Security and compliance, independently verified.

All certifications: 9

• ISO 27001

  Certified

  ISO/IEC 27001:2022

  The globally recognised standard for information security management. Independently audited and certified — demonstrating end-to-end controls across people, processes, and technology.

  Scope, audit & documents

  Scope

  Information Security Management System covering the design, development, hosting, operation, maintenance, and support of BlueWhale Stack and BlueWhale Fincore platforms, including AI-native multi-cloud management, provisioning and operation of public cloud, hybrid cloud and on-premises infrastructure, inventory and discovery, migration, ITSM, observability, security and compliance, FinOps, identity and administration, Whale AI, invoicing platform services, API integrations, information security governance, access control, incident management, backup, business continuity, and customer data protection. Statement of Applicability v1.0, 5 Jan 2026.

  Audit cycle

  Annual surveillance audit · 3-year recertification

  Issued by

  LMS Assessments Limited, UK — EGAC accredited (ISMS CAB #012312), IAF MLA member

  Certified entity

  BlueWhale Stack Consulting and Technologies FZE LLC — BC-892084, 26th Floor, Amber Gem Tower, Ajman, UAE

  Stage 1 audit

  May 2026

  Stage 2 audit

  10 Jun 2026

  Findings

  No nonconformities or observations raised at Stage 1 or Stage 2

  Surveillance programme

  Year 1 surveillance June 2027 · Year 2 surveillance June 2028 · recertification June 2029. Sites in scope: Ajman (UAE) and Pune (India).

  Management-system documents (7)

  • Information security policy summaryOn request
  • ISMS scope statementOn request
  • ISMS Manual and 17 management-system proceduresUnder NDA
  • Information security policy set (19 policies)Under NDA
  • Statement of Applicability v1.0Under NDA
  • Stage 1 and Stage 2 audit reportsUnder NDA
  • 3-year surveillance audit programmeUnder NDA

  No. AE260625009

  Issued 25 Jun 2026 · Surveillance due 24 Jun 2027 · Recertification 24 Jun 2029

  Verify with the issuer (opens in a new tab)

  Download PDF— ISO 27001
• ISO 27017

  Certified

  ISO/IEC 27017:2015

  Cloud-specific extension to ISO 27001 — defines additional controls for cloud service providers and their customers. Covers shared responsibilities, virtual machine hardening, and cloud-specific threat management.

  Scope, audit & documents

  Scope

  Cloud security controls covering the design, development, hosting, operation, maintenance, and support of BlueWhale Stack and BlueWhale Fincore platforms, including AI-native multi-cloud management, cloud resources and inventory, provisioning and landing zones, migration, security and compliance, ITSM and observability, identity and administration, FinOps, secure cloud operations, shared responsibility controls, and protection of customer data across public cloud, hybrid cloud and on-premises environments.

  Audit cycle

  3-year certificate · annual surveillance assessment

  Issued by

  SNS Certification Inc., San Francisco — IACGS accredited (No. 24840011)

  Certified entity

  BlueWhale Stack Consulting and Technologies FZE LLC — BC-892084, 26th Floor, Amber Gem Tower, Ajman, UAE

  Surveillance programme

  Annual surveillance due 18 June 2027; recertification 18 June 2029. Deployment models in scope: SaaS, BYOC and sovereign / on-premises.

  Management-system documents (2)

  • Shared-responsibility matrix (SaaS · BYOC · Sovereign)On request
  • Cloud Security Controls ManualUnder NDA

  No. 2026784001

  Issued 18 Jun 2026 · Surveillance due 18 Jun 2027 · Recertification 18 Jun 2029

  Verify with the issuer (opens in a new tab)

  Download PDF— ISO 27017
• ISO 27018

  Certified

  ISO/IEC 27018:2019

  The international standard for protecting personal data in public cloud services. Establishes commonly accepted control objectives, controls, and guidelines for processing PII in the cloud.

  Scope, audit & documents

  Scope

  Protection of personally identifiable information in public cloud environments covering the design, development, hosting, operation, maintenance, and support of BlueWhale Stack and BlueWhale Fincore platforms, including processing of customer and end-user personal data through multi-cloud management, cloud operations, identity and administration, invoicing platform services, API integrations, collection, processing, storage, transmission, retention, deletion, and protection of personally identifiable information.

  Audit cycle

  3-year certificate · annual surveillance assessment

  Issued by

  SNS Certification Inc., San Francisco — IACGS accredited (No. 24840011)

  Certified entity

  BlueWhale Stack Consulting and Technologies FZE LLC — BC-892084, 26th Floor, Amber Gem Tower, Ajman, UAE

  Surveillance programme

  Annual surveillance due 16 June 2027; recertification 16 June 2029. BlueWhale acts as PII processor for customer platform data; roles are fixed in each customer DPA.

