Is easyAML ISO 27001 certified?
Yes. easyAML is certified to ISO/IEC 27001:2022, the latest version of the international standard for information security management.
Yes. easyAML is certified to ISO/IEC 27001:2022, the latest version of the international standard for information security management systems and is the de-facto baseline for enterprise SaaS in Australia. The certificate can be found here.
What is ISO 27001?
ISO 27001 is the world’s most widely recognised standard for managing information security. It’s often used as the baseline for software providers that handle sensitive information, particularly for banks, government agencies and listed companies in Australia.
To be certified, a company must show an independent, accredited auditor that it has a formal system for protecting information. This is called an Information Security Management System (ISMS). Being certified means that system has been checked from the outside. It is not just something the company says about itself.
What does this mean for your information?
When you use easyAML, you share personal and business information such as identity documents, customer details and verification results. Our ISO 27001 certification means:
- Security risks are formally assessed. We regularly identify what could go wrong with the information we hold and put measures in place to reduce those risks.
- Access is controlled. Only people who need access to information to do their job can get it, and that access is reviewed.
- Information is protected in storage and in transit. We use measures such as encryption to protect data.
- Our staff are trained. Our team is trained in security responsibilities and safe handling of information.
- Incidents are planned for. We have documented processes for detecting, responding to and learning from security incidents.
- Suppliers are held to account. Third parties that handle information on our behalf are assessed and managed.
- We are checked every year. Certification isn’t a one-off. Independent auditors review us every year, and we must be fully recertified every three years.
What certification doesn’t mean: No standard can guarantee that a security incident will never happen. What ISO 27001 does show is that we take a structured, independently verified approach to preventing incidents and responding quickly if one occurs.
Our identity verification partner: Scantek
easyAML works with Scantek, which acts as our Approved Gateway Service Provider for the Document Verification Service (DVS). The DVS is a government service that checks whether identity documents (like a driver’s licence or passport) match the records held by the issuing agency. Approved gateway providers are the authorised channel through which businesses can access it. Scantek has held this approval since 19 October 2018.
Scantek is also independently certified to ISO/IEC 27001:2022, the latest version of the standard. This means that the partner handling document verification on our behalf meets the same international security standard.
Common questions
Can I see proof of certification?
Yes. Our certificate is available here. For more detailed security documentation, please contact our privacy officer at privacy@easyaml.com.
Does easyAML store my identity documents?
easyAML stores the information needed to complete identity checks only for as long as it’s required, generally to meet legal obligations. Data is held on secure servers in Sydney, Australia, and is encrypted both while it’s being sent and while it’s stored. Full details about what we collect, how it’s stored and how long we keep it are in our Privacy Policy & Collection Notice. If you have questions that aren’t answered there, contact us at privacy@easyaml.com or on 1300 425 495.
Who else can see my information?
Information is only shared with the parties needed to complete your verification. This includes the business that requested your check and Scantek, which provides our identity verification services. All of them are subject to security and contractual requirements. See our Privacy Policy & Collection Notice for full details.