Executive Summary

Utila is now ISO/IEC 27001:2022 certified, adding an internationally recognised information security management standard to our existing SOC 2 Type II assurance. These complementary assessments provide independent validation of our information security programme and give institutions evidence to support their vendor due diligence. This article explains what our ISO 27001 certification covers, how it complements SOC 2 Type II, and how institutions can use both assessments when evaluating our infrastructure.

Independent Assurance for Institutional Operations

Banks, fintechs, and investment firms building digital asset custody, stablecoin payments, and treasury services need to assess the security of the infrastructure supporting those operations. Their vendor reviews examine how providers identify risks, protect information, and demonstrate that security controls work over time.

Utila supports more than 400 companies and over $30 billion in monthly volume. Our ISO/IEC 27001:2022 certification adds to our existing SOC 2 Type II assurance, giving these institutions further independent evidence to inform their reviews. Together, the assessments provide insight into our security management and the operation of our controls, supported by more than one independent auditor.

Security and procurement teams can use the ISO certificate to establish the scope of our certified information security management system, alongside the SOC 2 Type II report’s findings on control effectiveness. This gives them a documented basis for assessing our security practices against their own requirements and identifying questions to address during vendor due diligence.

What Our ISO 27001 Certification Demonstrates

ISO/IEC 27001:2022 sets requirements for an information security management system, or ISMS. It establishes a structured approach to identifying risks, selecting appropriate controls, and reviewing how effectively information is protected.

The standard addresses security across people, processes, and technology. It requires defined responsibilities, internal audits, management review, and continual improvement, making information security an ongoing organisational discipline.

Our certification provides independent assurance that the management system within its stated scope meets these requirements. Customers can request the certificate to confirm the certified scope and assess its relevance to the services they plan to use.

How ISO 27001 Complements SOC 2

ISO 27001 and SOC 2 Type II provide complementary perspectives on our security programme. The certification addresses the management system used to govern information security while the SOC 2 report examines the controls included in its scope and their operation over time.

Together, these assessments give security and procurement teams a broader evidence base for vendor reviews. They can examine how we govern information security alongside independently tested controls, then assess that evidence against their own operational and risk requirements.

“Banks need evidence they can use to assess the providers supporting their digital asset services. This certification gives their security and risk teams an independently assessed basis for reviewing how we manage information security, alongside our SOC 2 Type II report.”

- Erez Levi, Director of Information Security, Utila

Security Controls Behind Our Infrastructure

Our ISO 27001 certification and SOC 2 Type II report complement the technical safeguards built into our security architecture. These safeguards govern how signing keys are protected, who can authorise transactions, and how access can be recovered following disruption.

Our MPC-ECDSA implementation enables Utila and the customer to jointly sign transactions while keeping their respective private-key shares confidential. Signing control is distributed between the two parties, with customer device key shares bound to specific users and devices. Biometrics and passkey support provide additional protection for access to those shares.

We also support HSM-based digital asset custody, allowing institutions to retain transaction-signing keys inside compatible hardware security modules under their own control. The HSM protects the keys and performs signing, while Utila coordinates transaction policies, approvals, compliance workflows, blockchain connectivity, and transaction records. This connects the institution’s hardware security controls to the operational capabilities required to manage digital assets.

Recovery is another part of that operational design. Our offline backup and recovery process allows approved customer administrators to restore access following lost or damaged devices, with third-party backup options also available.

Customers can evaluate these capabilities alongside our ISO certificate and SOC 2 report to assess how our infrastructure fits their own security requirements.

Security Assurance Across Institutional Use Cases

Our ISO 27001 certificate and SOC 2 Type II report support due diligence across the institutions using Utila. Each organisation can review this evidence in the context of its intended use, whether it is operating customer wallets, settling payments, or managing its own digital assets.

We support banks building digital asset custody and tokenized deposit services, and fintechs embedding wallets and transfers into their products. Payment service providers can manage stablecoin pay-ins, payouts, and settlement while integrating transaction screening and reconciliation into their workflows.

Trading firms and asset managers use Utila to manage capital across exchanges and DeFi protocols, with approval policies for transfers and trading activity. Corporate treasury teams can oversee balances across wallets and blockchains, organise permissions, and maintain transaction records for financial reporting.

Further Investment in Security and Resilience

We are also working towards certification under the Cryptocurrency Security Standard (CCSS) and ISO 22301. These initiatives address cryptocurrency-specific security controls and business continuity management, respectively, and form part of our ongoing work to broaden independent assurance across the services institutions rely on.

Visit our Trust Center to request our ISO 27001 certificate, SOC 2 Type II report, and supporting security documentation. Our team can help you understand the scope of each assessment and review how our infrastructure fits your organisation’s security and operational requirements.

FAQ

What Is ISO/IEC 27001:2022?

ISO/IEC 27001:2022 is an international standard for information security management systems. Certification demonstrates that an organisation’s ISMS meets the standard’s requirements within a defined scope, including requirements for risk management and continual improvement.

How Does ISO 27001 Differ From SOC 2?

ISO 27001 certification evaluates an information security management system against the standard’s requirements. SOC 2 Type II is an attestation report covering the design and operating effectiveness of scoped controls over a defined period. The two provide complementary evidence for assessing a provider.

What Is the Benefit of Meeting Multiple Security Standards?

Complementary assessments give customers a broader evidence base for evaluating a provider’s security programme. They can review how risks are governed alongside independent testing of controls, compare the findings against their own requirements, and identify areas for follow-up during due diligence.