A borrower’s loan file holds more than the numbers needed for a credit decision. Bank statements, identity documents, payslips, and financial records can reveal a detailed picture of someone’s life and business. When a lender brings a new software provider into that workflow, it needs to understand how that information will be handled.
Kita is now certified to ISO/IEC 27001:2022, the international standard for information security management systems. An independent certification body has assessed the way we identify information-security risks, put controls in place, and check that those controls are working.
For lenders evaluating Kita, the certificate is one part of the security review. Here is what sits behind it—and where its limits are.
The scope matters
Our certified information security management system covers Kita Capture, Kita AI Credit Officer, Kita AI Underwriter, Kita Portal, and Kita API, together with the assets and processes that support them.
The certificate is issued by Advantage Partners, the trading name of Montlake Partner Group LLC. It was issued on 15 July 2026 and is valid to 15 July 2029. Its reference number is ISMS-KI-071526.
Scope is important when reviewing any supplier’s certificate: the relevant services need to fall within the management system that was assessed. Your team can request our certificate and review that scope against the products you plan to use.
What the audit examined
Before the external audit, we defined the boundaries of our information security management system, assessed the risks within it, and documented how we would address them. We then carried out an internal audit and management review. Vanta helps us collect and monitor supporting evidence; the controls and the people operating them remain our responsibility.
The external audit took place in two stages. The first examined the management system: its scope, risk process, policies, responsibilities, and readiness for certification. The second examined how it operated in practice, including evidence for the relevant controls.
The audit findings then went through a separate certification review. The certification decision was made independently of the audit team, and the certificate was issued after that review was complete.
What certification does—and doesn’t—tell you
ISO 27001 provides independent assurance about an information security management system. It is not a certification of an AI model’s accuracy, an individual extraction, or a lending decision. It is also not a guarantee that a security incident can never occur.
Those distinctions matter in lending. Your credit team still needs to evaluate outputs against source documents, test the system on its own files, and decide whether it meets the requirements of its workflow. Certification does not replace that assessment or your supplier due diligence.
SOC 2 Type II is a separate engagement and remains in progress. We are not presenting an engagement letter as a completed SOC 2 report.
The work continues after the certificate
The three-year certification cycle includes surveillance audits, followed by recertification before renewal. Between those reviews, we continue to maintain the controls, assess risks, and keep the supporting evidence current.
For a lender, the useful question is not only whether a supplier has a certificate today. It is whether the supplier can explain its scope, provide the supporting documentation, and keep that information up to date as the service changes.
Review the evidence
Start with our Trust Center for security documentation. To request the ISO certificate or the SOC 2 engagement letter, email support@kita.ai.
You can also review the certification body’s IAS accreditation listing, MSCB-389, and its certification process and policies. These are separate from Kita’s own certificate.
If you are evaluating Kita for your lending workflow, we can help your security team find the documents it needs to complete its review.