Certifications and
​Attestations

Overview:

The International Organization for Standardization (ISO) is an independent nongovernmental organization. The ISO/IEC 27000 family of standards are global standards providing a framework for policies and procedures that help meet legal, physical and technical regulatory requirements involved in an organization's information risk management processes.

Product Scope:

WSO2 has obtained the ISO/IEC 27001:2022 certification for the Digital Operations function, which oversees the access management of WSO2 infrastructure and overall management of end-points.

Overview:

WSO2 has obtained the SOC 2^® Type 2 attestation for its Public Cloud offerings. The SOC 2^®/SSAE18 attestation covers the Security, Confidentiality, and Availability Trust Service Criteria (TSC) as well as HITRUST Common Security Framework (CSF) controls that align with the SOC 2^® TSCs.

Product Scope:

Developer Platform Control Plane and Cloud Data Plane, Integration Platform - SaaS / Cloud, API Platform - SaaS / Cloud & Identity Platform - SaaS / Cloud are SOC 2^® Type 2 certified.

Overview:

The Payment Card Industry (PCI) Data Security Standard (DSS) is a global information security standard designed to prevent fraud through increased control of credit card data. Compliance with PCI DSS is required for any organization that stores, processes, or transmits payment and cardholder data.

WSO2 conducts annual PCI DSS assessments using an approved independent Qualified Security Assessor (QSA) and certification can be viewed here.

Product Scope:

Developer Platform Control Plane and Cloud Data Plane, Integration Platform - SaaS / Cloud & API Platform - SaaS / Cloud are certified on PCI-DSS v.4.0.1.

Overview:

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the related regulations are a set of U.S. healthcare laws that establish requirements for the use, disclosure, and safeguarding of individually identifiable health information.

HIPAA regulations require that covered entities enter into a Business Associate Agreement (BAA) with the business associate (WSO2) to ensure that Protected Health information (PHI) is adequately protected.

Although there is no one certification standard that is approved by the Department of Health and Human Services to demonstrate compliance with HIPAA, WSO2 supports its customers to meet their obligations with HIPAA and also adheres to the Security Rule requirements of HIPAA as a business associate.

WSO2 will enter into BAAs at the request of its customers for the WSO2 product & services detailed in the Product Scope below. The WSO2 products detailed below have undergone audits conducted by accredited independent auditors.

Product Scope:

Developer Platform Control Plane and Cloud Data Plane, Integration Platform - SaaS / Cloud & API Platform - SaaS / Cloud are attested by an independent auditor to be HIPAA compliant.

Overview:

The EU DORA (Digital Operational Resilience Act) aims to provide a harmonized approach to achieving “a high level of digital operational resilience” of the financial services industry in the EU.

European Union (EU) financial entities and ICT third-party service providers must comply with this regulation.

DORA standardizes how financial entities report cybersecurity incidents, test their digital operational resilience, and manage ICT third-party risk across the financial services sector and EU member states.

DORA provides European Supervisory Authorities (ESAs) with direct supervisory powers over designated critical ICT providers.

Product Scope:

WSO2 has identified itself as a non critical ICT third party service provider for its on premise products offerings. As a non critical ICT third party we comply with DORA provisions to the extent applicable and this will help regulated financial institutions meet their own DORA requirements when using WSO2 products.

Overview:

WSO2 LLC has certified that WSO2 Identity Platform - Self-hosted 7.1.0 conforms to FAPI2SP OP and FAPI2SP OP private key + MTLS of the OpenID Connect™ protocol. You can view details about these profiles on the OpenID Foundation website.

Product Scope:

WSO2 Identity Platform - Self-hosted 7.1.0

Overview:

The General Data Protection Regulation (GDPR) requirements apply to the data collected by WSO2 for the services provided to our EU customers. The GDPR grants individuals (or data subjects) certain rights in connection with the processing of their personal data.

Product Scope:

WSO2, as an organisation, follows the General Data Protection Regulation (GDPR) for all products and services offered to customers, to the extent applicable.

Overview:

The California Consumer Privacy Act along with subsequent amendments and related laws, is a state law in the United States that provides California residents with specific rights regarding their personal information, including the right to know, delete, and opt-out of the sale of their data.

Product Scope:

WSO2, as an organisation, follows the California Consumer Privacy Act of 2018 (CCPA) across all products and services, to the extent applicable.

Overview:

This comprehensive data protection law safeguards the constitutional right to privacy by regulating how public and private bodies process personal information, establishing eight core conditions for lawful processing, and creating the Information Regulator to enforce compliance, including mandatory security safeguards and reporting of data breaches.

Product Scope:

WSO2, as an organisation, follows the Protection of Personal Information Act 4 of 2013 (POPIA) for all products and services offered to customers, to the extent applicable.

Overview:

Ghana's primary data privacy legislation aims to protect individuals' personal data and privacy by requiring data controllers and processors to adhere to principles such as accountability, lawfulness, and security safeguards, with enforcement overseen by the established Data Protection Commission (DPC).

