corporate venture program, or a government-backed innovation hub evaluates a software vendor, the security questionnaire arrives early. Sometimes it arrives before the demo. The question underneath every form, every audit request, and every procurement call is the same: can we trust you with our founders' data?
As of 5 June 2026, the answer is independently verified. AcceleratorApp is now certified to ISO/IEC 27001:2022, the international standard for information security management. The certification was issued by Sensiba Australia Pty Ltd, an IAS-accredited certification body (MSCB-379).
Quick answer
ISO/IEC 27001 is the international standard that defines how an organization should manage information security. It requires an independent, accredited auditor to verify that the company has documented policies, identified its risks, implemented controls, and operates an Information Security Management System (ISMS) that is actively reviewed and improved. AcceleratorApp has now joined the small group of platforms purpose-built for accelerators, incubators, and innovation programs that hold this certification, with certificate number 202606-262 issued on 5 June 2026.[1]
What ISO/IEC 27001 actually is
ISO/IEC 27001 is not a self-assessment, a self-declared compliance posture, or a marketing badge. It is a management system standard, published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), and the 2022 revision is the current version of the standard.[2]
To be certified, an organization has to do three things. First, define an Information Security Management System covering the scope of the business that handles customer data. Second, identify the controls that apply to that scope, drawing from Annex A of the standard, which lists 93 controls across organizational, people, physical, and technological domains. Third, submit to a two-stage external audit by an accredited certification body. Stage 1 reviews the documented system. Stage 2 tests whether the system is actually operating in practice.
The certification is then valid for three years, with surveillance audits annually and a full recertification audit at the end of the cycle. The standard is treated by enterprise procurement and government program offices as a baseline credential for any vendor handling sensitive operational data.
Why we pursued it
Accelerators, incubators, and grant managers handle some of the most sensitive data in the early-stage ecosystem. Application materials contain business plans, financial projections, cap tables, and personal information about founders. Cohort data includes performance metrics, milestone tracking, and confidential coaching notes. Grant programs deal with capital deployment records and beneficiary documentation. When 200+ programs run on a single platform, the operational consequences of strong information security compound across thousands of founders, mentors, and funders.
Our customer base also shaped the timeline. AcceleratorApp is used by programs operating under institutional procurement rules at dozens of government and university-affiliated programs. These organizations have written security requirements. Many of them now require, or will soon require, ISO 27001 from their vendors. Achieving certification removes a recurring procurement obstacle and shortens the sales cycle for the institutional buyers who increasingly treat ISO 27001 as a screening criterion.[3]
It also changes the internal practice. The ISMS is not a document folder. It is a running cycle of risk assessment, control review, incident response, and management oversight. Building it correctly means the security posture improves continuously, not just at audit time.
The scope of our certification
The certificate scope, set out verbatim on the certificate, is:
"The Information Security Management System (ISMS) of AcceleratorApp, supporting the delivery of an online platform for innovation management, grant management, and funding management, including the development, operation, and support, in accordance with the Statement of Applicability (SoA) and aligned with the control requirements of ISO/IEC 27001:2022."[1]
In practical terms, that means the certified scope covers the entire AcceleratorApp platform, including everything customers interact with, plus the development pipeline that produces it and the operational team that runs it. There are no carve-outs for sub-products or specific modules. Every feature you use today, and every feature we ship next, falls inside the certified scope.
How the audit was conducted
The audit was performed by Sensiba Australia, an accredited certification body, under the supervision of Lead Auditor Mark Kelly and audit team members Abrar Baig and Shariq Amir. Stage 2 ran in late May 2026 and used Vanta as the compliance management platform, which Sensiba's auditor function reviewed against the standard.[1]
The audit team's procedures included:
- Inquiry. Direct interviews with control owners to verify understanding and operation of each policy.
- Observation. Watching team members perform live security operations, such as access reviews and incident handling.
- Inspection. Reviewing policies, procedures, logs, source documents, system configurations, and audit trails for evidence of design and implementation.
- Sampling. Selecting a representative subset of records, tickets, and configurations to test whether controls operate consistently.
The lead auditor's formal recommendation: certification granted, sufficient evidence reviewed to verify the integrity of the management system, with zero major non-conformities identified.[1]
What changes for our customers
ISO 27001 verifies the system that produces our security controls, and that system is now independently certified. What that means in practice:
- Faster procurement. Institutional and government buyers that previously required pre-contract security assessments can now reference the certificate and the IAF CertSearch entry instead of running a full questionnaire from scratch. For programs at universities, corporates, and government agencies, this can shave weeks off the vendor approval cycle.
- Stronger audit transparency. Customers under NDA can request the full Stage 2 audit report from their account manager. The certificate itself is shareable without NDA.
- Continuous oversight. The ISMS runs in cycle. Risk assessments are refreshed at least annually, management reviews are documented, and corrective actions are tracked against deadlines. You receive the downstream benefit of a security program that is independently reviewed every year for the next three.
- A higher baseline for everything we ship next. Future product work, including modules in development, falls inside the certified scope from the day they go live. The standard rises with the platform.
