ISO 27001 vs SOC 2 for a European SaaS in 2026

For a SaaS selling mainly to European customers, ISO 27001 is usually the one to get first: it's an international standard, buyers and tenders in Europe know it, and the result is a certificate you can show anyone. SOC 2 matters when your pipeline includes US companies, whose security teams often ask for a SOC 2 report by name. Many SaaS companies end up with both, because the work behind them overlaps.

This guide isn't legal or audit advice. Ask your auditor or certification body before you plan a timeline.

ISO 27001 and SOC 2 at a glance

What each one actually proves

ISO/IEC 27001 sets the requirements for an information security management system, or ISMS: how you find your security risks, decide what to do about each one, assign owners and keep improving. The current edition was published in October 2022, and ISO lists one amendment to it. ISO doesn't certify anyone itself. An independent certification body audits you and issues the certificate. Clever Cloud's ISO page spells out the cycle: the certificate is renewed every three years, and an independent body runs a surveillance audit every year in between.

A certificate tells a buyer your management system meets the standard. It doesn't say how strong each technical control is, and it covers only the scope written on it.

SOC 2 is an attestation by a CPA firm on your controls, measured against the AICPA's trust services criteria for security, availability, processing integrity, confidentiality and privacy. Security is always covered, and you add the other categories that fit your service. The Journal of Accountancy, published by the AICPA, explains the two types:

• Type 1 looks at your system description and whether your controls are suitably designed, as of one date.
• Type 2 adds an opinion on whether those controls actually worked throughout a period, with the auditor's tests and results written out.

A Type 1 is a snapshot, while a Type 2 shows your controls holding up over months. The AICPA restricts the use of a SOC 2 report in general. A SOC 3 covers the same subject with a shorter system description and no test results, and its distribution isn't restricted, so you can put it on your website.

What to check before you pick one

• Where your buyers are. List the last ten security questionnaires you received. If they name SOC 2, that answers it. If they name ISO 27001, or no framework at all, start there.
• Tenders and regulated sectors. Read the tender or the client's supplier policy for the exact framework it names, and whether a report in progress counts.
• Scope. Certify the product your customers buy, with the people and suppliers who touch it. A narrow scope is cheaper but can disappoint a buyer who reads it.
• Time to first evidence. A Type 1 report or an ISO stage 1 audit can come early. A Type 2 needs controls that have already run through the review period.
• Your suppliers. Both audits look at how you manage the providers you rely on, so their certificates and reports become part of your evidence.
• German buyers of cloud services. Germany's BSI publishes its own cloud criteria, C5, and advises cloud customers to request a provider's C5 report and analyse it every year. Ask whether a German prospect expects one.

Your host's certificate isn't yours

A frequent mistake is to answer "we're ISO 27001 certified" because the cloud underneath is. Hetzner, for example, says its ISO 27001:2022 certificate covers the infrastructure, operation and customer support of its data center parks in Nuremberg, Falkenstein and Helsinki. That certificate belongs to Hetzner Online GmbH and Hetzner Finland Oy. It says nothing about your code, your access rules, your laptops or your incident process.

What a certified host does give you is evidence for the supplier part of your own audit. Here's what some European platforms state on their own pages:

Platform	ISO 27001	SOC 2	Other
Clever Cloud	ISO 27001:2022, whole platform	Not stated	HDS, SecNumCloud offer
Scalingo	Covers all its activities, issued by LNE	Not stated	HDS, SecNumCloud region
Upsun	ISO 27001	Type 2	PCI Level 1, HIPAA
Exoscale	ISO/IEC 27001:2022	Not stated	ISO/IEC 27017 and 27018, BSI C5
OVHcloud	ISO/IEC 27001, 27017, 27018	SOC 1, 2 and 3	SecNumCloud on some services
Hetzner	ISO 27001:2022, its data center parks	Not stated	Not stated
Eurobase	In progress, not held	In progress, not held	Not stated

Certifications are from each provider's own page, checked on 10 November 2026. Exoscale and OVHcloud also list certificates per data center, so check the location you'd use. A host's SOC 2 report covers the host. You still need your own if a buyer asks for one.

Where Eurobase fits

Eurobase runs your app, its Functions, files and logs on European infrastructure run by Scaleway, a French provider. The company behind it is registered in Warsaw, Poland. Eurobase is preparing for ISO 27001 and SOC 2 but holds neither yet, so there's no Eurobase certificate or report to put in your audit file today. If a tender needs a certified hosting platform right now, Clever Cloud, Scalingo or Upsun can show one.

For the supplier section of your own audit, Eurobase publishes a subprocessor list and a data processing agreement. On that list, GitHub, Inc. and GitLab Inc. appear as US subprocessors only if you connect a repository from them; a Codeberg repository works too. Each workspace starts on Free and moves to €10 or €20 a month + VAT when it needs more. There are no usage charges today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving. See Eurobase pricing and the host in the EU guide.

How to choose

1. Selling mostly in Europe, few US prospects: start with ISO 27001.
2. A US enterprise deal is waiting on it: start with SOC 2, often a Type 1 first, then a Type 2.
3. Both markets: build one set of controls and policies, then map them to both frameworks so the same evidence serves both audits.
4. Too early for either: fill in questionnaires with the documents you already have, such as your DPA, the list of suppliers that process data and where they sit, and your hosts' certificates, and say plainly which audit you're preparing.

The paperwork a client asks for beyond certificates is covered in EU-only data for a SaaS. For who can be compelled to hand data over, which no audit settles, read data residency vs data sovereignty.

Frequently asked questions

Is SOC 2 recognised in Europe?

It depends on the buyer. SOC 2 is a US attestation, not a European standard, but a European security team may still accept a Type 2 report, especially one that already buys from US vendors. Check the exact framework a questionnaire or tender names before you choose.

Is ISO 27001 harder than SOC 2?

They ask for different things. ISO 27001 is about running a management system with risk assessment and review, and it ends in a certificate. SOC 2 is about whether specific controls exist and, for Type 2, whether they worked over a period. The effort depends far more on your scope than on the framework.

Can I use my cloud provider's ISO 27001 certificate?

Only as evidence about that supplier. The certificate names the provider and its scope. Your own company isn't covered, so don't present it as your certification.

What is the difference between SOC 2 Type 1 and Type 2?

Type 1 checks that controls are designed properly on a single date. Type 2 checks that they actually operated throughout a review period, and it includes the auditor's tests and results.

Does GDPR require ISO 27001 or SOC 2?

No. The GDPR asks for appropriate security, and neither audit is compulsory under it. A certificate or report is a common way to show a client that your security is organised.

Sources

• ISO: ISO/IEC 27001:2022
• AICPA & CIMA: SOC suite of services and SOC 2 guide
• Journal of Accountancy: Explaining the 3 faces of SOC
• BSI: C5 criteria catalogue
• Clever Cloud: ISO 27001
• Scalingo: ISO 27001 certification
• Upsun: Trust Center
• Exoscale: Compliance
• OVHcloud: Compliance
• Hetzner: ISMS and data protection
• Eurobase subprocessors, Eurobase DPA and Eurobase pricing