Company
What Innovatum holds, and what that means.
A certification logo tells you very little on its own. What matters is which standard, what scope it covers, who audited it, and whether it is still valid, so this page is organised around those four questions rather than around a badge.
ISO 9001:2015, precisely.
The standard Innovatum's quality system is certified to, and what a certification of that kind does and does not tell you.
It certifies the company, not the product.
ISO 9001 is a quality management standard: documented processes, controlled change, corrective action, management review. It says how Innovatum operates, which is exactly what a supplier assessment is asking about.
It is externally audited.
Certification means an accredited body has audited the quality system and continues to do so through surveillance audits. That external check is the whole value of it over a self-declaration.
It matters to your supplier file.
If you are regulated, your own quality system requires you to assess and monitor suppliers. A certified supplier makes that assessment shorter, and gives you a document to file.
It covers development, delivery and support.
The scope on the certificate is Innovatum's quality management system for software development, delivery and support, which is the part of a supplier's quality system that bears on you: how the software you validate is built, how it reaches you, and how a problem with it is handled.
It is not validation.
It says nothing about whether RONOVA does what you need in your process. That is what IQ/OQ/PQ and your own validation are for, and no certification substitutes for them.
The certificate.
Published here in full, with the four things worth checking on any certificate. The wording of the scope is quoted as printed rather than paraphrased, because a certificate scoped to one activity means something different from one covering a company.
- Standard: ISO 9001:2015, certifying Innovatum's quality management system
- Scope, as printed: Quality Management System for software development, delivery and support
- Certifying body: National Quality Assurance, U.S.A. (NQA), 289 Great Road, Suite 105, Acton, MA 01720, accredited by the ANSI National Accreditation Board
- Certificate number: K 17405, EAC code 33
- Certified since 9 March 2018, reissued 9 March 2024, valid until 8 March 2027
ISO/IEC 27001:2022, precisely.
The information security standard Innovatum is certified to, and what a certification of that kind does and does not tell you.
It certifies a management system.
ISO/IEC 27001 is the international standard for an information security management system: how risks to information are identified and treated, which controls apply, and how the system is reviewed and improved. Like ISO 9001, it is a certification of how Innovatum operates.
Its scope covers how RONOVA is delivered.
The printed scope covers the technical infrastructure, applications and systems that deliver ROBAR, RONOVA, cloud hosting management and AI automation workflows to customers, together with the activities that hold, obtain, share or manage customer and business data.
It names the AI automation workflows.
Innovatum's AI automation workflows are named in the scope of its ISO/IEC 27001:2022 certification, alongside RONOVA, ROBAR and cloud hosting management. The systems that run them, and the customer data they handle, sit inside an information security management system that an accredited body audits.
It reaches beyond engineering.
The scope also names the business functions of HR, Engineering, Product Management, Customer Support, Sales and Marketing, and Finance, so the people who handle your data are inside it, not only the servers.
It is externally audited, and kept under audit.
An accredited body audited the management system for initial certification and returns for surveillance audits before full recertification in 2029.
It does not replace your security review.
A certificate tells you an external body has audited the system. Your own review still decides whether the controls fit your risk, and the Statement of Applicability behind the certificate is the document that lists which controls apply.
The ISO/IEC 27001 certificate.
The same four things worth checking, with the scope quoted as printed.
- Standard: ISO/IEC 27001:2022, certifying Innovatum's information security management system
- Scope, as printed: Information Security Management System at Innovatum applies to technical infrastructure, applications and systems that ensure delivery of its ROBAR, RONOVA, CLOUD HOSTING Management, and AI Automation Workflows to its customers. It also includes technical activities which holds, obtain, share or manage customer and business data; and the business functions of HR, Engineering, Product management, Customer Support, Sales & Marketing, and Finance.
- Certifying body: Accorp Partners Cert Inc., 26500 Agoura Road, Suite 207, Calabasas, CA 91302, accredited by the United Accreditation Foundation (UAF), CB-MS-105243
- Certificate number: ACC-ISMS-2026100425, against Statement of Applicability version 1.0 dated 6 August 2026
- Certified and issued 22 October 2026, surveillance validity to 22 September 2027, recertification due 21 October 2029
Read them yourself.
For your supplier file. These are the certificates as issued, not summaries of them.
Questions people ask.
Is Innovatum ISO 9001 certified?
Yes. Innovatum holds ISO 9001:2015 certification scoped, as printed on the certificate, to its quality management system for software development, delivery and support. It was issued by National Quality Assurance, U.S.A. (NQA) under ANAB accreditation, is certificate K 17405, and runs to 8 March 2027. The certificate is published on this page, so it can go into your supplier file without being requested. Innovatum is also a member of RAPS and of AIM Global, which are memberships rather than certifications.
Does ISO 9001 mean RONOVA is validated?
No, and the distinction matters in a regulated environment. ISO 9001:2015 certifies how Innovatum operates as a company. Validation is evidence that RONOVA does what it is specified to do in your process and configuration, which is what IQ/OQ/PQ documentation and your own validation activity establish.
Is Innovatum ISO 27001 certified?
Yes. Innovatum holds ISO/IEC 27001:2022 certification for its information security management system, issued by Accorp Partners Cert Inc. under UAF accreditation as certificate ACC-ISMS-2026100425 on 22 October 2026, with recertification due 21 October 2029. The printed scope covers the technical infrastructure, applications and systems that deliver ROBAR, RONOVA, cloud hosting management and AI automation workflows to customers, along with the handling of customer and business data and Innovatum's business functions. The certificate is published on this page.
Does ISO 27001 mean RONOVA is certified?
Not as a product, because ISO/IEC 27001 certifies a management system rather than software. What it does mean is that the infrastructure, applications and systems through which RONOVA is delivered, and the people and functions that handle customer data, sit inside an information security management system an accredited body audits. Your own security review still decides whether the controls fit your risk.
Are Innovatum's AI workflows covered by ISO 27001?
Yes. Innovatum's AI automation workflows are named in the scope of its ISO/IEC 27001:2022 certification, alongside RONOVA, ROBAR and cloud hosting management. The systems that run them, and the customer data they handle, sit inside an information security management system that an accredited body audits. As with the rest of the scope, it is Innovatum's management system that is certified, not the workflows as a product.
Does Innovatum have a SOC 2 report?
Yes. Innovatum has completed a SOC 2 Type 2 examination, and the most recent report is available under NDA for your security review. The renewal examination is underway, and the new report will be available on the same basis once it is issued. SOC 2 is an independent attestation rather than a certification, which is why there is no certificate for it on this page: ask Innovatum for the report.
Can we see the certificates?
Yes, both are published on this page as PDFs, so nothing has to be requested. Each carries the certifying body, the certificate number, the scope as printed and the validity dates, which are the four things your own auditors will look for. A certification claim without those is not something an auditor accepts, so it is reasonable to expect all four from any supplier before evaluating further.
Read next.
Ditch the change-tracking spreadsheets.
Witness the power of fully unified, relational change management.