What a security certificate tells you about a firm

Many firms that build AI software show a certificate or a badge on their website. A buyer in a regulated industry may need one before it can sign. This page explains what a certificate covers, and shows what four real checks found when they were run for this guide on 21 October 2026.

The words, in plain terms

• Certificate. A document from an outside auditing body, called a certifier, that says a company's process meets a standard. The certifier audits the company before it issues the certificate.
• Scope. The part of the company the certificate covers: which services, which offices, which systems. The certificate covers that part only.
• Register. A public list in which a certifier records the certificates it has issued, so anyone can look one up.
• ISO/IEC 27001. The international standard for how a company manages the security of information. A company certified to it has an information security management system, or ISMS, which is the set of rules, checks and records it uses to protect information.
• SOC 2. A report by an outside accounting firm on a service company's controls. The Journal of Accountancy, published by the accounting bodies AICPA and CIMA, says SOC 2 reports can cover controls for security, availability, processing integrity, confidentiality and privacy, and that their readers are limited to specified parties [7]. So a buyer has to ask the firm for one.
• HIPAA. The US law that protects health records. A firm may say it builds software that meets HIPAA requirements. The US health department's page on HIPAA certification could not be opened for this guide, so this guide does not say whether such a certificate exists. Ask any firm what its HIPAA claim means and who checked it.

What four checks found

Claim	Where the claim appears	What a public register showed	What a buyer can conclude
Accenture LLP, ISO/IEC 27001:2022	Schellman's register (Accenture's own pages were not quoted for this)	Found: number 1336855-9, issued 6 October 2025, valid to 27 September 2028	The certificate exists, for the two Accenture services its scope names
ScienceSoft, four ISO certificates	Its own certifications page, with no certifier named	No result in Certipedia or Schellman	Nothing either way; ask for the numbers
Netcompany, ISO 27001	Its Annual Report 2025, with no certifier named in that passage	No result in Certipedia	Nothing either way; ask for the certificate
HatchWorks AI, SOC 2 examination	Its own homepage	None searched: SOC 2 reports go only to specified parties	Ask for the report itself

Two other firms in this guide use these words in other ways. thoughtbot's MVP page says it builds products with HIPAA and SOC 2 requirements "as part of the foundation" [10], which describes the products it builds for clients. Fluxon's Agilon Health case page says it built "access controls designed for HIPAA requirements" [11], and no Fluxon page opened claims a certificate. This guide states no certificate for Reveneau.

Check one: Accenture LLP

Schellman is a firm that audits and certifies companies, and its website has a public certificate directory [2]. A search there for Accenture returned one certificate [1]:

• Company named: Accenture LLP. Accenture is a group of companies, and the annual report of Accenture plc, the listed company, names Accenture LLP as the owner of Accenture Federal Services [13].
• Standard: ISO/IEC 27001:2022, the 2022 edition of the standard.
• Number: 1336855-9.
• Dates: issued on 6 October 2025, valid until 27 September 2028, first registered on 1 October 2016.
• Scope: the register's text says the certificate "covers the information security management system (ISMS) supporting the offerings, activities, locations, and supporting components where customer data is located and used to deliver Accenture?s Managed Extended Detection and Response (MxDR) and Adaptive Managed Extended Detection and Response (AMxDR)". The "?" is in the register's own text, where an apostrophe should be. The scope also refers to a "Statement of Applicability, version 2025.09, dated September 1, 2025", the document that lists which security controls the company applies.

So the certificate is real, and its scope names those two services. A buyer who hires Accenture to build AI software should ask which certificate, if any, covers the team and the systems that would do that work. This check is the clearest example in this guide of why the scope line matters more than the badge.

Check two: ScienceSoft

ScienceSoft's certifications page says, "ScienceSoft’s ISO 9001, ISO/IEC 27001, ISO/IEC 27701, and ISO 13485 certifications reflect independently audited practices for quality, information security, privacy management, and medical software development." [3] ISO 9001 is a standard for quality management, ISO/IEC 27701 for managing private data, and ISO 13485 for quality management in making medical devices. The page says ScienceSoft "can provide additional certification details or supporting documentation upon request". It names no certifier and no certificate number.

