ISO 27001 certificate and scope
Leadscale Engine Limited's ISO/IEC 27001:2022 certificate, with the named holder, full scope and validity dates in one place.
Needs approval
End
Needs approval
The ISO/IEC 27001:2022 certificate is held by Leadscale Engine Limited and states the following certification scope: "The design, development, delivery, operation and ongoing support of Leadscale Engine Limited's software and consultancy services. In accordance with Statement of Applicability version 3."
End
Certificate holder, scope and dates
Needs approval
Certificate holder:
Leadscale Engine Limited
Standard:
ISO/IEC 27001:2022
Certificate number:
18666-ISMS-001
Certification body:
ISOQAR
Initial registration:
September 2020
Reissued:
2 September 2026
Stated expiry date:
15 September 2029
The certificate states its scope as:
The design, development, delivery, operation and ongoing support of Leadscale Engine Limited's software and consultancy services. In accordance with Statement of Applicability version 3.
It also states the condition for remaining current:
This certificate will remain current subject to the company maintaining its system to the required standard. This will be monitored regularly by ISOQAR.
Match the company and services you are reviewing to the holder and scope above. The certificate applies to that named holder within its stated scope. Inspect the original certificate.
End
The Engine’s role in processing data
Needs approval
The LeadScale Engine™ processes programme data in a processor role. It applies the checks agreed for the programme and delivers records into the destination systems. The record history described below provides evidence of that processing.
End
What happens to programme records
- Capture. Records created through the Engine carry their source label, timestamp, lineage and consent audit trail.
- Hosting. Needs approvalThe Engine is hosted on Microsoft Azure.End
- Processing and delivery. An audit trail follows the record through processing to hand-over. Where records are delivered against an order, deliveries are reconciled against that order.
- Retention. Needs approvalWhere configured for the programme, records are retained for the agreed period and disposed of securely.End
- Removal on request. Needs approvalAuthorised privacy requests can trigger configurable deletion or irreversible anonymisation.End
See how record history supports a governance review for the capture and delivery mechanisms in more detail.
Information security and your programme
ISO/IEC 27001 sets requirements for an information security management system. For procurement and security teams, the certificate is evidence about that management system within the scope it names.
Needs approval
At programme level, the questions become more specific: where did the records come from, what consent was captured and how were they processed? The Engine's source information, consent audit trail and delivery history give your team evidence to examine alongside its assessment of the programme's obligations.
End
Questions for a supplier review
Does the certificate establish that our programme meets its legal obligations?
Needs approval
No. Certification concerns the information security management system within the stated scope. Assess the programme’s use of data and the responsibilities of the parties separately.
End
Is LeadScale a controller or a processor?
Needs approval
The Engine has a processor role. For a particular engagement, establish the controller and contracting company as part of your review. The certificate identifies its holder; it does not assign those programme responsibilities.
End
Discuss your programme
Read the certificate PDF, then book a discovery call with your programme requirements and supplier-review questions.