  Management-system documents (3)

  • Sub-processor list (30-day change notice)On request
  • Retention and deletion commitmentsOn request
  • PII Protection ManualUnder NDA

  No. 2026086002

  Issued 17 Jun 2026 · Surveillance due 16 Jun 2027 · Recertification 16 Jun 2029

  Verify with the issuer (opens in a new tab)

  Download PDF— ISO 27018
• ISO 27701

  Certified

  ISO/IEC 27701:2019

  Privacy extension to ISO 27001 — specifies requirements and guidance for establishing, implementing, and continually improving a Privacy Information Management System. Demonstrates accountability under GDPR and the DPDP Act.

  Scope, audit & documents

  Scope

  Privacy Information Management System covering the design, development, hosting, operation, maintenance, and support of BlueWhale Stack and BlueWhale Fincore platforms, including privacy governance, processing of personally identifiable information through multi-cloud management, cloud operations, identity and administration, invoicing platform services, API integrations, consent management, data subject rights, retention, deletion, breach response, and third-party processing controls. No clause excluded; controller (Annex A) and processor (Annex B) control sets both audited.

  Audit cycle

  Annual surveillance audit · 3-year recertification

  Issued by

  Staunchly Management and System Services Limited, UK — EGAC accredited (MSCB CAB #011804)

  Certified entity

  BlueWhale Stack Consulting and Technologies FZE LLC — BC-892084, 26th Floor, Amber Gem Tower, Ajman, UAE

  Stage 1 audit

  17 Jun 2026

  Stage 2 audit

  17 Jun 2026

  Audit mode

  Remote audit (video, screen sharing, controlled document exchange)

  Findings

  0 major · 0 minor nonconformities · 4 opportunities for improvement

  Surveillance programme

  1st surveillance by June 2027 · 2nd surveillance by June 2028 · re-assessment June 2029. Sites: Ajman (UAE), Pune (India) and remote evidence review.

  Management-system documents (9)

  • PIMS scope and applicability statementOn request
  • Technical and Organisational Measures statementOn request
  • Sub-processor and transfer registerOn request
  • Records of processing (ROPA) summaryOn request
  • Data Processing Agreement (DPA) templateUnder contract
  • PIMS ManualUnder NDA
  • DPIA and privacy-by-design templateUnder NDA
  • PIMS risk register and treatment planUnder NDA
  • Stage 1 and Stage 2 remote audit reportsUnder NDA

  No. AE63241V

  Issued 25 Jun 2026 · Surveillance due 24 Jun 2027 · Recertification 24 Jun 2029

  Verify with the issuer (opens in a new tab)

  Download PDF— ISO 27701
• ISO 22301

  Certified

  ISO 22301:2019

  The international standard for Business Continuity Management. Certifies our ability to continue critical operations, protect people, and recover from disruption — backed by documented plans, defined RTOs/RPOs, and a yearly exercise programme.

  Scope, audit & documents

  Scope

  Business Continuity Management System for the design, development, hosting, operation, maintenance, and support of BlueWhale Stack and BlueWhale Fincore platforms, including continuity of AI-native multi-cloud management, public cloud, hybrid cloud and on-premises operations, inventory and discovery, provisioning, migration, ITSM, observability, security and compliance, FinOps, identity and administration, invoicing platform services, business continuity planning, risk assessment, disaster recovery, backup management, incident response, service continuity, and crisis communication.

  Audit cycle

  Annual surveillance audit · 3-year recertification

  Issued by

  AMERICO Quality Standards Registech Pvt. Ltd. — UAF accredited (CM-MS-7807)

  Certified entity

  BlueWhale Stack Consulting and Technologies FZE LLC — BC-892084, 26th Floor, Amber Gem Tower, Ajman, UAE

  Surveillance programme

  Annual surveillance due 22 June 2027; recertification 22 June 2029. First-cycle certificate (revision R0). BCMS document pack v1.0 effective 13 June 2026.

