Certifications and compliance

Last updated Oct 8, 2026 Security & Privacy

AI summary

Rencore GmbH holds ISO 27001:2022 and ISO 27017:2015 certifications, and Rencore Governance has a SOC 2 Type 2 report. The company meets GDPR requirements and undergoes annual penetration testing and monthly vulnerability scans. Request certification documents, security reports, the Data Processing Agreement, and sub-processor list through the Rencore Trust Center.

Rencore GmbH holds an ISO 27001:2022 and ISO 27017:2015 certification, and Rencore Governance has a SOC 2 Type 2 report. You can request the certificates, reports and security questionnaires on the Rencore Trust Center.

ISO 27001:2022 and ISO 27017

ISO 27001:2022 is the current version of the international standard for information security management systems. ISO 27017 adds the controls for cloud services.

The certification covers Rencore GmbH as a company, not only Rencore Governance. The current certificate and the latest audit report are available on request: request access on trust.rencore.com.

SOC 2 Type 2

The SOC 2 Type 2 report covers Rencore Governance. The reporting period runs from 1 February to 31 January.

SOC 2 is a report, not a certification. There is no certificate to show, so read the full report to see how the controls were tested. The latest report is available on request: request access on trust.rencore.com.

CAIQ security questionnaire

Rencore has completed the Consensus Assessments Initiative Questionnaire (CAIQ) of the Cloud Security Alliance, version 4.1.0. It is a standardized questionnaire, so you can use it in place of a custom one. Request it on the Trust Center.

Rencore has not gone through the CSA STAR self-assessment or audit process.

Security testing

An external company runs a penetration test on Rencore Governance once a year. The test covers the admin portal and the Rencore Teams App. Medium and high risk findings are fixed before the final report is issued. The latest penetration test report is available on request: request access on trust.rencore.com.

The Rencore Governance code is also scanned for vulnerabilities at least once a month, and the production systems are monitored continuously.

Running your own penetration test against Rencore Governance is generally not possible. It would require Rencore to relax firewall rules and other protections that keep all customers safe. The audit and penetration test reports, available on request through trust.rencore.com, give you this information instead.

Rencore runs a data protection program and reviews it continually to meet the requirements of the GDPR.

The current Data Processing Agreement (Art. 28 GDPR) for Rencore Governance is published on rencore.com and on the Trust Center.

Rencore lists its current sub-processors, what each one does and where it processes data on the Trust Center and in the sub-processor list on rencore.com. To learn where your own data is stored, see Data Residency.

What to request for a vendor review

For the most complete picture, Rencore recommends that you request these documents on the Trust Center:

The SOC 2 Type 2 report
The ISO 27001 certificate
The CAIQ questionnaire
The SaaS Agreement
The Data Processing Agreement
The latest penetration test report

Some documents open directly. For the others, request access on trust.rencore.com.

To report a security concern, email [email protected].

Frequently asked questions

Which security certifications and reports does Rencore have?

Rencore GmbH, the company, holds ISO 27001:2022 and ISO 27017:2015 certifications. Rencore Governance has a SOC 2 Type 2 report. You can request the certificates, reports and security questionnaires on the Rencore Trust Center.

Is the SOC 2 Type 2 report a certification, and what period does it cover?

No. SOC 2 is a report, not a certification, so there is no certificate to show. The SOC 2 Type 2 report covers Rencore Governance, and its reporting period runs from 1 February to 31 January.

Can I run my own penetration test against Rencore Governance?

Generally no. A customer test would require Rencore to relax firewall rules and other protections that keep all customers safe. The audit and penetration test reports, available on request through trust.rencore.com, give you this information instead.

How often is Rencore Governance penetration tested, and what does the test cover?

An external company runs a penetration test once a year. It covers the admin portal and the Rencore Teams App. Medium and high risk findings are fixed before the final report is issued.

Which documents should I request for a vendor review?

Rencore recommends requesting the SOC 2 Type 2 report, the ISO 27001 certificate, the CAIQ questionnaire, the SaaS Agreement, the Data Processing Agreement and the latest penetration test report on the Trust Center.

Was this page helpful?