BlueWhale Stack holds five ISO management-system certifications audited by accredited third-party bodies, plus a CSA STAR Level 1 self-assessment, a GDPR compliance assessment and a SOC 2 Type II readiness assessment. This summary lists each one exactly as the certification bodies allow it to be described, with the numbers you need to verify them.
Certifications and assessments
| Standard | Number | Body | Issued | Next date | Entity |
|---|---|---|---|---|---|
| ISO/IEC 27001:2022 | AE260625009 | LMS Assessments Limited | 25 Jun 2026 | Surveillance due 24 Jun 2027 | FZE LLC (UAE) |
| ISO/IEC 27017:2015 | 2026784001 | SNS Certification Inc. | 18 Jun 2026 | Surveillance due 18 Jun 2027 | FZE LLC (UAE) |
| ISO/IEC 27018:2019 | 2026086002 | SNS Certification Inc. | 17 Jun 2026 | Surveillance due 16 Jun 2027 | FZE LLC (UAE) |
| ISO/IEC 27701:2019 | AE63241V | Staunchly Management and System Services Limited | 25 Jun 2026 | Surveillance due 24 Jun 2027 | FZE LLC (UAE) |
| ISO 22301:2019 | AMER501473 | AMERICO Quality Standards Registech Pvt. Ltd. | 23 Jun 2026 | Surveillance due 22 Jun 2027 | FZE LLC (UAE) |
| CSA Security, Trust, Assurance and Risk (STAR) — Level 1 Self-Assessment | 2026086003 | SNS Certification Inc. | 17 Jun 2026 | Review due 16 Jun 2027 | FZE LLC (UAE) |
| SOC 2 Type II Trust Services Criteria — Readiness Assessment | 2026086005 | SNS Certification Inc. | 17 Jun 2026 | Next review 16 Jun 2027 | Pvt Ltd (India) |
| EU General Data Protection Regulation (2016/679) — Compliance Assessment | 2026086004 | SNS Certification Inc. | 17 Jun 2026 | Surveillance due 16 Jun 2027 | FZE LLC (UAE) |
| Digital Personal Data Protection Act 2023 (India) | — | Regulatory | ongoing | continuous | — |
CSA STAR Level 1 is a self-assessment declaration, GDPR a compliance assessment, and SOC 2 Type II a readiness assessment — not a CPA attestation report or Type II assurance opinion. Signed certificate PDFs are downloadable from the Trust Center; full audit packs are available to customers under NDA.
How we run security
Data residency
Choose where your data lives: Singapore, Mumbai, Dubai, Frankfurt, or Los Angeles. Sovereign and air-gapped options available for regulated workloads.
Encryption at rest & in transit
AES-256 at rest, TLS 1.3 in transit. Customer-managed keys available on Enterprise, Telco & Datacenter and Government editions.
Transparency & reporting
Annual Transparency Report, compliance summary reports, and a shared-responsibility matrix available for every deployment model.
Security posture
- One identity fabric (SAML 2.0 / OIDC) across 10 identity providers, with SCIM auto-provisioning
- Least-privilege, role-based access across every connected estate; credentials AES-256 at rest, TLS 1.3 in transit
- Continuous control monitoring; the report your auditor asks for, generated per regime on demand
- Data residency by region (DPDP — Mumbai, GDPR — Frankfurt); in-country by BYOC, on-prem or air-gapped elsewhere
- ISO/IEC 27001, 27017, 27018, 27701 and ISO 22301 certified; SOC 2 Type II readiness assessment complete
- Air-gapped and in-region deployment for sovereign customers, with WORM-backed audit logs in the Government Edition
Data residency
SaaS regions: Singapore (SIN), Mumbai (BOM), Dubai (DXB), Frankfurt (FRA), Los Angeles (LAX). Residency is enforced per resource and evidenced from the audit log. For regimes without a SaaS region, BYOC, on-premises or air-gapped deployment keeps everything in-country.
Procurement questions
What's the status of your SOC 2 Type II audit?
We've completed a SOC 2 Type II readiness assessment against the AICPA Trust Services Criteria, confirming readiness-level alignment of our control design across all five criteria with no readiness blockers. It is not a CPA attestation report or Type II assurance opinion — a formal Type II report requires an independent CPA examination over an observation period, which is our next step. The readiness assessment pack is available to Enterprise and Government customers under NDA — email security@bluewhalestack.com to request it.
Which legal entity holds the certificates?
The five ISO certificates, the CSA STAR Level 1 review certificate and the GDPR compliance certificate are issued to BlueWhale Stack Consulting and Technologies FZE LLC (Ajman, UAE), with our Pune, India engineering location included in the audited scope. The SOC 2 readiness assessment is issued to BlueWhale Consulting and Technologies Private Limited, our Indian company. All certificates cover the same BlueWhale Stack and BlueWhale Fincore platforms.
Can I verify a certificate independently?
Yes. Every certificate carries the issuing body's verification QR code, and each body maintains a public register — LMS Assessments (ISO 27001), Staunchly (ISO 27701), AMERICO (ISO 22301) and SNS Certification (ISO 27017, ISO 27018, CSA STAR, SOC 2 readiness, GDPR). Use the certificate numbers shown on this page.
Which certifications apply to the Government (sovereign / air-gapped) edition?
All certifications apply to the Government edition. Air-gapped deployments additionally support in-region AI inference and can be scoped for additional local regulatory requirements.
Do you offer a Data Processing Agreement (DPA)?
Yes — our standard DPA is available for all paid editions. It covers GDPR Article 28, India DPDP Act requirements, and sub-processor disclosure with a 30-day change-notice process. Request it at legal@bluewhalestack.com.
How do you handle security incidents?
We follow ISO 27001 incident management procedures with defined classification, escalation, and notification timelines. Customers receive notification within 72 hours for confirmed personal data incidents, in line with our DPA and GDPR obligations.
What sub-processors do you use?
Our current sub-processor list is provided with the Data Processing Agreement and on request from legal@bluewhalestack.com. We notify customers of material changes 30 days in advance (per our DPA terms).