Read the scope line: checking a host's ISO claims
A logo proves little. What to read on a host's ISO certificate: the scope line, who issued and accredited it, the dates and the Statement of Applicability.
Almost every hosting provider shows a row of certification logos somewhere on its website. Your auditor will not accept a logo, and neither should you. A certificate is a precise document, and the details decide whether it covers the service you are actually buying. This is what to read, in what order, and what to ask when something is missing.
Start with the scope statement
An ISO management-system certificate certifies a defined scope, and that scope is printed on the certificate. It might cover the whole company, one site, or one service. A provider certified for "software development" at its head office has told you nothing about the datacenter where your servers run.
Read the scope line first and compare it with the contract you are signing. The question is simple: does the service I buy, at the location I use, fall inside these words? If the answer is unclear, ask the provider to confirm it in writing.
Our own four certificates carry one scope: "Managed datacenter hosting service". That is the service our customers buy.
Check who issued it, and who accredited them
A certificate is only as good as the body that issued it. Certification bodies are themselves accredited by a national accreditation body, and those are members of the International Accreditation Forum. Check both links in the chain:
- The certificate names the certification body. Is that body accredited for this standard?
- The accreditation body is named, usually with its mark on the certificate. Is it a recognised national accreditation body?
Many accredited certificates can be verified independently in IAF CertSearch, the international database of accredited certifications. A provider should also be willing to send you the certification body's own accreditation certificate on request. Ours were issued by RIGCERT, accredited by ESYD, the Hellenic Accreditation System, and we include the accreditation certificates in every assurance packet.
Look at the dates
Certificates are issued for a cycle, normally three years, with surveillance audits each year in between. Check the issue date, the expiry date and, if you can, the date of the last surveillance audit.
Know what each standard covers
The numbers matter, because they certify different things:
- ISO/IEC 27001 is information security management, the core of what most auditors ask about.
- ISO/IEC 27017 adds security controls specific to cloud services.
- ISO/IEC 27018 adds controls for protecting personal data in cloud services, which is directly relevant to GDPR conversations.
- ISO 9001 is quality management: documented, repeatable processes.
- ISO 14001 is environmental management.
- ISO 37001 is anti-bribery management.
For ISO/IEC 27001 there is a further document worth requesting: the Statement of Applicability. It lists the controls from the standard's annex and states which are applied and which are excluded, with reasons. Exclusions are normal, but an exclusion that touches your use case is something to discuss.
Where we stand
EuroVPS holds ISO/IEC 27001 with ISO/IEC 27017 and 27018, ISO 9001, ISO 14001 and ISO 37001, issued in September 2026. Our datacenter operators hold their own independent audit reports and attestations, available under NDA.
When a customer's auditor or tender team needs evidence, we assemble a packet: an index, a signed statement of services, locations, certifications, scope and key controls, our certificates with the accreditation certificates behind them, the datacenter operator's assurance documents, and a cover note. We aim to deliver it within a day.
Questions to ask your provider
- What exactly does the certificate's scope say, and does my service fall inside it?
- Which body issued it, and who accredited that body?
- When was the last surveillance audit?
- May I see the Statement of Applicability?
If your auditor has asked for evidence and you want it in one packet, we are happy to help. Talk to an engineer
Published 22 October 2026.
All field notes