---
title: "Beyond the SOC 2: Why We Doubled Down on Privacy with ISO 27701"
description: Brand Sterne explains why Basis Theory is excited about achieving ISO/IEC 27701 certification, and what this means for working with the company.
image: https://blog.basistheory.com/hubfs/ISO27701.webp
---

[Skip to content](https://blog.basistheory.com/achieving-iso-27701-certification#main-content)

![Basis Theory logo](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=365&height=122&name=BTLogo%20(1).png)

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)

Open main navigation

Close main navigation

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)
- [Get a demo](https://basistheory.com/contact)

[Login](https://portal.basistheory.com/)

[Get a demo](https://basistheory.com/contact)

 March 31, 2026

![Picture of Brandon Sterne](https://blog.basistheory.com/hs-fs/hubfs/brandon-sterne-headshot.jpeg?width=50&name=brandon-sterne-headshot.jpeg) [Brandon Sterne](https://blog.basistheory.com/author/brandon-sterne) ·

[Data Security](https://blog.basistheory.com/tag/data-security)

# Beyond the SOC 2: Why We Doubled Down on Privacy with ISO 27701

![ISO 27701 Certification for Basis Theory](https://blog.basistheory.com/hubfs/ISO27701.webp)

## Table of Contents

- [What is ISO 27701?](https://blog.basistheory.com/achieving-iso-27701-certification#ISO)
- [Strengthening the Transatlantic Bridge](https://blog.basistheory.com/achieving-iso-27701-certification#Bridge)
- [Privacy is a Product Feature](https://blog.basistheory.com/achieving-iso-27701-certification#Product)

Security has always been the floor, not the ceiling at Basis Theory. Most companies start and often end their compliance journey with a SOC 2. And while SOC 2 is a great baseline for security, it doesn't always answer the more nuanced questions about how a platform handles the lifecycle of personal data.

As we continue to help global enterprises secure their most sensitive data, we wanted to go further. Today, we’re excited to announce that Basis Theory has officially achieved ISO/IEC 27701 certification.

## What is ISO 27701? 

If ISO 27001 is the gold standard for Information Security Management (ISMS), think of ISO 27701 as its privacy-obsessed sibling. It is the international standard for a Privacy Information Management System (PIMS).

While security focuses on the protection of data (encryption, access controls, uptime), privacy focuses on the rights associated with that data. Achieving this certification means our internal processes, from how we build new [features](https://basistheory.com/add-ons) to how we manage our sub-processors, have been independently audited to ensure we are managing Personally Identifiable Information (PII) with the highest level of accountability.

For our customers, this saves your compliance and legal teams from a massive amount of manual heavy lifting. When you’re building on Basis Theory, you’re inheriting a platform that was designed to meet the rigorous requirements of the GDPR, CCPA, and other global privacy frameworks.

[Return to Top](https://blog.basistheory.com/achieving-iso-27701-certification#TOC)

## Strengthening the Transatlantic Bridge 

In addition to our ISO certification, we are also active participants in the [EU-U.S. Data Privacy Framework (DPF)](https://www.dataprivacyframework.gov/list).

Cross-border data transfers have been a moving target for years. The DPF provides a reliable, legal mechanism for transferring personal data from the EU to the U.S.

By participating in this framework, we’re ensuring that our European partners can utilize our [tokenization](https://blog.basistheory.com/what-is-tokenization) and [vaulting](https://basistheory.com/solution/payment-vault) infrastructure without the legal headaches often associated with "standard contractual clauses" alone.

[Return to Top](https://blog.basistheory.com/achieving-iso-27701-certification#TOC)

## Privacy is a Product Feature 

We didn't pursue these certifications just to check a box for a sales RFP. We did it because we believe that privacy should be baked in. We have a Privacy by Design policy that embeds privacy considerations into the earliest stages of feature development and outlines a set of rigorous privacy principles that inform our product design.

The more we harden our own privacy posture, the better equipped we are to help you harden yours. Whatever Basis Theory platform features you choose to build on, you can be confident that the foundation you’re building on is held to a global standard of excellence.

We’re proud of the team for the hard work that went into this audit, but we aren't stopping here. Privacy is a moving target, and we’ll continue to evolve our platform to stay ahead of the curve.

Visit our Trust Center to find answers to questions about our security posture. Need a copy of our latest certifications? Reach out to us at security@basistheory.com.

