October 20, 2026
Four Years and Counting: Lumenova AI’s 2026 ISO 27001 and SOC 2 Type II Audits
Contents
Security teams don’t take a vendor’s word for how it protects data. They ask for proof. That’s the same principle behind our platform, which helps organizations prove what their AI does instead of simply promising it. We hold our own information security to that standard and put it in front of independent auditors every year.
This year’s results are in. Our second ISO/IEC 27001:2022 surveillance audit closed in early September, and our certification remains in good standing. At the end of the month, we completed our SOC 2 Type II audit for the fourth year in a row. Consistency matters as much as any single result, which is why we share these updates annually.
Below, we look at why independent audits matter, what each standard proves, and why we repeat them year after year.
Why Do Independent Audits Matter?
A security questionnaire tells you what a vendor says. An audit tells you what an auditor found.
That difference shortens reviews, cuts down on follow-up questions, and gives your team evidence it can add to its own risk documentation.
In regulated industries, it does more than save time. Banks, insurers, and healthcare organizations are expected to assess their vendors and keep assessing them. In finance, DORA in the EU and third-party risk guidance from US banking agencies make that explicit. Independent audits give buyers the evidence to do it.
The stakes are higher for an AI governance platform. Teams using Lumenova AI bring in sensitive information about their AI systems, so they need to know we protect it as carefully as they do. Our annual audits are how we show it.
ISO 27001 and SOC 2 Type II: What Each Standard Proves
ISO 27001 and SOC 2 Type II often appear side by side, but they prove different things. One looks at the system. The other looks at the results.
- ISO/IEC 27001 is the international standard for information security management systems (ISMS). Certification shows that a company identifies its security risks, controls them, and keeps improving.
- SOC 2 Type II, developed by the AICPA, is about evidence. An independent CPA firm tests whether controls actually worked over several months, not just whether they look right on paper.
ISO 27001 carries particular weight in Europe and internationally, while SOC 2 is the standard expectation for North American buyers. Holding both means most customers can check our commitments against the framework they already trust. Each covers classic information security: how we protect customer data and run our own operations.
Why We Repeat These Audits Every Year
Companies change all the time. Teams grow, systems are added, vendors change, and new threats appear. A control that worked last year may not cover what the business looks like today. Annual audits catch that drift before it becomes a gap.
Both standards are built for this. ISO 27001 certification runs on a three-year cycle, with surveillance audits in the years between to confirm the management system still works. A SOC 2 Type II report covers a specific period, so each new report shows how controls performed over the most recent one. Our SOC 2 Type II audits began in 2023, and our ISO 27001 certification followed in 2024. Since then, independent auditors have checked our controls every year, so customers can rely on current evidence rather than past results.
Passing once isn’t the goal. Keeping the bar high is. ISO 27001 requires continual improvement, so each audit cycle has to show an information security program that keeps getting better, not one that simply stays in place. That’s the standard we hold ourselves to, year after year.
See Lumenova AI in Action: Request a Personalized Demo
Audits show how we protect your data. A demo shows what we can do for your AI program.
See how Lumenova AI helps you control, test, and prove what your AI agents do, all on a platform backed by independently audited security controls. Request a personalized demo, and we’ll tailor it to your industry, your AI use cases, and the questions your security team is likely to ask.