Filed is certified to ISO/IEC 27001:2022 by Schellman
Filed is certified to ISO/IEC 27001:2022, the international standard for information security management. Schellman, an ANAB-accredited certification body, issued the certificate on October 16, 2026, after an independent audit of the information security management system (ISMS) behind the Filed platform. The certificate runs to October 2029, with a surveillance audit every year. Filed also has a SOC 2 Type II report and a SOC 3 report.
If your firm runs a vendor review before it lets new software near client data, your IT lead or security reviewer now has two independent audits to start from instead of a blank questionnaire.
What does the certification cover?
The certificate covers Filed's information security management system: the policies, risk assessments and controls Filed uses to protect information, and the routine of testing and improving them. Its scope is the cloud services, data, systems, processes and people that design, build, deploy and run the Filed platform.
The certificate number is 1138856-1. Anyone can look it up in Schellman's public certificate directory to check that it's current.
How is ISO 27001 different from SOC 2?
SOC 2 is an attestation report and ISO 27001 is a certification. Security reviewers often ask for both because they check different things.
For a SOC 2 Type II report, a CPA firm tests whether specific controls operated over a set period, measured against the AICPA's Trust Services Criteria, and writes up what it tested and what it found. Filed's latest report covers July 1, 2025 to June 30, 2026.
For ISO/IEC 27001:2022, a certification body audits the management system itself. It checks that the company identifies its own information security risks, decides which controls it needs and compares them against the 93 controls in the standard's Annex A, audits itself, and has leadership review the results. The certificate is valid for three years, with a surveillance audit each year in between.
A SOC 2 report shows that Filed's controls worked during the audit period. The ISO 27001 certificate shows there's a management system that keeps finding and treating risks between audits.
Why does this matter to a tax firm?
Your firm is responsible for the vendors that handle your clients' data. The FTC Safeguards Rule requires tax and accounting firms to pick service providers that can keep customer information safe, to require those safeguards in the contract, and to check on providers periodically. IRS Publication 4557 and the written information security plan (WISP) template in Publication 5708 walk tax professionals through documenting that oversight.
An ISO 27001 certificate and a SOC 2 Type II report are the kind of evidence that goes in that file. Your reviewer can start from two independent audits and spend their time on the questions that matter most to your firm, like where data is stored and who can see it. Our guide to tax workflow automation covers what else to check before a new tool goes into your WISP.
How do firms get the certificate and reports?
Start at the Filed trust center. The certificate can be shared freely. The SOC 2 Type II report and the ISO 27001 audit report are available under NDA. Your Filed contact can also work through your firm's security questionnaire with you, and the Filed security page covers how Filed handles client data day to day.
Frequently asked questions
Is Filed ISO 27001 certified?
Yes. Filed, Inc. is certified to ISO/IEC 27001:2022 by Schellman Compliance, LLC. The certificate (number 1138856-1) was issued on October 16, 2026, is valid until October 15, 2029, and depends on Filed passing a surveillance audit each year.
Is Filed SOC 2 compliant?
Yes. Filed has a SOC 2 Type II report covering July 1, 2025 to June 30, 2026, and a SOC 3 report. The SOC 2 Type II report is available under NDA through the Filed trust center.
Where does Filed store client data?
In the United States. Filed processes and stores client data on U.S. servers and doesn't send source documents or returns offshore.
Does Filed use client data to train AI models?
No. Client data is never used to train Filed's AI models, and each firm's data is isolated from every other firm's.
If your firm has a vendor review coming up, book a demo and bring your security questionnaire.