Rivulo is now ISO 27001 certified

Rivulo is now ISO 27001 certified

When you buy software, you hand a vendor your data. When you buy Rivulo, you hand us rather more.

The model is simple: you record a process once, and we build and run the automation that does it for you. That means access to the systems the process actually lives in, usually some combination of booking platform, accounting package, supplier portal and inbox, and occasionally a legacy system with no API that we drive through a browser using credentials you have issued us.

It is fair to ask what sits behind that much access. As of 1st of September 2026 part of the answer is independent: Rivulo is certified to ISO/IEC 27001:2022

What ISO 27001 actually is

ISO 27001 is the international standard for information security management, and the management half is the part people skip. The certificate says an organisation runs a working system for finding security risks, deciding what to do about them and checking that those decisions still hold. It says nothing about whether any given product is secure.

An accredited certification body audits you in two stages: first the documentation, then a deeper audit of whether you do the things the documentation claims. The certificate runs for three years with surveillance audits in between, so it lapses if the practice does.

The 2022 revision covers 93 controls across four areas: organisational, people, physical and technological. Which of those apply to us, and why, is set out in our Statement of Applicability, which we publish in full.

What changed here

Some of this we were already doing and had to evidence properly. Some of it we were not.

• Access to client environments is role-based and time-bound with MFA & SSO enforced. Joiners, movers and leavers run off a checklist rather than off someone's memory.

• Automations move through a defined lifecycle (planned, building, testing, live, retired) with change review, separated environments and a record of who deployed what and when. Nothing reaches your live systems on a whim.

• Every sub-processor in the chain is assessed and recorded, including the model providers and integration platforms we build on.

• Incident response has named owners and defined notification timelines, and we test it.

• What happens to your data, your credentials and your automations when you leave is written down before you start, not negotiated afterwards.

What it means if you are buying from us

Mostly, it means fewer weeks lost to admin.

Security review is often the longest stage of an automation purchase, particularly in multi-site operations and anywhere procurement has a vote. A certificate and a Statement of Applicability answer a good share of a standard questionnaire outright, and give your security team something defined to inspect.

It also means the questions we ask at the start have a reason behind them. When we decline a shared admin login and ask for a scoped service account instead, that is not us being difficult.

What it does not mean

Certification is a floor. Any certificate is only as meaningful as its scope, which is why ours is stated in full:

The Information Security Management System at Rivulo Ltd applies to the technical infrastructure, applications and systems that ensure the delivery of the Rivulo workflow automation platform and its related services to its customers. It also includes the technical activities which hold, obtain, share or manage customer and business data, and the business functions of Engineering, Product Management, Customer Support, Business Development & Sales, and Corporate Administration. Statement of Applicability Version 1.1, approved 1 September 2026

If a vendor shows you a certificate without telling you what it covers, that is worth a question.

It also does not make us immune to anything. It means we run a system for spotting problems, fixing them and proving we did.

The evidence

The certificate, the scope statement, the controls we hold and the sub-processors we rely on all live at trust.rivulo.ai. It is there so your security team can check us over without booking a call first. If something you need is missing, ask and we will add it.