ISO 27001 Compliance
ISO 27001 compliance for credential management.
Map your credential handling directly to ISO 27001 controls. Give auditors clear evidence, not excuses.
What is ISO 27001?
ISO 27001 is the international standard for information security management systems (ISMS). It provides a framework for managing sensitive information securely — and auditors will ask how you handle credentials.
Risk-Based Approach
ISO 27001 requires you to identify risks to information assets — credentials are high-value targets.
Annex A Controls
93 controls across 4 themes. Multiple controls apply directly to how you store, share, and access credentials.
Audit Evidence
Auditors need to see documented processes and evidence. keyhold.io provides both.
ISO 27001 Control Mapping
Here's how keyhold.io helps you meet specific ISO 27001:2022 Annex A controls related to credential and authentication management.
Information Transfer
Information transfer rules, procedures, or agreements shall be in place for all types of transfer facilities.
How keyhold.io helps: Secure intake links let clients submit credentials directly — no email, no chat, no insecure file transfers. Credentials are encrypted in their browser before transmission and go straight into your vault.
Access Control
Rules to control physical and logical access to information shall be established and implemented.
How keyhold.io helps: Credentials are organised into clients and projects. Team members only see what they're assigned to. Access is explicit, not implicit.
Authentication Information
Allocation and management of authentication information shall be controlled, including advising users to keep it confidential.
How keyhold.io helps: Credentials are encrypted at rest and never exposed in plaintext until revealed by an authorised user. No credentials in email, chat, or tickets. Secure intake links let clients submit credentials directly.
Supplier & Client Credential Handling
Information security requirements shall be established for supplier relationships, and relevant security requirements shall be agreed with each supplier.
How keyhold.io helps: Demonstrates secure handling of third-party credentials supplied by customers or partners. Clients submit credentials through secure intake links, and all access is logged and auditable.
Protection of Records
Records shall be protected from loss, destruction, falsification, unauthorized access and unauthorized release.
How keyhold.io helps: Complete audit logs record every access event with user, timestamp, and IP address. Logs are immutable and exportable for compliance reporting.
Privileged Access Rights
The allocation and use of privileged access rights shall be restricted and managed.
How keyhold.io helps: Role-based access controls separate Admins and Members. Only assigned team members can access specific client credentials. Every privileged access is logged.
Information Access Restriction
Access to information and other associated assets shall be restricted in accordance with the access control policy.
How keyhold.io helps: Client and project boundaries enforce segregation. A team member working on Client A cannot access Client B's credentials unless explicitly assigned.
Secure Authentication
Secure authentication technologies and procedures shall be implemented.
How keyhold.io helps: All communication is encrypted in transit via TLS 1.3. User sessions are securely managed with industry-standard authentication practices.
Information Deletion
Information stored in systems, devices or other storage media shall be deleted when no longer required.
How keyhold.io helps: Supports defined retention periods and controlled deletion of stored secrets. Set expiry by time or view count, and permanently delete clients or projects when no longer needed.
Data Leakage Prevention
Data leakage prevention measures shall be applied to systems, networks and other devices that process, store or transmit sensitive information.
How keyhold.io helps: Credentials never touch email, chat, or support tickets. Zero-knowledge architecture means even a breach of our systems doesn't expose your secrets. Split-key encryption ensures data is unreadable without both keys.
Use of Cryptography
Rules for the effective use of cryptography, including cryptographic key management, shall be defined and implemented.
How keyhold.io helps: Industry-standard AES-256 encryption for all stored credentials. TLS 1.3 for all data in transit. Client-side encryption ensures secrets are encrypted before transmission.
Audit-Ready by Design
When the auditor asks "How do you collect client credentials?", show them keyhold.io.
"Give auditors evidence, not explanations."
Simple pricing. No per-seat fees.
Add as many people as you need. We don't charge per seat.
Billed monthly in GBP.
Billed annually in GBP.
Includes 5-day free trial
- Unlimited Secrets & Requests
- Encrypted File Sharing
- Unlimited Team Members
- Zero-Knowledge Encryption
- Full Audit Logging
- Chat Integrations
- IP Whitelisting
- Custom Branding
- Priority Support