Product Scope:

WSO2, as an organisation, follows the Data Protection Act, 2012 for all products and services offered to customers, to the extent applicable.

Overview:

Somalia's key data protection law, in line with international standards, regulates the processing of personal data, grants data subjects rights (like access and deletion), places obligations on data controllers (such as breach notification and DPIAs), and establishes a Data Protection Authority with the power to impose significant financial penalties for non-compliance.

Product Scope:

WSO2, as an organisation, follows the Data Protection Act, 2023 for all products and services offered to customers, to the extent applicable.

Overview:

These Joint Standards, issued by the financial regulators, establish minimum, risk-based requirements for financial institutions to implement robust cybersecurity governance, manage IT risk, and build cyber resilience across the financial sector to protect against escalating cyber threats.

Product Scope:

WSO2, as an organisation, follows the FSCA and SARB Joint Standard 2 of 2024 on Cybersecurity and Cyber Resilience for all products and services offered to customers, to the extent applicable.

Overview:

Nigeria's foundational data protection law supersedes prior regulations, with the core objective of safeguarding the rights and freedoms of data subjects by regulating personal information processing, establishing the Nigeria Data Protection Commission (NDPC) as the regulatory authority, and setting requirements for lawful processing, including sensitive data and cross-border transfers.

Product Scope:

WSO2, as an organisation, follows the Data Protection Act, 2023 (NDPA) for all products and services offered to customers, to the extent applicable.

Overview:

Issued by the Central Bank of Nigeria (CBN), this framework sets minimum, risk-based cybersecurity requirements for supervised financial institutions, such as Deposit Money Banks and Payment Service Banks, detailing requirements for robust cybersecurity governance, risk management systems, and protocols for enhancing cyber resilience across the Nigerian financial sector.

Product Scope:

WSO2, as an organisation, follows the CBN Risk-Based Cybersecurity Framework and Guidelines, 2024 for all products and services offered to customers, to the extent applicable.

Overview:

This Act gives effect to the right to privacy in the Kenyan Constitution by regulating the collection, processing, storage, and transfer of personal data, establishing core data protection principles, granting rights to data subjects, and creating the Office of the Data Commissioner (ODPC) to enforce compliance and manage registration.

Product Scope:

WSO2, as an organisation, follows the Data Protection Act, 2019 for all products and services offered to customers, to the extent applicable.

Overview:

A sectoral directive from the Central Bank of Kenya (CBK), this Note establishes minimum requirements for licensed banking institutions to implement effective cybersecurity governance and risk management, mandating a top-down approach (involving the Board and CISO) and requiring the prompt reporting of significant cyber incidents to the CBK.

Product Scope:

WSO2, as an organisation, follows the CBK Guidance Note on Cybersecurity, 2017 for all products and services offered to customers, to the extent applicable.

Overview:

This directive applies to all financial institutions regulated by the Bank of Ghana, providing a mandatory framework for establishing detailed cyber and information security protocols, procedures, and governance structures to manage risk, ensure security infrastructure integrity, and enhance the overall cyber resilience of the financial sector.

Product Scope:

WSO2, as an organisation, follows the Bank of Ghana Cyber & Information Security Directive, 2018 for all products and services offered to customers, to the extent applicable.

Overview:

Egypt's data privacy law establishes standards for the lawful processing of personal data, including the requirement for all controllers and processors to obtain a license or permit from the Personal Data Protection Center, and mandates stringent principles for processing and rapid breach notification.

Product Scope:

WSO2, as an organisation, follows the Personal Data Protection Law No.151 of 2020 for all products and services offered to customers, to the extent applicable.

Overview:

This is Morocco's primary legislation for the protection of personal data, establishing guidelines for data processing in both the public and private sectors, requiring adherence to principles like explicit consent and security, and mandating that certain processing activities receive prior notification or authorization from the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP), Morocco's official data protection authority.

Product Scope:

WSO2, as an organisation, follows the Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data, 2009 for all products and services offered to customers, to the extent applicable.

Overview:

This specific law is dedicated to establishing a legal and regulatory framework for cybersecurity, prescribing a set of rules and security measures to ensure and enhance the security and resilience of information systems belonging to government administrations, public entities, and operators of critical infrastructure.

Product Scope:

WSO2, as an organisation, follows the Law No. 05-20 on Cybersecurity, 2020 for all products and services offered to customers, to the extent applicable.

Overview:

This Act protects the privacy of individuals and personal data by regulating its processing by all entities (public and private) and applies extraterritorially to those processing data of Ugandan citizens, mandating compliance with core principles, requiring consent, and establishing a Data Protection Office to oversee its

Product Scope:

WSO2, as an organisation, follows the Data Protection and Privacy Act, 2019 for all products and services offered to customers, to the extent applicable.

Overview:

Adopted in 2014 and now in force, this continental legal framework aims to harmonize legislation across African Union (AU) member states by providing unified guidelines on three main pillars: regulating electronic transactions, establishing a framework for personal data protection with mandatory national authorities, and criminalizing a broad range of cybercrime activities.

