Demandbase completes ISO 27001:2022 and SOC 2 Type 2 recertifications

On December 18, 2025, Demandbase announced it had completed its annual SOC 2 Type 2 audit and its ISO 27001:2022 surveillance audit, both with a clean report and no issues identified, the company says. The audits were conducted by Schellman & Company, LLC. Demandbase says it first achieved ISO 27001:2022 certification in 2024 after years under the 2013 version of the standard, and that this year's recertification covers the Information Security Management System of the Demandbase One platform. General counsel Andrew Epstein said in the release that AI is accelerating both innovation and risk.

The details

• Audits covered: annual SOC 2 Type 2 audit and ISO 27001:2022 surveillance audit.
• Auditor: Schellman & Company, LLC.
• Demandbase says both audits finished with no issues identified.
• Scope named in the release is the Demandbase One platform's Information Security Management System.
• The company says the audits confirm controls for security, availability and confidentiality.
• Certifications are available through the Demandbase Trust Site.

Context

This is the earliest Demandbase story in our coverage. It precedes the April 14, 2026 debut of Demandbase AI with MCP data delivery, the September 2026 Mojo campaign agent and MCP links to Gong, Outreach and Sendoso, and the October 20, 2026 launch of AEO, Campaign and Audience agents at GO. Those later releases send Demandbase data into third-party systems, which falls under the same security and confidentiality controls the audits review.

Not disclosed

• Whether the SOC 2 report covers privacy or processing integrity criteria
• Audit period dates
• Whether newer AI and MCP features fall inside the audited scope