ISO/IEC 27001:2022 achieved: the strength you don’t see

But taking it to production, operating it with guarantees for years and answering to customers, auditors and regulators takes something else: proven infrastructure, defined processes and experience accumulated in real environments.

That difference is exactly what today's news is about: Thinger.io has achieved ISO/IEC 27001:2022 certification, the international reference standard for information security management systems. The audit was carried out by NQA, and the scope covers the design, development, implementation and operation of cloud-based software and platforms, and the dedicated infrastructure for connecting, managing, storing, monitoring and analysing data from IoT devices.

It is not a badge for the website. It is confirmation, by an independent body, of something we have been doing for years and that is almost never visible from the outside: the work that sustains a platform where other companies place their devices, their data and their operations.

Veracode's latest report, which analyses more than a hundred language models, found that 45% of the generated code contained known vulnerabilities, a figure that has not improved in two years despite the evolution of the models. And a study presented at USENIX Security 2025 found that nearly 20% of the packages recommended by the models analysed did not even exist, an opening already being used to slip malicious software into the supply chain.

The effects are already visible. In 2025, a very popular app exposed identity documents and more than a million private messages through unprotected cloud storage, and a coding agent deleted a company's production database despite instructions to the contrary. None of these failures required a sophisticated attack: insecure configurations and permissions nobody reviewed were enough.

Building has become easy. Sustaining it with guarantees has not.

It is continuous work, not particularly visible, and nobody notices it until the day it fails.

In IoT, the consequences also go beyond data. A deployment connects sensors, industrial controllers, energy meters or vehicles, and every misconfigured access is a door to a physical asset. That is why, when a company chooses a platform, it is not only choosing a set of features: it is also choosing every process behind them.

Since 1 August 2025, internet-connected radio equipment sold in the European Union must meet the cybersecurity requirements of the Radio Equipment Directive, with the EN 18031 standards as the reference. Since 11 September 2026, the Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents within 24 and 72 hours, and its remaining requirements will apply from December 2027.

The NIS2 Directive requires essential and important entities to assess the security of their supply chain, including the practices of their technology providers. And the AI Act will apply its obligations for high-risk systems from December 2027.

All of it comes down to a question more and more customers ask before signing: can this provider demonstrate how it protects what I trust it with?

A platform cannot comply on its customer's behalf, but it can make it far easier.

That means identifying risks, applying controls and reviewing their effectiveness on a continuous basis. The 2022 version gathers 93 controls across four areas, organizational, people, physical and technological, and includes requirements closely tied to the current context, such as secure development, configuration management, cloud services security and threat intelligence.

For those who work with us, this translates into verifiable evidence. Instead of answering security questionnaires case by case, the certification provides an internationally recognised framework that simplifies vendor approval processes and offers a solid basis for requirements such as those of NIS2.

Over these years we have built more than a platform: a way of working proven in real environments for over a decade. That track record comes with concrete evidence.

And now, ISO 27001 certification confirms that all of it is managed with method.

We are not the fastest option for a weekend prototype. We are the option for those who need their project to keep running, with guarantees, five years from now.

The hard part starts afterwards: knowing who accessed which device, when and with what permissions, revoking an access instantly, and being able to prove it to an auditor or a security officer.

ThinRemote, our remote access vertical for edge devices, is built on the same core that has been in production for over a decade. Its agent opens encrypted outbound connections, with no open ports and no VPN, using TLS 1.3, token authentication, role-based access control, SSO, audit logging and end-to-end encryption.

That is exactly what we were looking for: a framework that demands rigour every day, not only on audit day.

If your company is developing IoT solutions, managing device fleets or looking for a technology partner that can answer to its customers and to the regulator, we would love to work with you. Build what differentiates you with AI; rely on those who have spent years sustaining everything else.

We will keep building an IoT platform that an operations team can use... and a security officer can defend.

For any questions, join our Discord community: our team and other users will be happy to help.