Indian startup ISO certificate verification comes down to three questions: which standard and scope does the startup claim, which certification body issued the certificate, and can that certificate be confirmed today in a record the startup does not control? "ISO certified", "ISO 27001 compliant" and "aligned with ISO 9001" sound similar on a pitch deck or a SuperLaunch listing. They are not the same claim, and only one of them points to a certificate you can check.
This guide shows how to read an ISO claim narrowly, confirm it against public records, and write down only what the record supports. It is a research method, not legal, audit or procurement advice.
ISO writes the standard. Someone else issues the certificate
The first fact to hold on to comes from ISO itself. ISO's own certification page says it does not perform certification or issue certificates, and that it does not permit anyone to use the ISO logo in connection with certification. Certification is carried out by external certification bodies, so a company cannot be "certified by ISO".
So a certificate that says "issued by ISO", or a badge that uses the ISO logo itself, is a reason to slow down. It does not prove fraud, since small teams often copy template wording, but the claim needs the full check below.
ISO's page also separates two words that are often blurred together:
- Certification is written assurance from an independent body that a product, service or system meets specific requirements.
- Accreditation is formal recognition, by an accreditation body, that a certification body works according to international standards.
So a useful ISO claim has a chain behind it: the startup holds a certificate, a named certification body issued it, and ideally an accreditation body recognises that certification body.
Start with the exact sentence the startup uses
Before you search anything, copy the claim word for word, with the page and the date you saw it. Then sort it into one of these buckets.
| Claim wording | What it points to | What you can check |
|---|---|---|
| "ISO/IEC 27001:2022 certified, certificate no. …" | A specific management system certificate | Certificate status, holder name, scope, issuing body, accreditation |
| "ISO 9001 certified" with no other detail | Probably a certificate, but not identified yet | Ask for the certificate copy or the issuing body, then check |
| "ISO 27001 compliant" or "aligned with ISO 27001" | A self-assessment or internal programme | Nothing public to verify. Record as a self-description |
| "Our cloud provider is ISO 27001 certified" | Someone else's certificate | The provider's certificate, which says nothing about the startup's own processes |
| "ISO certification in progress" | An audit that has not finished | Nothing yet. Record the stage and revisit later |
The fourth row catches many SaaS claims. A startup's cloud provider holding certificates is not the same as the startup being certified, so keep it in a separate column.
Step 1: get the certificate details
A certificate claim you can verify has, at minimum, the legal name of the certified organisation, the standard and edition, the scope statement, the certificate number, the issue and expiry dates, and the name of the certification body. If the startup only shows a badge, ask for the certificate copy. ISO's guidance on complaints notes that you can identify the certification body from the statement of certification, the certification mark used, or by requesting a copy of the certificate, so asking is normal practice, not an accusation.
Check the edition as well as the number. The current information security standard is ISO/IEC 27001:2022, published in October 2022, and ISO's page lists one amendment to it. A certificate that still names an older edition is worth a closer look at its dates and status rather than an automatic pass.
Step 2: match the legal entity, not the brand
Certificates are issued to organisations, usually under their registered legal name and sometimes for specific sites. The brand on the website may be different. Confirm the company behind the product first, using the MCA company master data method or the GST legal and trade name check, then compare that name with the holder on the certificate.
A mismatch is not automatically a problem: a parent company may hold the certificate, or the startup may have renamed itself. Until the relationship is explained, the claim stays unresolved.
Step 3: confirm the certificate in an independent database
ISO's certification page names two ways to verify a certificate from an accredited certification body: search IAF CertSearch, or contact the certification body, the accreditation body or Global ACI directly.
IAF CertSearch is the global database for accredited certificates. According to the IAF's own description, a result there lets you confirm three things at once: that the certification is valid, that the certification body is accredited, and that the accreditation body is a signatory to the IAF Multilateral Recognition Arrangement. The site also offers alerts when certificates are suspended, withdrawn or expired, which tells you those statuses exist and are worth reading carefully.
When you search:
- Try the legal name, the brand name and common spelling variants.
- Open the record and compare the standard, scope, sites and dates with the certificate the startup showed you.
- Copy the status wording exactly, and note the date you checked.