[Return to Top](https://blog.basistheory.com/achieving-iso-27701-certification#TOC)

[![View an Interactive Demo   See how the Basis Theory platform secures payment data and significantly reduces PCI compliance burden from day 1.  ](https://no-cache.hubspot.com/cta/default/22332934/interactive-171495116167.png)](https://blog.basistheory.com/hs/cta/wi/redirect?encryptedPayload=AVxigLIMWwTGTbx2X6vRECADVlDl%2BcnNEYEZVoXEWHX2Ev2%2BsoxGd36k6EGerSsbh%2B4pREy5YsQGec6G35BoCMqJWAqL7LSgFx0YOtH3acbWzloWfafoNy6Jmw17f7b6wPtd1k%2BeM0Eu0LZq7EmwIBrBrywVM5JtyrrnqyWwy5wsXXssn9dxs%2BAqH%2FM0PDl0IMGaav9K2f3eKmiSrh75%2BjtZ5WSkh4A%3D&webInteractiveContentId=171495116167&portalId=22332934)

## Related posts

[![Data portability and interoperability](https://blog.basistheory.com/hubfs/data-portability-interoperability.png)](https://blog.basistheory.com/data-portability-interoperability)

[Payments](https://blog.basistheory.com/tag/payments)

### [Payments Data Portability and Interoperability](https://blog.basistheory.com/data-portability-interoperability)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 March 11, 2024

[Read more](https://blog.basistheory.com/data-portability-interoperability)

[![what is a card-on-file transaction?](https://blog.basistheory.com/hubfs/card-on-file-transaction.png)](https://blog.basistheory.com/card-on-file-transactions)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [What is a Card-on-File Transaction and what is it used for?](https://blog.basistheory.com/card-on-file-transactions)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 January 27, 2023

[Read more](https://blog.basistheory.com/card-on-file-transactions)

[![What is tokenization?](https://blog.basistheory.com/hubfs/What%20is%20Tokenizaiton.png)](https://blog.basistheory.com/what-is-tokenization)

[Data Tokenization](https://blog.basistheory.com/tag/data-tokenization)

### [What to Know About Tokenization](https://blog.basistheory.com/what-is-tokenization)

![Picture of Brian Gonzalez](https://blog.basistheory.com/hs-fs/hubfs/Imported_Blog_Media/62b1da642fc5a096fc91429e_Gonzo.jpg?width=50&name=62b1da642fc5a096fc91429e_Gonzo.jpg) [Brian Gonzalez](https://blog.basistheory.com/author/brian-gonzalez) 

 February 19, 2026

[Read more](https://blog.basistheory.com/what-is-tokenization)

## Stay Connected

### Receive the latest updates straight to your inbox

### Follow on Social

<https://www.linkedin.com/comm/mynetwork/discovery-see-all?usecase=PEOPLE_FOLLOWS&followMember=colinthomasluce>

[![BTLogo (1)](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=138&height=46&name=BTLogo%20(1).png "BTLogo (1)")](https://basistheory.com)

- Use Cases 
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Remittance](https://basistheory.com/use-cases/remittance)
    - [Subscription Platforms](https://basistheory.com/use-cases/subscriptions)
    - [Online Travel Agencies](https://basistheory.com/use-cases/travel)
    - [Vertical SaaS](https://basistheory.com/use-cases/vsaas)
- Developers 
    - [Quickstart](https://developers.basistheory.com/getting-started)
    - [Elements](https://developers.basistheory.com/docs/sdks/web/javascript)
    - [Documentation](https://developers.basistheory.com/)
- Basis Theory 
    - [Pricing](https://basistheory.com/pricing)
    - [Add-Ons](https://basistheory.com/add-ons)
    - [ROI Calculator](https://go.basistheory.com/roi)
    - [Case Studies](https://blog.basistheory.com/case-studies)
    - [Blog](https://blog.basistheory.com)
    - [Contact](https://basistheory.com/contact)
- Other 
    - [Terms and Conditions](https://basistheory.com/resources/terms-of-service)
    - [Privacy Policy](https://basistheory.com/resources/privacy-policy)
    - [Cookie Policy](https://basistheory.com/resources/cookie-policy)
    - [Security](https://basistheory.com/security)
    - [System Status](https://status.basistheory.com/)
- Compare 
    - [Basis Theory Vs. Evervault](https://go.basistheory.com/evervault-alternative)
    - [Basis Theory Vs. IXOPAY](https://go.basistheory.com/alternative-to-ixopay)
    - [Basis Theory Vs. VGS](https://go.basistheory.com/compare/very-good-security)

---

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Brandon Sterne",
    "url" : "https://blog.basistheory.com/author/brandon-sterne"
  },
  "dateModified" : "2026-03-31T13:16:24.867Z",
  "datePublished" : "2026-03-31T13:15:58.000Z",
  "headline" : "Beyond the SOC 2: Why We Doubled Down on Privacy with ISO 27701",
  "image" : [ "https://blog.basistheory.com/hubfs/ISO27701.webp" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.basistheory.com/achieving-iso-27701-certification",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.basistheory.com/hubfs/BTLogo%20(1).png"
    },
    "name" : "Basis Theory"
  }
}
```