Certifications & Compliance

An overview of Carriyo's security certifications, compliance frameworks, and regulatory adherence.

Last updated October 2026

ISO 27001:2022

Certified

Carriyo holds ISO 27001:2022 certification, the international standard for information security management systems (ISMS). This certification demonstrates our systematic approach to managing sensitive company and customer information, ensuring it remains secure.

Scope of certification

Design, development, and operation of the Carriyo SaaS platform
Cloud infrastructure management and security operations
Customer data processing and storage
Internal corporate IT systems and employee security practices

Certification details

Standard

ISO/IEC 27001:2022

Certification cycle

3-year cycle with annual surveillance audits

Certifying body

Available upon request

Certificate availability

Available via Request Documents

SOC 2

Planned for 2027

SOC 2: not certified; planned for 2027. Our ISO 27001-certified ISMS already addresses many of the same trust service criteria, including security, availability, and confidentiality controls. Contact us if you have questions about our compliance posture.

GDPR

Compliant

Carriyo processes personal data in compliance with the General Data Protection Regulation (GDPR). As a data processor, we implement appropriate technical and organizational measures to protect personal data and support our customers in meeting their obligations as data controllers.

Compliance measures

Data minimization and purpose limitation practices
Right to erasure and data portability support
Sub-processor transparency (see Sub-processors)
Breach notification to affected customers without undue delay
Data retention and secure disposal per the customer agreement