Key takeaways
- BrightEdge and Conductor list the widest attestation sets on their own pages (ISO 27001 plus SOC 2, and ISO 42001 for both). Profound is the loudest on SOC 2 Type II, HIPAA and SSO. Promptwatch certified to ISO 27001:2022 on October 26, 2026.
- A SOC 2 report is an attestation. ISO 27001 is a certificate with a scope line. "Compliant" and "aligned with" are marketing words until you see the document.
- Botify's last verifiable public SOC 2 news is a Type 1 announcement from December 2021. Ask for the current Type 2 report.
- Several claims below come from vendors themselves, including Profound's comparison page and Promptwatch's own 17-platform check. Treat them as claims and verify.
- Request the report, the scope, the SSO and audit-log details, and the data-handling terms before the demo, not after.
Why security decides this shortlist
Most AI visibility buying guides rank vendors on prompts tracked, engines covered and price. Then the security questionnaire lands and half the shortlist stalls. Procurement security sign-off can take several weeks, according to Promptwatch's own write-up on ISO 27001, so it is worth knowing early who can actually pass.
This guide compares five platforms that show up in enterprise evaluations: Promptwatch, Profound, BrightEdge, Conductor and Botify. It sticks to what each vendor publishes, flags what I could not verify, and tells you which documents to ask for. I did not verify Conductor's or Profound's trust pages directly, so some of their details come through secondary sources and I say so.
The short comparison
| Platform | ISO 27001 | SOC 2 | Other stated items | Confidence |
|---|---|---|---|---|
| Promptwatch | Certified, ISO/IEC 27001:2022 + Amd1:2024 (Oct 26, 2026) | Not verified | Crawler logs limited to 10 fields per bot request; human requests dropped before saving | High for ISO (certificate details published); SOC 2, SSO and HIPAA unverified |
| Profound | Not found on public security pages (per Promptwatch's check) | Type II, assessed by Sensiba LLP (vendor claim) | HIPAA, SAML/OIDC SSO, RBAC, daily backups, SCIM, audit log (per third-party summaries) | Vendor claims; wording varies between "certified" and "compliant" |
| BrightEdge | ISO 27001:2022 certified | Labelled "SOC2 Certified"; type not stated | ISO 27701, ISO 42001, NIST CSF, NIST AI RMF, GDPR, CCPA, Data Privacy Framework, SAML SSO, annual pen test | High: all on its Trust page |
| Conductor | Listed on enterprise pages per Promptwatch's check; not verified by me | Type II (documents on request) | ISO 42001, SAML SSO, annual third-party pen tests, DPA terms | Medium: via secondary sources |
| Botify | Could not confirm | Type 1 announced Dec 2021; Type 2 was planned | None confirmed | Low: stale |
Two things stand out. First, no single vendor wins every column. Second, the biggest differences are not who has a badge but how recent, how scoped and how checkable it is.
SOC 2 vs ISO 27001: read the paperwork correctly
Before comparing vendors, get the vocabulary straight, because marketing pages blur it.
A SOC 2 report is an attestation written by an auditor. It is not a certificate. Type 1 describes controls at a point in time. Type 2 tests them over a period, which is what most security teams want. ISO 27001 is a certificate issued by an accredited body, valid for three years with annual surveillance audits (see Scrut's SOC 2 vs ISO 27001 explainer).
A few practical checks:
- ISO 27001:2013 certificates became invalid after October 31, 2025. Any valid certificate should reference the 2022 version.
- The scope line matters. A certificate that covers the company's HR processes does not cover the SaaS platform that stores your prompts.
- "Aligned with" or "compliant with" ISO 27001 says less than an accredited certificate.
- Annex A of ISO 27001:2022 has 93 controls in 4 themes. You do not need to read them all, but you should ask which are excluded in the Statement of Applicability.
Promptwatch
Promptwatch is an AI search visibility and GEO platform that tracks brands across ChatGPT, Google AI Overviews, Gemini, Perplexity, Claude and others, and goes further than monitoring with a content agent and an action board.
