Announcing SOC 2 Type II Compliance and ISO/IEC 27001:2022 Certification

Cheiron today announced two milestones in its information security program: completion of its SOC 2 Type II examination and the certification of its Information Security Management System (ISMS) to ISO/IEC 27001:2022. Together, they provide independent, globally-recognized pledges that the data biopharma teams entrust to Cheiron is protected to the highest degree. 

The SOC 2 Type II examination was performed by Prescient Assurance, an independent, AICPA-accredited auditing firm, against the American Institute of Certified Public Accountants’s (AICPA) System and Organization Controls (SOC) standards for service organizations. SOC 2 Type II is one of the most rigorous and renowned benchmarks for data security. Unlike a point-in-time review, a Type II examination evaluates how effectively an organization's security controls operate over an extended period, providing independent assurance that those controls work in practice and not just theory. As expected, Cheiron passed with an unqualified opinion and zero exceptions.

The ISO/IEC 27001:2022 certification was issued to PhnyX Lab, Inc. – the company behind Cheiron – by Insight Assurance, an independent certification body, for the ISMS powering Cheiron’s platform. ISO/IEC 27001 is the most widely respected international standard for information security management. Again, in contrast to a one-time review, it certifies a living system - one independently audited and sustained through ongoing surveillance across the certificate’s life (July 20, 2029). The two milestones complement each other well, as SOC 2 Type II tests Cheiron’s security controls in operation, while ISO/IEC 27001 qualifies the management system behind them.

For the biopharma teams Cheiron serves, that assurance is fundamental. Drug development runs on some of the most sensitive information, such as protocols, study results, CMC changes, and regulatory commitments. Cheiron unifies such knowledge and data into one AI-native operating system; safeguarding it to the highest degree remains central to both earning and keeping our customers’ trust.

These certifications also make Cheiron easier to adopt. Security and vendor-risk review is typically the longest step for biopharma organizations when onboarding new platforms. WIth an independently verified SOC 2 Type II report and an ISO/IEC 27001 certificate available up front, prospective clients can satisfy those requirements sooner, thus reducing procurement friction and putting Cheiron to work faster.