Looms has achieved ISO 27001:2022 certification following a rigorous audit conducted by an accredited external certification body. ISO 27001 is the internationally recognised standard for information security management systems — and achieving it means our controls for protecting health data have been independently verified, not just self-declared.
What the audit covered
The certification audit assessed over 90 security controls across four domains: organisational security, people security, physical security and technological controls. The audit team conducted interviews, reviewed documentation and performed technical testing of our infrastructure.
- Access control and identity management
- Encryption at rest and in transit
- Incident detection and response
- Supplier and third-party security
- Business continuity and disaster recovery
- Security awareness and staff training
What this means for you
Certification gives patients, clinics and partners an independently verified assurance that Looms handles health data with the controls expected of a trusted healthcare platform. It is not a guarantee against all threats — no certification is — but it is evidence of a disciplined, continuously improving approach to security.
Maintaining certification
ISO 27001 certification requires annual surveillance audits and a full recertification audit every three years. Our security team treats the ongoing audit programme as an integral part of how we build and operate the platform.