Pantheon Achieves ISO 27001 Certification, Giving Enterprise Web Teams a Clearer Path Through Security Review

SAN FRANCISCO – November 5, 2026 – Pantheon.io, the platform for helping professional teams create, run, and evolve the sites that matter, today announced it has achieved ISO 27001 certification, the internationally recognized standard for information security management. Awarded by Grant Thornton LLP, the certification covers all of Pantheon’s business and builds on the company’s latest SOC 2 Type 2 report, which received an unqualified opinion and showed zero control exceptions.

For enterprises, security and compliance are part of choosing a web platform from the very start. Security, procurement, risk, and IT stakeholders need confidence that a provider has a mature, repeatable approach to protecting information, and ISO 27001 is designed to provide it. The standard sets the requirements for an information security management system, defining a structured approach to identifying risks, putting the right controls in place, and continually improving them. Certification requires an independent audit against the standard.

“Enterprises need proof, not promises, that the platform behind their most important sites takes information security seriously,” said Joey Stanford, Chief Information Security Officer at Pantheon. “ISO 27001 reflects how we already operate, with security managed as an everyday discipline across the entire company, not a box we check once. For our customers, it means fewer hurdles in vendor review, so they can spend less time on paperwork and more time on the work that matters.”

Pantheon pursued the certification in response to the expectations of enterprise customers worldwide, particularly in Europe and other markets where ISO 27001 is a standard part of vendor evaluation. For teams reviewing Pantheon, it provides a trusted reference point that can help reduce friction during security reviews and procurement, so projects can move forward faster.

The certification complements Pantheon’s recent SOC 2 Type 2 examination, an independent audit of a provider’s security and availability controls over an extended period. The report received an unqualified opinion with zero control failures, meaning the auditor concluded Pantheon’s controls were designed and operated effectively, giving customers added assurance that its safeguards hold up in day-to-day practice.

Together, these third-party validations reflect Pantheon’s ongoing investment in keeping WordPress, Drupal, and Next.js sites secure as teams build, deploy, and operate them at scale.

To learn more about Pantheon’s security and compliance approach, click here.

Media Contact

Sarah Kolar

Pantheon@pancomm.com