Brickken Achieves ISO/IEC 27701 and ISO/IEC 27018 Certification

‍When institutional clients evaluate a tokenization platform or infrastructure, they are not only assessing what it can do, they are assessing what happens to their data, too. 

Brickken has now received formal certification to two more international standards, ISO/IEC 27701 and ISO/IEC 27018, reinforcing its approach to privacy governance and cloud data protection across its infrastructure.

The question every institutional client asks

Banks, asset managers, family offices and regulated enterprises do not onboard platforms casually. Before any contract is signed, legal and compliance teams want to understand one thing above all else: what controls govern the personal and financial data that will flow through this system?

For Brickken, this question is capital. The platform processes sensitive data at multiple levels: issuer documentation, investor onboarding records, KYC and AML outputs, beneficial ownership information, and data tied directly to regulated financial instruments. Handling this data responsibly is not a secondary obligation. It is a precondition for institutional trust.

The ISO/IEC 27701 and ISO/IEC 27018 certifications are Brickken's formal, audited answer to that question.

You can find the certifications here:

• ISO/IEC 27701
• ISO/IEC 27018

What the certifications cover

The two standards address complementary dimensions of the same problem.

ISO/IEC 27701: Privacy governance as an operating system

ISO/IEC 27701 is the international standard for implementing and maintaining a Privacy Information Management System (PIMS). Achieving certification means Brickken has not only written privacy policies. It has put in place the processes, controls, accountabilities, and evidence required to manage personal data in a structured, responsible, and auditable way.

In practice, this covers:

• Who is responsible for privacy within the organisation, and how decisions are made
• How personal data is collected, processed, stored, shared, retained, and deleted
• Brickken's obligations when acting as a data controller, a data processor, or both
• Privacy by design, meaning privacy is integrated into products and processes from the outset, not layered on afterwards
• Controls over third parties and sub-processors, including KYC providers and technology infrastructure partners
• Processes for responding to data subject rights: access, rectification, erasure, and portability
• Identification, assessment, and mitigation of risks associated with personal data processing

For institutional clients, ISO/IEC 27701 answers the question: how does Brickken manage privacy as an internal operating discipline?

ISO/IEC 27018: Cloud data protection with specific controls

ISO/IEC 27018 addresses a more specific context: the protection of personally identifiable information (PII) in public cloud computing environments. 

Brickken is a SaaS infrastructure company. Its clients' data is processed in the cloud. This certification provides formal assurance that Brickken has implemented controls adapted to that environment.

Those controls include:

• Ensuring personal data is used only for the purposes for which it was collected
• Transparency around sub-processors that may access or handle personal data
• Data separation and confidentiality controls to prevent unauthorised access or misuse
• Defined practices for returning, deleting, or managing personal data at the end of a contractual relationship
• Restricted internal access, with defined privileges, authorisation, and audit trails
• Security controls adapted specifically to cloud-based data processing environments

For institutional clients, ISO/IEC 27018 answers the question: how does Brickken protect personal data processed within cloud environments?

‍

What this means for our clients

For all our clients that use our SaaS or who build on Brickken's infrastructure, these certifications have direct and practical relevance.

During due diligence, procurement, and enterprise contracting, clients and their legal teams increasingly require evidence of data protection controls that go beyond a published privacy policy. ISO/IEC 27701 and ISO/IEC 27018 provide internationally recognised, independently verified evidence that those controls exist and are operating.

Specifically, clients can expect:

• Structured, auditable privacy management across all personal data Brickken handles on their behalf
• Defined controls over how that data is processed within cloud environments
• Accountability and traceability, with evidence available for regulatory review or internal audit
• Third-party and sub-processor management aligned with their own compliance requirements
• Privacy governance that supports, rather than complicates, regulatory alignment under frameworks including GDPR and other applicable privacy regimes

‍

Privacy as infrastructure, not compliance overhead

There is a tendency in technology to treat privacy certification as a box-ticking exercise, something to complete, file, and reference in procurement questionnaires. That is not the position from which Brickken has approached this.

Tokenization involves bringing real financial assets and real investor data onto digital infrastructure. The regulatory and reputational stakes are high. Institutions that adopt tokenization at scale need to be confident that every layer of the stack they are building on, including the providers they rely on, operates to standards consistent with their own obligations.

ISO/IEC 27701 and ISO/IEC 27018 certification is proof of Brickken's commitment that privacy is part of the infrastructure, not a policy document.

This build on Brickken´s existing builds ISO/IEC 27001 certification, archived in March 2026

‍