  Management-system documents (13)

  • Business continuity policy and objectives summaryOn request
  • BCMS scope statementOn request
  • BCMS ManualUnder NDA
  • Business impact analysis and critical activities registerUnder NDA
  • Business continuity risk assessment and treatment planUnder NDA
  • Business continuity strategy and solutions planUnder NDA
  • Incident response and crisis management procedureUnder NDA
  • IT disaster recovery planUnder NDA
  • Backup and restore procedure and recordUnder NDA
  • Business continuity communication planUnder NDA
  • Supplier and dependency continuity registerUnder NDA
  • Platform business continuity plansUnder NDA
  • Exercise, testing and review programmeUnder NDA

  No. AMER501473

  Issued 23 Jun 2026 · Surveillance due 22 Jun 2027 · Recertification 22 Jun 2029

  Verify with the issuer (opens in a new tab)

  Download PDF— ISO 22301
• CSA STAR Level 1

  Self-assessed

  CSA Security, Trust, Assurance and Risk (STAR) — Level 1 Self-Assessment

  A CSA STAR Level 1 self-assessment against the Cloud Security Alliance's Cloud Controls Matrix (CCM), using the Consensus Assessments Initiative Questionnaire (CAIQ). Level 1 is a self-assessment declaration, not a Level 2 third-party certification audit — SNS Certification Inc. reviewed the self-assessment package remotely in two stages and issued a compliance certificate for the declaration.

  Scope, audit & documents

  Scope

  Cloud security self-assessment covering the design, development, hosting, operation, maintenance, and support of BlueWhale Stack and BlueWhale Fincore platforms, including AI-native multi-cloud management, cloud resources and inventory, provisioning and landing zones, migration, security and compliance, ITSM and observability, identity and administration, FinOps, Whale AI, data protection, logging and monitoring, incident response, business continuity, and compliance controls across public cloud, hybrid cloud and on-premises environments.

  Audit cycle

  Self-assessment declaration · annual review

  Issued by

  SNS Certification Inc., San Francisco — IACGS accredited (No. 24840011); review certificate for a management self-assessment declaration

  Certified entity

  BlueWhale Stack Consulting and Technologies FZE LLC — BC-892084, 26th Floor, Amber Gem Tower, Ajman, UAE

  Stage 1 audit

  17 Jun 2026 (remote document review)

  Stage 2 audit

  17 Jun 2026 (remote evidence and declaration review)

  Audit mode

  Self-assessment declared 12 June 2026; two-stage remote review

  Findings

  0 major · 0 minor nonconformities · 3 observations, none blocking

  Surveillance programme

  CCM domains reviewed: GRC, A&A, AIS, CCC, TVM, IAM, CEK, DSP, IVS, IPY, LOG, SEF, BCR, STA, HRS, UEM — all accepted. Next review due 16 June 2027.

  Management-system documents (4)

  • Shared-responsibility matrix (SaaS · BYOC · Sovereign)On request
  • Completed CAIQ / CCM self-assessment responseUnder NDA
  • CCM domain review summaryUnder NDA
  • Stage 1 and Stage 2 remote review recordsUnder NDA

  No. 2026086003

  Issued 17 Jun 2026 · Review due 16 Jun 2027

  Verify with the issuer (opens in a new tab)

  Download PDF— CSA STAR Level 1
• SOC 2 Type II

  Readiness assessment

  SOC 2 Type II Trust Services Criteria — Readiness Assessment

  A readiness assessment against the AICPA Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality, and Privacy. It confirms readiness-level alignment with selected SOC 2 control areas based on documents, management representations, interviews and sample evidence. It is not a CPA attestation report or a SOC 2 Type I or Type II assurance opinion; a formal Type II report requires an independent CPA examination over an observation period.

  Scope, audit & documents

  Scope

  Readiness review of documented policies, procedures, control design, information security practices, access control, change management, incident response, vendor management, backup, business continuity, risk management, and related governance controls for the design, development, hosting, operation, maintenance, monitoring, and support of BlueWhale Stack and BlueWhale Fincore platforms, covering AI-native multi-cloud management, inventory and discovery, provisioning, migration, ITSM, observability, security and compliance, FinOps, identity and administration, invoicing platform services, customer data protection, system availability, confidentiality, processing integrity, and privacy controls.

  Audit cycle

  Readiness assessment · next review recommended within 12 months

  Issued by

  SNS Certification Inc., San Francisco — readiness assessment, not a CPA audit opinion

  Certified entity

  BlueWhale Consulting and Technologies Private Limited — Kalyan West, Thane, Maharashtra, India (CIN U74999MH2018PTC306172)

  Assessment date

  17 Jun 2026 (single-day remote readiness assessment)

  Audit mode

  Remote — video interviews, secure document exchange, screen sharing; independent technical review before issue

  Findings

  0 major · 0 minor readiness blockers · 3 improvement actions (evidence retention for a future CPA observation period)

  Surveillance programme

  28 Trust Services Criteria reviewed (CC1–CC9, A1, PI1, C1, P1–P6) — all recorded as conforming at readiness level. Next review recommended by 16 June 2027.