On security, the concrete public fact is its ISO certification. Promptwatch B.V. in Amsterdam was certified to ISO/IEC 27001:2022 + Amd1:2024 on October 26, 2026, per its announcement:
- Certification body: ProCertify B.V. (Apeldoorn), accredited by the Dutch Accreditation Council (RvA, registration C 707).
- Certificate number 27001 26102026.2, valid until October 26, 2029, with annual surveillance audits.
- Statement of Applicability v1.0, dated September 14, 2026.
- Scope: the information security management system for development, implementation and customer support of the Promptwatch SaaS platform.
- Customers can get a copy from their Promptwatch contact or support.
The data-handling detail is useful for security teams. The scope covers tracked prompts, collected AI answers and citations, and crawler log records. Crawler log records are limited to 10 fields per bot request, and human visitor requests are dropped before anything is saved. That matters if you are nervous about pointing a CDN log feed at a third party.
What I did not find: public Promptwatch SOC 2, SSO or HIPAA claims. They may exist, but I will not assert them. If those are gating items for you, ask directly.
One more caveat. Promptwatch's claim that it is the only AI-native platform among 17 checked with its own ISO 27001 certificate comes from its own check on October 26, 2026. It is a vendor claim, and a snapshot. Still, it is a specific and falsifiable one, which is more than most vendors offer.
For crawler analytics, Promptwatch counts only requests whose source IP matches the operator's published ranges, so spoofed user agents are excluded, according to Promptwatch Data's AI crawler report (June 8 to September 6, 2026). It works with Cloudflare, Vercel, Fastly and raw server logs.
Profound
Profound sells itself as an agentic marketing platform for AEO, and it has the most assertive compliance story of the five.
Profound
According to Profound's own comparison page (June 10, 2026):
- SOC 2 Type II, assessed by Sensiba LLP
- HIPAA compliant
- SSO via SAML/OIDC, supporting Okta and Azure AD
- Role-based access control
- Automated daily backups
- Prompt Volumes data anonymized and scrubbed of PII
Third-party summaries add SCIM and a customer audit log on the Enterprise plan (the Rework procurement review dates these to August 2026). That combination is the fullest control set of the five, and for healthcare or insurance buyers the HIPAA assessment will be the reason Profound lands on a shortlist.
The catches are about wording and gaps. Profound's pages call SOC 2 "compliant" in places and "certification" in others, which is loose language for something that is an attestation. Promptwatch's check also found no public ISO 27001 for Profound. And since I have not read Profound's trust page directly, everything above is vendor-reported. Ask for the SOC 2 report under NDA and read the system description, not just the opinion letter.
SSO and the audit log sit on the Enterprise plan, which has custom pricing. Budget for that if SSO is a hard requirement.
BrightEdge
BrightEdge is an enterprise SEO platform that added AI visibility through AI Catalyst and AI Hyper Cube.
Its Trust page is the most complete public document in this comparison. It lists:
- ISO/IEC 27001:2022 (certified) and ISO 27701:2019 (certified)
- ISO/IEC 42001:2023 (it says it is certified)
- SOC 2, labelled "SOC2 Certified"
- NIST CSF (audited regularly) and NIST AI RMF (used in the design of its AI products)
- EU-U.S., UK and Swiss-U.S. Data Privacy Framework, audited annually
- GDPR and CCPA
- SAML/SSO, customizable password and lockout policy, and annual third-party penetration testing
Two caveats. The page does not say whether SOC 2 is Type I or II, and as above, an exam produces a report, not a certificate. Ask. Second, HIPAA is not listed on the page, which Profound's comparison also points out. If you handle protected health information, that is a real gap.
BrightEdge has held a security certification since at least the ISO 27001:2013 era, based on its older OAuth security post. That history helps if your reviewers value track record.
On the product side, one practical note from a competing review: Google AI Mode was not named on some BrightEdge pages, so ask for it by name in the demo if it matters to you.
Conductor
Conductor combines AI search tracking with content and technical monitoring inside an SEO platform.
