Masttro is ISO/IEC 27001:2022 certified

Masttro has earned ISO/IEC 27001:2022 certification. The certification follows an independent audit by BSI (British Standards Institution), a certification body accredited by the ANSI National Accreditation Board (ANAB), and covers the Information Security Management System supporting the design, development, operation, and management of the Masttro platform, including the processing and protection of client and corporate information, supporting technology infrastructure, personnel, third-party services, business operations, including management and support services, located in Mexico, New York and Switzerland.

Why this matters for family offices, RIAs, and private banks

For the family offices, RIAs, and private banks who trust us to safeguard their data, this means an accredited third party has examined our data controls and confirmed that they work in practice.

When principals, investment committees, or regulators ask how data is being protected, our clients and partners can cite independent verification alongside our own documentation. Masttro will also undergo a yearly audit to keep the certification.

What is ISO/IEC 27001?

ISO/IEC 27001 is the most widely recognized international standard for information security management systems (ISMS). The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) publish it jointly. It establishes the requirements that an organization must meet to identify security risks, apply controls to manage them, and improve those controls over time.

The 2022 edition is the current version of the standard. Its 93 controls cover organizational, people, physical, and technological security, including requirements for threat intelligence, cloud services, data leakage prevention, and secure coding.

Certification involves two stages of audit. The first reviews documentation, and the second tests whether the controls work as planned. Each certificate lasts three years. In years one and two, a surveillance audit checks that the system is still working, and in year three, a full audit renews the certificate.

How we protect client data

At Masttro, protecting client information is a fundamental priority. Our platform is built on a secure Microsoft Azure cloud infrastructure hosted in Switzerland. We implement a comprehensive, defense-in-depth security approach that includes AES-256 encryption for data at rest, TLS encryption for data in transit, Multi-Factor Authentication (MFA), and logical data segregation between clients.

Our security architecture incorporates network segmentation, firewalls, intrusion detection and prevention mechanisms, and continuous security monitoring. In addition, we conduct regular vulnerability assessments, independent penetration testing, access reviews, and security risk assessments to identify and address potential threats.

Our security framework is further supported by documented incident response, business continuity, and disaster recovery procedures, designed to protect the confidentiality, integrity, and availability of client information. Through these measures, Masttro maintains a proactive approach to cybersecurity, data protection, and continuous improvement, reinforcing the trust our clients place in our platform.

What certification adds

With certification, an independent auditor reviews our risk assessments, internal audits, and management reviews against an international standard. It also acts as a common benchmark. ISO/IEC 27001 is recognized worldwide, so security and procurement teams across the 40+ countries we serve have a verified starting point for vendor review.

Current and prospective clients can request a copy of the certificate from infosec@masttro.com.