  Management-system documents (6)

  • System description and scopeUnder NDA
  • TSC control matrixUnder NDA
  • SOC 2 TSC control manualUnder NDA
  • SNS readiness assessment reportUnder NDA
  • Findings, CAPA and closure reportUnder NDA
  • Client sharing and limitations statementUnder NDA

  No. 2026086005

  Issued 17 Jun 2026 · Next review 16 Jun 2027

  Verify with the issuer (opens in a new tab)

  Download PDF— SOC 2 Type II
• GDPR

  Certified

  EU General Data Protection Regulation (2016/679) — Compliance Assessment

  An independent compliance assessment confirming that BlueWhale Stack has implemented appropriate technical and organisational measures in alignment with GDPR, as Data Processor for customer platform data and Data Controller for its own business processing. It is a compliance assessment — not an Article 42 certification, supervisory-authority approval, or legal opinion. DPA templates, data residency options (Frankfurt region), and our Privacy Policy underpin GDPR obligations.

  Scope, audit & documents

  Scope

  Data protection and privacy compliance covering the design, development, hosting, operation, maintenance, and support of BlueWhale Stack and BlueWhale Fincore platforms, including processing of personal data through multi-cloud management, cloud operations, identity and administration, invoicing platform services, API integrations, data subject rights, lawful processing, consent management, privacy notices, data processing agreements, breach response, retention, deletion, and vendor/sub-processor controls.

  Audit cycle

  3-year certificate · annual surveillance assessment

  Issued by

  SNS Certification Inc., San Francisco — IACGS accredited (No. 24840011)

  Certified entity

  BlueWhale Stack Consulting and Technologies FZE LLC — BC-892084, 26th Floor, Amber Gem Tower, Ajman, UAE

  Stage 1 audit

  17 Jun 2026

  Stage 2 audit

  17 Jun 2026

  Audit mode

  Remote audit — document review, management interviews, screen sharing, evidence sampling

  Findings

  0 major · 0 minor nonconformities · 3 opportunities for improvement, closed without corrective action

  Surveillance programme

  All 15 checklist areas rated conforming (governance, ROPA, lawful basis, transparency, consent, data subject rights, privacy by design, security, breach, retention, sub-processors, transfers, training, monitoring). Surveillance due 16 June 2027; recertification 16 June 2029.

  Management-system documents (10)

  • Privacy noticeOn request
  • Sub-processor and international transfer registerOn request
  • Technical and Organisational Measures statementOn request
  • Records of processing (ROPA) summaryOn request
  • Privacy awareness training summaryOn request
  • Data Processing Agreement (DPA) templateUnder contract
  • Data retention and deletion scheduleUnder NDA
  • Personal data breach response procedureUnder NDA
  • DPIA and privacy-by-design procedureUnder NDA
  • Stage 1 and Stage 2 remote audit reportsUnder NDA

  No. 2026086004

  Issued 17 Jun 2026 · Surveillance due 16 Jun 2027 · Recertification 16 Jun 2029

  Verify with the issuer (opens in a new tab)

  Download PDF— GDPR
• India DPDP Act 2023

  Compliant

  Digital Personal Data Protection Act 2023 (India)

  BlueWhale Stack's privacy programme is aligned to India's DPDP Act 2023, covering consent frameworks, data localisation (Mumbai region), Data Fiduciary obligations, and breach notification procedures. DPDP was assessed as an applicable privacy regime within our ISO 27701 certification; built-in controls support SDF readiness requirements.

  How the platform meets it

  • Data localisation — SaaS in the Mumbai region, or BYOC, on-prem and air-gapped in-country — residency enforced per resource and evidenced from the audit log
  • Consent and notice — Consent management and privacy notices, within the ISO 27701-certified privacy programme
  • Data Principal rights — Access, correction and erasure requests handled through the data subject rights process audited under ISO 27701
  • Breach notification — A documented personal data breach response procedure, with incidents tracked to closure through Whale ITSM
  • Significant Data Fiduciary readiness — DPIA and privacy-by-design procedure, records of processing and an append-only audit trail for periodic audit

  Scope

  Processing of Indian citizens' personal data; Significant Data Fiduciary readiness

  Audit cycle

  Ongoing — continuous compliance programme

  Issued by

  Regulatory — Government of India

  Management-system documents (6)

  • Privacy noticeOn request
  • Records of processing (ROPA) summaryOn request
  • Sub-processor and transfer registerOn request
  • Data Processing Agreement (DPA) template — GDPR Art. 28 and DPDPUnder contract
  • Personal data breach response procedureUnder NDA
  • DPIA and privacy-by-design procedureUnder NDA

  Regulatory framework — no certificate issued