Its security page lists SOC 2 Type II and ISO 42001 documents, available on request, as quoted in the seoClarity guide. Promptwatch's check says Conductor also lists ISO 27001 on its enterprise pages, and a procurement review from Rework cites ISO 27001:2022, ISO 42001, annual third-party pen tests, SAML SSO and DPA terms. I did not verify those directly, so confirm the ISO 27001 certificate and its version in the demo.
Documented controls and integrations include SAML SSO, a Data API, an MCP server and a Looker Studio connector. One comparison (qvery) says single sign-on is available from the Growth plan rather than only Enterprise, which is unusual and worth verifying if SSO budget matters. Hosting region is not stated in what I reviewed, so if data residency is a requirement, put it in writing.
Conductor does not publish prices, and AI Search credits start at 2,500 a year on Growth, with daily tracking using substantially more credits. That is a cost question, not a security one, but it affects whether you can afford the monitoring cadence your risk team wants.
Botify
Botify is an enterprise technical SEO and AI search platform built on large first-party crawl and log data.
This is the weakest-documented entry. Botify announced SOC 2 Type 1 on December 8, 2021, examined by Schellman, and said it planned Type 2 in 2022, per its press release. The release explained that its platform holds proprietary first-party logs and data, which is why it sought the audit.
The release is nearly five years old. I could not confirm current Type 2 status or ISO 27001 from a Botify primary source. That does not mean Botify lacks them. It means you cannot confirm them from public pages, so the burden is on you to request the current report.
What the data-handling differences mean in practice
Certifications tell you about process. For AI visibility tools, the sensitive data is more specific:
- Tracked prompts and answers, which can reveal strategy and product plans
- Server and CDN logs, which can include IPs and paths
- CMS or Search Console credentials, if the tool publishes or reads data
- Prompt volume panels, which come from consumers (Profound says its Prompt Volumes are anonymized and scrubbed of PII)
The tools that ingest logs deserve the closest read. Promptwatch publishes its field limit and the fact that human requests are dropped before saving. Botify's log-heavy model is exactly why it pursued SOC 2 in the first place. For any vendor, ask which log fields are stored, for how long, and whether you can delete them.
A procurement checklist
A typical enterprise checklist, adapted from CustomGPT's SOC 2 guide, translated for this category:
- A current SOC 2 Type 2 report, with the audit period and any exceptions
- An ISO 27001:2022 certificate, with certifying body, number, expiry and scope
- SSO through your identity provider, and which plan includes it
- Role-based access, SCIM if you need automated provisioning
- Encryption in transit and at rest
- A statement that your data is not used to train models
- Audit logging you can export
- Data residency, retention and deletion terms
- Incident response and breach notification timelines
- Trust-center documentation and the pen-test summary
Questions to ask in the demo
- Which document covers the product I am buying, and what is the scope line?
- Is the SOC 2 Type 1 or Type 2, and when does the audit period end?
- Which plan includes SSO, SCIM and audit logs?
- Where is data hosted, and can I choose a region?
- What happens to logs and prompt history when we leave?
- Do any subprocessors, including third-party LLM or scraping providers, see our data?
Which one to shortlist
| If you need | Start with |
|---|---|
| Widest published attestation list, including privacy and AI governance | BrightEdge |
| SOC 2 Type II plus ISO inside an SEO suite | Conductor |
| SOC 2 Type II, HIPAA and SAML/OIDC, SCIM, audit log | Profound |
| An AI-native platform with a fresh, checkable ISO 27001 certificate and minimal log retention | Promptwatch |
| A technical SEO and log-analysis shop that will supply current paperwork on request | Botify |
If you want a broader view of the field, the GEO software directory lists more platforms, and Promptwatch's 22-platform comparison covers features beyond security.
Bottom line
No vendor here is a clear all-round winner on security, and the public record is uneven. BrightEdge has the most documented certifications. Profound has the most extensive claimed control set, including HIPAA. Conductor sits between them with documents on request. Promptwatch has the newest ISO certificate with fully published details, but I found no SOC 2, SSO or HIPAA claims to verify. Botify's public evidence is stale. Whatever you pick, get the report and the scope line in writing before legal and security review start, because that is where deals slow down.