Kinship is now ISO 27001 certified. If you work in IT or security at a design firm, hopefully that sentence will save you a lengthy vendor questionnaire. If you don't, here's why this matters: ISO 27001 is the leading international standard for information security management.

Being certified for ISO 27001 means an independent auditor has verified that we identify, manage, and reduce risks to the information our customers entrust to us. And not just once, but as an ongoing, documented practice.

For a company like Kinship that manages Revit content and project data for design firms, that verification brings valuable peace of mind. Your families, templates, and project information are critical parts of how your firm works and the results you produce. You should expect the vendors who handle them to prove they take that seriously.

Why we pursued certification

We've been working toward this for a while, and the push came from our customers. Larger enterprise firms have long asked for ISO 27001 as part of their vendor security reviews. More recently, smaller firms in certain geographies have started asking too, often because their own clients or local regulations require it of everyone in the chain.

We've always taken security and data protection seriously. It's part of why some of the biggest design firms in the world have trusted Kinship for the better part of a decade. What certification adds is verifiability: an accredited third party has audited our practices, so you don't have to take our word for it.

How we got there

Getting certified means capturing, tracking, and organizing a lot of evidence: policies, controls, access reviews, risk assessments, and more. These days there's a whole category of SaaS tools built to manage exactly this, and, honestly, it's difficult to imagine how a company our size would obtain and maintain ISO certification without one.

Our first attempt didn't go well. We started with one of the most popular platforms out there, but we found their customer support poor and their contract terms dismal. So we switched to Sprinto, and the difference was night and day.

Sprinto's platform is very solid, but what stood out even more was their customer support. They met with us regularly to keep us on track with progress and deadlines, and helped us navigate and resolve numerous questions that would have kept us stuck without their guidance. If you're a software company considering ISO 27001 or similar certifications, they're an easy recommendation. Thanks, Sprinto!

What changed

Somewhat to our surprise, we didn't have to change much about how we operate to achieve certification. Our existing practices were already close to the standard, which was reassuring to have confirmed.

But that doesn't mean the certification process wasn't valuable. Certification gives you the confidence that you're doing things the right way, backed by an outside audit rather than your own assumptions. Just as importantly, it ensures your methods are sustainable and auditable as people change and operations grow. Good security can't depend on any one person remembering to do the right thing. The ISO 27001 framework turns good habits into documented, repeatable practices and systems.

What's next

You can see our ISO 27001 certification and related security information on our trust site. If your firm's security team needs documentation for a vendor review, that's the place to point them.

We also plan to add SOC 2 certification in the near future. There's not much meaningful difference between the two standards, but it's a fact of life that some companies have a strong preference for one or the other. We'd rather have both than make you explain to your compliance team why one should count just as much as the other.

If you have questions about security at Kinship, get in touch. We're happy to talk about it, and now we have the paperwork to prove it.