Is Trace ISO 27001 certified?

Not yet, but we're working on it. Trace has engaged Prescient Security, an accredited, independent certification body, to certify our information security management system against ISO/IEC 27001:2022, the international standard for information security.

What is ISO 27001?

ISO 27001 is the world's best-known standard for managing information security. A certified company has shown an independent auditor that it has a working system to identify security risks, protect information and keep improving over time: not just once, but year after year.

Where we are

Certification is done by an independent auditor in two stages:

1. Stage 1: readiness review. The auditor reviews our security policies, risk assessments and procedures.
2. Stage 2: in-depth audit. The auditor checks that those policies are actually followed in practice, by looking at records, interviewing staff and observing how we work.

Once certified, the auditor checks us again every year to make sure we keep meeting the standard.

We'll update this page when our certification is issued.

Independent security testing

We don't wait for certification to have our security checked:

• Penetration testing. Every year, independent security specialists test Trace's defences by trying to break in the way a real attacker would. Our latest test, in September 2026, found no critical, high or medium-risk issues. The few minor findings were fixed, and the testers confirmed the fixes in a follow-up re-test.
• QuickBooks App Store. Trace also completed a full penetration test as part of its QuickBooks App Store certification.

Learn more

Read How does Trace keep my data secure? for an overview of how we protect your data.

Need more detail for a security review or questionnaire? Email security@our-trace.com.