ISO 9001 & ISO 27001 certified
Vault Outsourcing holds both ISO 9001 for quality management and ISO 27001 for information security. Together they cover how we run our work and how we protect your data.
What ISO 27001 means
Not a self-declaration — an independently audited, internationally recognised standard.
ISO/IEC 27001 is the world's best-known standard for information security management systems (ISMS). It sets out the requirements for establishing, implementing, maintaining, and continually improving an information security management system — covering people, processes, and technology.
For Vault clients, ISO 27001 certification means that our security controls have been assessed by an independent third-party certification body. It is not a self-declared badge — it requires annual surveillance audits and full recertification every three years.
In the context of Australian financial services, ISO 27001 is one of the most widely accepted evidence items for ASIC and APRA vendor due diligence. If you are an AFSL or ACL holder outsourcing operations offshore, Vault's certification supports your regulatory obligations.
What ISO 9001 means
The international standard for quality management, focused on consistent delivery and continual improvement.
ISO 9001 is the world's most widely used standard for quality management systems (QMS). It sets out how an organisation plans, delivers, measures, and improves its work, so clients receive a consistent standard of service every time.
For Vault clients, ISO 9001 certification means our processes for recruitment, onboarding, delivery, and performance management are documented, audited, and continually reviewed. The same independent, third-party audit discipline behind our security applies to the quality of our work.
Put simply, ISO 27001 covers how we protect your data, and ISO 9001 covers how we run the work itself. Together they give you confidence in both the security and the quality of your offshore team.
Security controls in practice
What the certification looks like day-to-day for your offshore team.
Access Control
Role-based permissions, least-privilege enforcement, multi-factor authentication on all systems. No staff can access data beyond their role scope.
Monitoring & Audit Logs
All data access is logged and monitored. Audit trails are maintained and available for client review. Anomalous access triggers automatic alerts.
Encryption
Data encrypted in transit (TLS 1.3) and at rest (AES-256). All endpoints managed under device management policy. No unencrypted data transfer permitted.
Incident Response
Documented incident response plan with defined SLAs. Any security event is escalated within 1 hour, client notified within 24 hours per ISO 27001 requirements.
Staff Screening & NDA
Every team member undergoes NBI background clearance and signs a comprehensive NDA before accessing any client system or data.
Annual Third-Party Audit
ISO 27001 certification is maintained through annual third-party audits. Clients can request audit summaries as part of their due diligence.
Common Questions
Request our security documentation
ISO 27001 certificate, security policy summary, and due diligence pack available on request.