Skip to main content
ThreatAware is independently audited against international information security standards. Certificates and audit reports are available under NDA — contact your account manager or security@threataware.com.

Current certifications

ISO/IEC 27001

Certified. Annual surveillance audit; full recertification every three years. Scope covers the ThreatAware platform including Dimension.

UK Cyber Essentials

Certified. Annual reassessment. Aligned with UK government baseline cyber controls.

Frameworks & alignment

Beyond formal certification, the ThreatAware platform is designed to align with:
  • NIST Cybersecurity Framework (CSF) — Identify / Protect / Detect / Respond / Recover
  • NIST 800-53 controls for moderate-impact systems
  • CIS Controls v8 — relevant safeguards mapped to our control library
  • GDPR — for EU customers and EU data subjects, supported by a Data Processing Agreement (DPA)
  • UK Cyber Essentials — aligned
A control-mapping spreadsheet (ISO 27001 ↔ NIST CSF ↔ CIS Controls) is available on request.

Scope

The current ISO 27001 certificate covers:
  • Entities — ThreatAware Ltd
  • Services — ThreatAware cyber asset attack-surface platform, including the Dimension add-on
  • Locations — UK head office plus AWS data centres in the regions we operate in
  • Functions — Software development, customer support, platform operations, sales, marketing

Audit cadence

Sub-processors

The ThreatAware sub-processor list (cloud providers, AI providers, observability vendors, support tools) is maintained and provided on request. We notify customers in advance of any change that affects data processing.

Data residency

Customer data is hosted in the AWS region your tenant was provisioned in. Cross-region replication is for backup/disaster-recovery only and stays within the same regulatory zone.

Requesting evidence

For audit certificates, the ISO 27001 Statement of Applicability, Cyber Essentials certificates, penetration-test summaries, DPAs, BAAs, or sub-processor lists:
  • Email — security@threataware.com
  • Account manager — for active customers, your AM has these on file
  • Sales — sales@threataware.com for vendor-review packs during procurement
All audit reports are released under NDA.

Reporting concerns

If you’re a customer, auditor, or researcher and have a concern about our compliance posture, email security@threataware.com. We acknowledge within one business day.