Why ‘trust us’ stopped being an answer: How PR.co became ISO 27001-certified

TL;DR: PR.co is now ISO 27001 certified. In this article, CEO Jeroen Bos explains why “trust us” stopped being enough, what the certification means in practice and how it helps our customers move through security reviews with greater confidence.

Key insights:

• Why PR.co decided to pursue ISO 27001 certification after years of relying on customer trust and internal security practices.

• How the changing role of PR has made independently verified information security a business requirement.

• What ISO 27001 certification actually covers, beyond a checklist of security tools and policies.

• How certification reduces procurement friction and gives enterprise customers independently audited proof of security practices.

• Why information security is an ongoing process of risk management and continuous improvement.

• What this certification changes for our current customers (basically, it’s business as usual).

To very little fanfare, an email landed in my inbox in July this year, with the subject line, “Congratulations, you’ve been ISO 27001 certified.” 

I remember thinking, “Is that it?” After nearly 10 years of building up to finally earning the ISO 27001 stamp of approval, I half-expected a courier and a wax seal.

On the other hand, the email’s subtlety reminded me that PR.co has been working this way for years. The certification didn’t change our practices. It simply made it official.

Of course, the certification also indicated how the nature and scope of our work (and our customers) have changed over the years. It says as much about where PR is today as it does about our PR software security practices.

Why did ISO 27001 certification become commercially necessary?

For years, not having the ISO 27001 certification wasn’t really a problem. We’d complete our customers’ security questionnaires, jump on calls with procurement, show people how we worked and eventually everyone was happy. 

But as we started working with larger, more regulated organizations, that approach stopped scaling. The questionnaires became more detailed, procurement took longer, and, in some cases, certification was simply a requirement.

If you’re not familiar with ISO 27001, an easy way to explain it is with an analogy:

Before a restaurant can display its food hygiene certificate, it must show an inspector that it handles food safely. Every so often, it has to prove it still meets the standard. But once it’s certified, the inspector doesn’t come back every time a regular customer walks through the door.

For us, it was much the same. Without ISO 27001 certification, many of the larger companies we spoke to wanted to gain a deep understanding of our security processes. We had to walk their security teams through our internal controls, answer every question and show we were already working to the same standard. In most instances, it worked. But it took time.

At some point I realized we were answering the same PR software security questions over and over. Eventually, we also started losing major opportunities to vendors who already had the certification. That was probably the moment when I thought, okay, this isn’t optional anymore. 

The interesting thing is that we weren’t pursuing the certificate because we suddenly discovered gaps in our security. I knew we already had most of the right practices in place. 

The challenge was to prove this in a way our customers could trust. Nothing did this better than an external, independent organization coming in, checking our systems and reporting back with a certificate showing we follow the practices we claim to follow.

For me, the certificate felt like another step toward growing PR.co into a more mature software company. 

Why did companies and their customers start caring so much?

GDPR and other privacy regulations reflect a growing need for companies to take control of how they handle and protect data. With hacks, ransomware, and data breaches being a serious threat, customers need to know they can trust companies with their information.

Over the last few years, AI has added another layer of complexity. Companies need to be sure their data won’t fall into the wrong hands or be used to train AI models without their permission.

AI has also made it easier to build new software tools. As more vendors enter the market, customers need stronger proof that the companies behind their software tools are trustworthy.

All these factors have made ISO 27001 certification increasingly important for software companies. 

What the ISO 27001 certification actually verifies

From the outside, ISO 27001 can look like just another certification: a box you tick, a stamp on your website. In reality, however, it’s evidence that your software company has built and documented a structured approach to information security.

As part of the certification process, you need to identify risks, decide how to address them, and make sure the relevant processes become part of daily operations. An independent auditor then checks that your documentation and systems match reality. They actually ask you to share your screen, log into your systems and show them you’re doing things the way you claim you are. If you don’t, you don’t get certified.

At PR.co, we had to provide them with overviews where (sensitive) data exists across the business, from our platform architecture and the tools we use to the way our team operates. We also had to ask ourselves a few tough questions. For example, “What happens if I’m suddenly unavailable? Who takes over? How do I make sure the business keeps running?”

Like many smaller companies, we naturally let some knowledge accumulate with only a few people. The certification forced us to document that knowledge and consider spreading responsibilities more deliberately across the team.

What ISO 27001 certification means for PR.co’s customers

If you’re already using PR.co, rest assured: The platform, the people and our services remain the same. What’s changed is the independent proof behind it. 

If, on the other hand, you’re evaluating us as a potential enterprise PR software partner, the difference will already show up during the procurement process. 

Security questionnaires about processes that used to take weeks of back-and-forth are now answered with documentation that’s already been independently checked. That means less time for your IT and legal teams, and a lower operational risk profile for your organization, since the controls behind our platform aren’t just self-reported anymore.

ISO 27001 also isn’t a one-time achievement, either. The certification is valid for three years, with annual surveillance audits in between. That means we’re expected to keep improving our security practices. This ongoing scrutiny gives both our customers and us confidence that the certification reflects how we currently work, not just how we prepared for an audit.

More than a certificate

We didn’t pursue ISO 27001 for another badge on our website. We did it because the way enterprise software is bought has changed, and because the companies we work with expect independent proof that their data is safe.

If you’re already a PR.co customer, not much changes. If you’re evaluating us as a partner, the difference is that your procurement, legal and security teams no longer have to rely on our word alone.

If you’d like to learn more about our approach to security and compliance, we’d be happy to walk you through it. Or, if you’re evaluating enterprise PR software, book a demo with Nelson, and he’ll walk you through what ISO 27001 means in practice and answer any questions your IT or procurement teams may have.

FAQs

1. What is ISO 27001? 

It’s the internationally recognized standard for information security management. 

Rather than prescribing specific tools or technologies, it requires organizations to build a structured information security management system (ISMS) to identify risks, protect information and continuously improve, with compliance verified through an independent external audit.

2. Does this change how I use PR.co? 

No. The day-to-day product experience stays the same. What’s different is that the processes behind how your data is handled have now been independently verified.

3. Why now? 

Cost and priority, mostly. For us, the certification process represented a substantial investment both in time, attention and money. For years, that investment didn’t immediately justify the investment, since we could walk our customers through our processes and controls manually.

As our customer base grew to include more regulated, demanding and, publicly listed organizations, that manual approach stopped working for us, and certification became the obvious next step.

4. Is this a one-time certification? 

No. Certification is valid for three years, with annual surveillance audits to verify that we maintain and continuously improve our information security management system. 

Continuous improvement means regular penetration testing, reviewing suppliers, updating our risk assessments and continuously improving how we protect customer information.

In other words, it’s a continuous commitment, not just a certificate in a frame on the wall.

5. Where can I find more details on PR.co’s security practices? 

Visit our Security and Compliance page for a full overview of our enterprise security program.

6. Does ISO 27001 certification mean our data is secure with PR.co?

Data protection and keeping our company and platform secure have always been a top priority for the PR.co team, with or without certification. ISO 27001 shows that our processes have now also been independently audited to identify risks, reduce them and continuously improve our security practices.