How ISO 27001 compares to SOC 2
The other certification customers often ask about is SOC 2. The two are complementary frameworks rather than substitutes. SOC 2 is an attestation produced by a CPA firm against five Trust Services Criteria, common in North American B2B SaaS. ISO 27001 is a certification against a management system standard, more common globally and especially in EMEA and APAC procurement. Many enterprise SaaS vendors hold both. Our roadmap includes additional standards over the coming year, and ISO 27001 is the foundation that makes the rest faster to achieve.
How to verify the certificate
Customers and procurement teams can verify the certificate three ways:
- Request the certificate and audit report directly from your account manager. The certificate is shareable as-is; the full audit report is shareable under NDA.
- Verify the certificate at the IAF CertSearch global register, the international body that lets stakeholders confirm the status, expiry, scope, and entity for any accredited ISO certification.[4]
- Contact Sensiba Australia directly at iso@sensiba.com to confirm the certificate's authenticity.
Certificate details for verification: Certificate Number 202606-262, issued 5 June 2026, expires 5 June 2029, Statement of Applicability v1.0 (10 April 2026), held by AcceleratorApp Limited.
What comes next
The ISO 27001 certificate enters a three-year cycle. Surveillance audits will be conducted annually, and we are already preparing for the first one. In parallel, we are expanding the security program: additional certifications, an updated public Trust Center, and continued investment in the platform's underlying security architecture. Every milestone makes it easier for the next institutional buyer to say yes.
For program managers reviewing AcceleratorApp during a procurement process, you can now skip the long-form security questionnaire for any control already covered in our Statement of Applicability. Your security team should ask for the certificate and the audit report. Both are ready to share.
If you are running an accelerator, incubator, or grant program and want to see how the certified platform handles your specific workflow, a demo takes about 20 minutes.
Frequently asked questions
What is ISO/IEC 27001:2022?
ISO/IEC 27001:2022 is the international standard for information security management. It requires organizations to operate a documented Information Security Management System (ISMS), perform a risk assessment, implement controls from Annex A of the standard, and submit to an independent two-stage audit by an accredited certification body. The 2022 revision is the current version of the standard.
When was AcceleratorApp certified?
AcceleratorApp was certified on 5 June 2026 under certificate number 202606-262, issued by Sensiba Australia Pty Ltd. The certification is valid until 5 June 2029, with surveillance audits each year and a full recertification audit at the end of the three-year cycle.
What does the certification scope cover?
The scope covers the entire AcceleratorApp platform supporting innovation management, grant management, and funding management, including the development, operation, and support of the platform. There are no carve-outs for specific modules or sub-products.
How can I verify the certificate?
You can verify the certificate three ways: request it from your account manager, look it up on the IAF CertSearch global register, or contact Sensiba Australia directly at iso@sensiba.com. The certificate is shareable without NDA. The full Stage 2 audit report is shareable under NDA on request.
Does ISO 27001 replace a SOC 2 report?
No. ISO 27001 and SOC 2 are different frameworks issued by different bodies. ISO 27001 is a certification against a management system standard, more commonly required in EMEA and APAC procurement. SOC 2 is a CPA-issued attestation against Trust Services Criteria, more common in North America. Many SaaS vendors hold both, and they are complementary rather than substitutable.
What does this mean for new features and modules?
The certification scope covers the platform as a whole, including the development pipeline. Future modules and features built within that pipeline fall inside the certified scope from the day they ship. Surveillance audits will verify that the ISMS continues to apply as the product evolves.
How long is an ISO 27001 certificate valid for?
ISO 27001 certificates are valid for three years from the original certification date. The certification body conducts annual surveillance audits during that window to confirm the ISMS continues to operate, and a full recertification audit at the end of the cycle. AcceleratorApp's current certification cycle runs through 5 June 2029.
Sources
[1] Sensiba Australia Pty Ltd. Certificate of Registration, AcceleratorApp Limited, ISO/IEC 27001:2022. Certificate Number 202606-262. Issued 5 June 2026. Available on request and verifiable at https://www.iafcertsearch.org
[2] International Organization for Standardization. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements. Published October 2022. https://www.iso.org/standard/27001
[3] International Accreditation Forum. IAF CertSearch global register of accredited certifications. https://www.iafcertsearch.org
[4] Sensiba Australia Pty Ltd. ISO/IEC 27001 Stage 2 Audit Report, AcceleratorApp Limited. Lead Auditor: Mark Kelly. Available to AcceleratorApp customers under NDA.
About the author
Alain Readman Valiquette is the CEO and Founder of AcceleratorApp, the operating system used by 200+ accelerators, incubators, and innovation programs worldwide, including programs at MIT, Yale, KAUST, Oraseya Capital, Climate-KIC and German Accelerator He served as the lead executive sponsor of AcceleratorApp's ISO 27001 certification program and was the auditee representative during the Stage 2 audit conducted by Sensiba Australia in May 2026.
Ready to see the certified platform in action? Book a 20-minute demo.