Product Scope:

WSO2, as an organisation, follows the African Union Convention on Cyber Security and Personal Data Protection, 2014 for all products and services offered to customers, to the extent applicable.

Overview:

Specific initiative for civil aviation, consolidating various regulations into one listing for easier compliance.

Product Scope:

All WSO2 products that are Self-hosted and SaaS

Overview:

Mandates aviation organizations and authorities to manage information security (IS) risks impacting aviation safety, requiring systematic identification, protection (like encryption, access controls), detection, response, and recovery from cyber threats using an ISMS (Information Security Management System) based on standards like ISO 27001

Product Scope:

All WSO2 products that are Self-hosted and SaaS

Overview:

Directs common basic standards for aviation security in the EU, covering everything from airport access control, screening of passengers and baggage, staff recruitment/training (like background checks for security roles), to vehicle access and implementing security programs, aiming to harmonize and strengthen EU aviation security against threats.

Product Scope:

All WSO2 products that are Self-hosted and SaaS

Overview:

Aerospace and Defense official standard for cybersecurity maturity evaluation and increase built by Airbus, Dassault Aviation, Safran and Thales to help the Aerospace Supply Chain to be more resilient.

Product Scope:

All WSO2 products that are Self-hosted and SaaS

Overview:

Baseline standard of protection for personal data in Singapore. It complements other sector-specific regulatory requirements. Also establishes a national Do Not Call (DNC) Registry for individuals to opt-out from receiving unwanted telemarketing messages.

Product Scope:

All WSO2 products that are Self-hosted

Overview:

Regulates how government agencies and private sector organizations handle personal information by governing the collection, use, storage, and disclosure of data.

Product Scope:

All WSO2 products that are Self-hosted

Overview:

Guidelines provided by the Reserve Bank of India on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds.

Product Scope:

Identity Platform - SaaS / Cloud, Developer Platform and API Platform - Self-hosted

Overview:

Protects the privacy of individuals by regulating the use of their personal information.

Product Scope:

Identity Platform - SaaS / Cloud

Overview:

Regulates personal data processing and protects individuals' privacy

Product Scope:

All WSO2 products that are Self-hosted and SaaS

Overview:

Comprehensive framework governing privacy and data processing in Italy.

Product Scope:

All WSO2 products that are Self-hosted

Overview:

The Swiss Federal Act on Data Protection strengthens data privacy for natural persons, aligns with EU GDPR requirements, and mandates stricter transparency and security measures for data processors. This applies to both private persons and federal bodies, focusing on protecting personality and fundamental rights.

Product Scope:

API Platform - SaaS / Cloud & Integration Platform - SaaS / Cloud

Overview:

Protects the privacy of individuals by regulating the use of their personal information. Also ensures that the Philippines complies with international standards set for data protection through the National Privacy Commission.

Product Scope:

Developer Platform

Overview:

UAE's comprehensive Personal Data Protection Law (PDPL) for public & private sector processing of personal data.

Product Scope:

All WSO2 products that are Self-hosted

Overview:

Provides comprehensive consumer protection including consumers' privacy and data security.

Product Scope:

All WSO2 products that are Self-hosted

Overview:

The EU AI Act is the world's first comprehensive legal framework for artificial intelligence, enacted in 2024. It takes a risk-based approach, classifying AI systems into four tiers from unacceptable risk to minimal risk and imposing obligations proportionate to the potential harm each tier poses. The strictest requirements apply to AI used in sensitive domains such as employment, healthcare, law enforcement, and access to essential services. It applies globally to any organisation whose AI systems affect individuals within the EU.

Product Scope:

All WSO2 products that are Self-hosted and SaaS.

Overview:

This act focuses on transparency of AI-generated content rather than risk-based regulation. It applies to large generative AI providers with over one million monthly users, requiring them to provide free AI content detection tools and embed disclosures in AI-generated images, video, and audio. It targets AI developers and model providers rather than businesses that deploy or integrate AI into their products.

Product Scope:

All WSO2 products that are Self-hosted and SaaS.

Overview:

It targets developers and deployers of high-risk AI systems that make or substantially influence consequential decisions affecting consumers in areas such as employment, healthcare, financial services, and housing. Its primary focus is preventing algorithmic discrimination and requires impact assessments, risk management programmes, and consumer disclosure obligations.

Product Scope:

All WSO2 products that are Self-hosted and SaaS.

Overview:

Issued by President Trump in his first term, this order directed federal agencies to adopt AI in a manner that is lawful, purposeful, accurate, reliable, safe, understandable, and accountable. It focused specifically on government use of AI rather than private sector regulation. It established nine principles of trustworthy AI that continue to inform how federal agencies evaluate and deploy AI systems.

Product Scope:

All WSO2 products that are Self-hosted and SaaS.

Overview:

Issued by President Biden, this order established the first comprehensive federal framework for responsible AI development in the United States. It directed federal agencies and AI developers to prioritise safety, security, privacy, and equity in AI systems. It was revoked by the Trump administration in January 2025, but its principles remain widely referenced as a benchmark for responsible AI governance.

Product Scope:

All WSO2 products that are Self-hosted and SaaS.