One change is worth knowing about. ISO's certification page now explains that Global ACI (Global Accreditation Cooperation Incorporated) has assumed the former roles of the IAF and ILAC. You will still see IAF names on CertSearch and on older certificates, so treat the two names as part of the same international accreditation system rather than a red flag.
Step 4: check the certification body itself
If the certificate is not in CertSearch, the next question is who issued it. In India, the National Accreditation Board for Certification Bodies (NABCB), a constituent board of the Quality Council of India, accredits management system certification bodies against ISO/IEC 17021-1:2015. NABCB describes itself as a signatory to the IAF, ILAC and APAC arrangements for schemes including quality, environmental, food safety and information security management systems. Its Search Accredited Bodies page lets you look up an accredited body.
International certification firms working in India are often accredited by a foreign accreditation body instead. The test is whether a recognised accreditation body accredits that certification body for that standard.
Keep one nuance from ISO's own guidance in mind: accreditation is not compulsory, and ISO says a certification body without accreditation is not necessarily disreputable. What changes is the evidence. An unaccredited certificate can only be confirmed with the issuer itself, and there is no independent body standing behind that issuer's competence. Record it as "certificate confirmed with issuer, issuer not accredited" rather than collapsing it into "verified".
Step 5: read the scope before you repeat the claim
The scope statement is where most overstatement happens. A certificate might cover "development and support of a payroll application from the Kochi office" while the website says "ISO 27001 certified company". Both can be true at the same time, but only the first is precise.
Write the scope down exactly, then ask whether the product or service you care about falls inside it. A certificate for software development says little about a call-centre partner.
What a matched certificate does not tell you
Even a clean, accredited, in-scope certificate confirms a narrower fact than many people assume:
- It shows that a management system was audited against a standard, for a scope, on the certification body's schedule. Certificates are maintained through periodic surveillance audits, so they reflect a cycle, not one moment of perfection.
- It is not a government licence. Sector permissions such as an FSSAI food licence or an RBI authorisation are separate public records, and an ISO certificate does not replace them.
- It is not a security guarantee, a product quality rating or proof that a breach cannot happen.
For founders making the claim
If you hold a certificate, make it easy to verify. On your website or your SuperLaunch listing, name the standard and edition, the certification body, the certificate number and the scope in one line. Link to the certificate record, or say where a buyer can confirm it. Do not use the ISO logo, and avoid "ISO approved" or "certified by ISO" wording. If you are working towards certification, say "audit in progress" with the expected stage rather than a badge.
Founder and researcher checklist
- Save the exact ISO claim, where it appears and the date.
- Sort it: certificate, self-assessment, someone else's certificate, or in progress.
- Get the certificate number, edition, scope, dates and issuing body.
- Confirm the legal entity behind the brand.
- Search IAF CertSearch with the legal name and variants.
- Copy the status wording and the check date.
- If not found, identify the certification body and check its accreditation.
- Record unaccredited certificates as confirmed with the issuer only.
- Compare the scope with the product or service you are evaluating.
- Keep sector licences and security claims in separate evidence columns.
- Mark unmatched claims as unverified, not false.
- Publish only the conclusion the record supports.
FAQ
Can ISO confirm whether a company is certified?
No. ISO does not issue certificates. Use IAF CertSearch or contact the certification body named on the certificate.
Is "ISO 27001 compliant" the same as "ISO 27001 certified"?
No. "Compliant" or "aligned" usually means the company is following the standard internally without an external certificate. There is nothing public to verify, so record it as a self-description.
The startup's certificate is not in IAF CertSearch. Is it fake?
Not necessarily. The certification body may not publish data there or may not be accredited. Ask the issuer directly and record exactly what you confirmed.
Does an ISO certificate mean a startup's product is safe or legal to sell?
No. It confirms an audited management system for a stated scope. Regulatory licences and product safety are separate questions.
The practical rule
Treat an ISO claim as a pointer to a specific certificate, not a badge. Match the claim to a certificate number, the certificate to the legal entity, the issuer to an accreditation, and the scope to the thing you are actually evaluating. When the chain holds, cite it with your check date. When a link is missing, say so plainly. To discover companies worth checking, browse the SuperLaunch directory, follow the source-first verification workflow for every other claim, and see SuperLaunch's editorial policy for how sources and corrections are handled.