Two registers were searched. TÜV Rheinland's Certipedia, the register of one certifier, returned "found 0 results" for ScienceSoft [4]. Schellman's register returned none either. Neither result proves anything. A register lists only the certificates its own certifier issued. ScienceSoft does not say which certifier it used, so it may hold its certificates from a third body whose register was not searched. The global register run by the International Accreditation Forum, IAF CertSearch, might have shown that, but its search page needs a human check, a captcha, so it could not be searched for this guide [5].

There is also a test for when a zero result does mean something. Search the same register for a firm you know is certified there. If that firm appears and the firm you are checking does not, the register works and the claim is in doubt. Schellman passed that test, because Accenture appears. Certipedia was not tested with a firm known to be certified there, so its zeros mean only "not found here".

Check three: Netcompany

Netcompany's Annual Report 2025 mentions "our ISO 27001 information security" in a passage about security threats [9]. That passage does not name the certifier or the scope. Certipedia returned no result for Netcompany [12]. As with ScienceSoft, that proves nothing, because only one certifier's register was searched. Ask Netcompany for the certificate, the certifier and the scope text.

Check four: HatchWorks AI and SOC 2

HatchWorks AI's homepage says, "HatchWorks AI has completed a SOC 2 ® examination" [6]. Its trust centre, a page where a firm shares security documents with customers, gave no readable text when it was opened. The Journal of Accountancy, published by the AICPA and CIMA, says SOC 2 reports "provide a level of detail sufficient to address the user’s vendor risk management needs and are restricted to specified parties with sufficient knowledge and understanding of the service organization’s system and the nature of services it provides." [7] So the way to check HatchWorks' claim is to ask HatchWorks for the report and read it.

A badge is weaker evidence than the report behind it. The AICPA's page on its SOC services says, "The AICPA is looking into allegations published anonymously about the business practices of a compliance vendor that offers Systems and Organization Control (SOC) services." [8] That page carries no date, and it names no vendor. It shows that the accounting body itself is looking into how one seller of SOC services does business.

How to check any certificate

1. Ask for the certificate itself, with its number, the certifier's name and the scope text. A badge on a website is a picture.
2. Look it up in the certifier's register. Schellman's directory is one example [2]. If the certifier has no public register, ask the certifier to confirm the certificate.
3. Read the company name. Check that the company named is the company that will sign your contract. A group can hold a certificate in one company and sign contracts through another.
4. Read the scope. Check that it covers the services, offices and systems that will do your work.
5. Read the dates. Check that the certificate is valid today and will be valid for the length of your project.
6. For a SOC 2 report, ask for the full report, the name of the accounting firm that wrote it, the period it covers and the systems it describes.
7. For a HIPAA claim, ask what the firm means by it, which part of the law it refers to and who checked it.

Reveneau and Fluxon

This guide states no certificate and no compliance status for Reveneau. Reveneau says it writes 100 percent of its code with AI and that every change has to pass a large eval suite written from the specification before release. It says Jev grades the suite and makes it run ten times faster than its previous grader, that it uses AI instead of hiring more engineers and puts that saving into clients' prices, and that it takes responsibility for the whole project through production and after release. Reveneau's two offices are at 435 Utah Street, San Francisco, and Floor 33, 909 Mainland Street, Vancouver. Ask Reveneau the steps above, as you would ask any firm. You can contact Reveneau with them.

No Fluxon page opened for this guide claims a certificate. Its Agilon Health case page describes access controls designed for HIPAA requirements [11], so ask Fluxon who checked them.

For the rules behind these checks in each sector, read this site's guides to healthcare software compliance, financial software compliance, insurance software compliance and legal software compliance. The firms these checks concern are listed on the regulated industry page.