Aleph FrontThe information security management system (ISMS) of Aleph Archives Sàrl, the company that publishes Aleph Front and builds ANOM, has been independently assessed and found to conform to ISO/IEC 27001:2022, the international standard for information security management.
A B2B commerce platform is not a brochure. It holds the price each customer negotiated, the full history of what they bought, the people allowed to order on their behalf, their delivery addresses, and the connections to their purchasing systems. Our clients trust us to run that platform every day. ISO/IEC 27001 gives them, their auditors and their own customers independent assurance that the controls protecting it are designed, operated and reviewed to an internationally recognised standard.
Why ISO 27001 matters for a commerce platform
Ask a distributor what would hurt most after a breach, and the answer is rarely the website itself. It is a competitor reading its price lists. It is a customer account taken over and used to place orders. It is a week without orders because the shop is down during the busiest season. Those are the three properties at the heart of ISO/IEC 27001: confidentiality, integrity and availability.
B2B buyers already ask about them. Large customers send security questionnaires before they connect their procurement suite through PunchOut, or open an EDI link with a supplier. European rules such as NIS2 push them to check the security of their suppliers, and of the platforms those suppliers run on. Who can access the back-office? How are changes controlled? How are incidents handled? How is the platform tested? A certificate does not replace those questions, but it answers many of them with evidence an independent auditor has already examined.
What the certificate covers
The certificate covers the ISMS of Aleph Archives Sàrl. Its scope is the design, development, operation, hosting and support of the company’s digital services, which is the work we do for every Aleph Front client. The ISMS applies in accordance with our Statement of Applicability (SoA) v1.0, dated 19 September 2026.
- Organisation: Aleph Archives Sàrl
- Standard: ISO/IEC 27001:2022
- Certification body: GCAI, accredited by the International Accreditation Service (IAS)
- Certificate number: GCAI-ISMS-ZA67
- Initial certification: 13 October 2026
- Expiry: 12 October 2029
The certificate can be verified independently on IAF CertSearch.
How we got there
Certification is the outcome of a programme, not a single audit. Three independent parties each played a distinct role.
Running the ISMS every day. We built the ISMS on a compliance automation platform. It mapped our existing practices to the ISO/IEC 27001:2022 controls, helped us formalise our policies, monitors those controls continuously across our infrastructure and keeps the evidence in one place. The result is a management system that runs every day, not one assembled once a year for the audit.
Testing the defences. A management system is only as good as the security of what it protects. An independent penetration testing firm attacked our platform and reported each finding with a reproducible proof of concept and a remediation path. Our engineers fixed them, and the re-test confirmed that every critical, high and medium issue was resolved. The engagement closed with an A+ grade.
Certifying it. The certification audit was conducted by GCAI, an independent body accredited by the IAS. Its auditors examined the ISMS, the Statement of Applicability and the evidence behind each applicable control before issuing the certificate.
That separation matters. The party that helps you build an ISMS should not be the one that certifies it, and the party that certifies it should itself be accredited. This is what gives an ISO/IEC 27001 certificate its weight with customers and regulators.
What sits under the certificate
ISO/IEC 27001:2022 lists 93 reference controls in its Annex A, grouped into organisational, people, physical and technological themes. On an Aleph Front platform, several of them are things you can see:
- Access control. A role per job in the ANOM back-office (sales, customer service, finance, catalogue, stock), two-factor authentication, and accounts disabled in one click with their history kept.
- Protection against attacks. ANOM Nullgate, our web application firewall, drops bots, scrapers and attack traffic before they reach the shop.
- Backup and continuity. The 3-2-1 rule: three copies on two kinds of storage, one kept offline. A backup every 15 minutes, encrypted at rest, with restores tested regularly.
- Monitoring. More than 400 indicators measured every second, and an alert reaches our team as soon as one leaves its normal range.
- Data location. Shop, database, backups and logs hosted in the European Union, fixed in the contract.
- Privacy. GDPR anonymisation built into the back-office.
What this means for our clients
- Faster vendor due diligence. Our certificate and Statement of Applicability can support your customers’ security questionnaires and your own third-party risk assessments.
- Independent assurance. The controls protecting your shop, your price lists and your customer accounts have been reviewed by an accredited third party, not only described by us.
- One less gap in your own audits. If your company is itself certified, or working towards it, a certified commerce provider is one supplier less to justify.
- Ongoing oversight. ISO/IEC 27001 is not a one-off. The certificate is subject to annual surveillance audits and full recertification, so the controls you rely on today will keep being tested.
Clients and prospects who need a copy of the certificate for their compliance files can contact us.
What comes next
ISO/IEC 27001 is a milestone, not a finish line. We are already working towards a SOC 2 Type II report, which will complement the certificate with an independent account of how our controls operate over time.
Thanks to everyone involved in the audit and the penetration test for their rigour, and to our own engineering and operations teams for the work behind this result.
