Psynth wins ISO 27001 certification for psychological assessment AI

Psynth said it earned ISO/IEC 27001:2022 certification on Sept. 30 for its AI-assisted psychological assessment platform, adding to its SOC 2 Type II and privacy programs. The company says the move reinforces security for clinicians handling patient data, clinical documents and test results across the U.S., Canada and Europe.

Why it matters: - Psynth now pairs ISO/IEC 27001:2022 certification with SOC 2 Type II, HIPAA, GDPR and PIPEDA programs. - The certification is meant to reassure clinicians and patients that psychological assessment data is handled under independently reviewed security controls. - Psynth publishes certificates, audit reports, policies and its subprocessor list at trust.psynth.ai.

What happened: - Psynth announced ISO/IEC 27001:2022 certification for its information security management system. - Glocert International Certifications (UK) Limited issued the certificate on Sept. 30, 2026, after an independent audit. - The certification covers Psynth’s AI-assisted psychological assessment platform, including the web application, supporting cloud environments and AI model integrations. - The platform helps clinicians turn patient data, clinical documents and test results into assessment reports.

The details: - Psynth said the security and privacy program began in November 2025 and was built to meet five frameworks: ISO/IEC 27001, SOC 2 Type II, HIPAA, GDPR and PIPEDA. - In August 2026, Psynth received an unmodified SOC 2 Type II opinion with no exceptions. - Psynth operates as a HIPAA Business Associate to clinician customers and as a data processor under GDPR and PIPEDA. - The ISO certificate number is 26ISMS-1263. - The certification is valid through Sept. 29, 2029, subject to ongoing surveillance audits. - Psynth said all core AI operations now run inside its own Google Cloud environment. - Data extraction runs there on Google Gemini models. - Extraction is processed in-region for customers in Canada and the European Union. - Report generation also runs inside Psynth’s Google Cloud environment and is processed in-region where the required models are available. - Where the required models are not available, Psynth said data transfer agreements described in its Terms apply. - Patient records, session data and finalized reports are stored at rest in the customer’s region: the U.S., the EU or Canada. - Psynth also published a guide explaining what ISO/IEC 27001 certification means for psychologists at Psynth’s ISO 27001 guide.

Between the lines: - The certification signals Psynth is trying to compete on compliance as much as on product features. - Moving AI extraction and report generation into Psynth-controlled cloud infrastructure reduces dependence on outside processing paths. - The company is also drawing a clear line between security certification and clinical responsibility: licensed providers still review, edit and finalize all reports. - CEO Stephen Stearman said the company sees the certifications as independent confirmation that security is built into how Psynth operates.

What’s next: - Psynth said structured intake is next on the product roadmap. - Ambient listening and AI-assisted report generation are already in market. - The company is serving clinical, neuropsychological and forensic practitioners across the U.S. and Canada. - Psynth said it will continue to publish supporting evidence openly rather than behind a sales process.

The bottom line: - Psynth is turning security credentials into a core part of its pitch as it expands an AI platform for psychological assessment.