Glaido Is Now ISO 27001 Certified

Glaido is now ISO/IEC 27001:2022 certified. After an independent audit of how we run the company, Johanson Group has certified our information security management system. Glaido is GDPR compliant too.

For a small team, this is a big milestone. Here is why we went for it.

We built Glaido to keep almost nothing

Privacy was part of Glaido from the first version. Your dictation text is never saved to our database. A short history lives on your device, and only there. Your audio is turned into text and then it is gone. The services that transcribe and format your speech do not keep it either.

So you might ask why a company that keeps so little would go through a full security audit.

Because what we do handle matters: your words, in the moment you speak them. The emails you write, the prompts you give your AI agents, your notes. Keeping almost nothing is a good start. But "we don't keep your data" is only a promise until someone outside the company checks it.

What it took

ISO 27001 asks a simple question. Are you running your company the way you say you are?

We spent months writing down how Glaido actually works, and then proving it. That covers who gets access to what, how every change is reviewed before it ships, how we choose the suppliers we rely on, and what happens when something goes wrong.

We tested ourselves before anyone else did. Independent security researchers ran a penetration test against our web app, and we worked through what they found. We ran a disaster recovery exercise and rehearsed how we would respond to a security incident. We audited ourselves internally before the real auditors arrived.

Then Johanson Group audited us in two stages. First they reviewed our system on paper, then they spent four days checking that it holds up in practice.

The certificate covers all of Glaido, not one product or one team: the desktop app, the web app, the services behind them, and the people who build and run them.

The same thinking, applied to GDPR

ISO 27001 is about protecting information. GDPR is about respecting the people that information belongs to. We treat both the same way.

We only process the personal data we need, for reasons we can explain. Anything more and Jannis, who runs compliance at Glaido, would freak out. Trust us, nobody wants that.

When data has to cross borders, it stays protected. Every provider that touches personal data on our behalf is bound to protect it. And we have appointed representatives, so people always have someone close by to contact. Our privacy policy has the full picture.

Ready for your company

For a lot of companies, a new tool has to get past the security team before anyone can use it. That is how it should be. They want to know who they are trusting with their data.

Now there is a clear answer. Glaido has been audited against the standard enterprises use to judge their vendors. Everything a reviewer needs is in the Glaido Trust Center.

If you have wanted to bring Glaido to your whole team, this makes it a lot easier. The Enterprise plan is built for exactly that.

Not a one-time thing

A certificate is a snapshot, and security is not. Johanson Group will come back every year to check our work again, and the whole certificate is renewed after three years. Between audits, the work keeps going.

Nothing changes in how you use Glaido. Hold your hotkey, speak, and your words appear wherever your cursor is. What changed is that someone outside Glaido has checked the work behind it, and will keep checking.