Brarista is ISO 27001 certified: secure AI bra fitting for lingerie retailers

Brarista is certified to ISO/IEC 27001:2022, the international standard for information security management. Our certificate was issued on 24 July 2026 by Tempo Audits, a UKAS-accredited certification body, after a two-stage audit of the Brarista platform and the way we run the company behind it.

If you're here because a security questionnaire asked: yes. You can check it yourself on our Tempo certificate page or by searching Brarista Ltd on UKAS CertCheck.

I'll be honest, we've been sitting on this news since July. Partly because we were busy. Mostly because I wanted to write about it properly, since it's one of the least glamorous things we've done and one of the things I'm proudest of.

Why this matters more when the data is this personal

Most AI chatbots deal with order numbers and delivery dates. Ours hears about band sizes, cup sizes, breast shape and sometimes nursing, mastectomy or prosthesis needs. Shoppers tell Brarista things they'd think twice about saying to a stranger in a fitting room.

When I started building Brarista, AI was such a foreign concept to most of the consumers we spoke to. Convincing people to trust AI was placed as the highest commercial risk in every product meeting we had. Getting a shopper to share her measurements with a chatbot was one hurdle. Getting a retailer's security team to sign off was another (I have genuinely lost count of the questionnaires).

Intimate wear is finally catching up with the rest of e-commerce on AI (I know, only took six years or so). As the world's first AI bra fitting chatbot trained by professional fitters, we wanted the trust side to be as solid as the fit side. ISO 27001 is how we prove it, rather than just promise it.

What ISO 27001 actually means, in plain English

ISO 27001 doesn't certify a feature. It certifies how a company looks after information, day in, day out. An independent auditor checks that we know where our risks are, that we've decided what to do about each one, and that we actually do it - not just on audit day.

In practice, that meant putting four things in place:

• A written information security management system (ISMS) covering how Brarista is built, run and supported

• A risk assessment based on how the business really works, including every third-party service we rely on

• Security controls chosen from the standard's Annex A, with a written reason for any we left out

• Regular internal audits and management reviews, on a schedule rather than whenever someone asks

It isn't a one-off either. There's a surveillance audit every year (our first is booked for June 2027) and a full recertification in year three. Miss one and the certificate lapses.

How we actually got here

We're a small team split between the UK and Vietnam, with no compliance department to hand this to. So we brought in ISO Serious to guide us through it, and Tempo Audits to audit us independently.

We started in February 2026. The first few weeks were data mapping: drawing out, on a Miro board, every place customer and company data travels, from how we build software to HR, finance, sales and marketing. It's slow, detailed work, and I'll admit there were a few groans from the team after the Lunar New Year break. It's also the bit that made everything after it make sense.

From there we built the rest:

• A competency matrix, so every role knows which security responsibilities sit with them

• Onboarding and offboarding checklists, so access is granted and removed the same way every time

• A data retention tracker, recording what we store, why we store it and when it's deleted

• A sub-processor list, with every provider we rely on reviewed as part of our own risk assessment

We pushed our Stage 1 audit back so we'd be ready rather than rushed. Stage 1 took place on 24 June and Stage 2 on 8 and 9 July. The auditor raised a handful of non-conformities, which is normal and genuinely useful. We fixed each one through a corrective action plan, and the certificate followed on 24 July.

Most of the good habits were already there. Bra fitters are trained to be discreet, and that mindset shaped how we handled data from day one. What ISO 27001 added was structure around those habits, and someone outside the company checking we stick to them.

A big thank you to Mike, Nikita and Tom at ISO Serious for keeping it human, to Jordan and the team at Tempo for a fair and thorough audit, and to our engineers, who kept it moving when it all felt very messy.

What it changes for retailers

Nothing changes for your shoppers. They still get the boutique treatment your brand promises, at 2am, in their pyjamas. What changes is the paperwork on your side.

• Shorter security reviews. If your procurement process accepts ISO 27001 in place of a custom questionnaire, you can use it from today.

• Easier sign-off for larger and international retailers. ISO 27001 is the standard most European and enterprise buyers ask for by name.

• Peace of mind for the people using your chatbot. Everyone sharing their fit details through your co-branded Brarista assistant is covered by an independently audited system.

Need a copy of the certificate for your security team? Email hello@brarista.fit and we'll send it straight over.

Frequently asked questions

Is Brarista ISO 27001 certified?

Yes. Brarista Ltd is certified to ISO/IEC 27001:2022, the international standard for information security management. The certificate was issued on 24 July 2026.

Who certified Brarista?

Tempo Audits, a UKAS-accredited certification body, carried out the two-stage audit. ISO Serious supported Brarista with implementation. ISO itself doesn't certify companies - an independent, accredited certification body always does.

How can I verify Brarista's ISO 27001 certificate?

Search Brarista Ltd on UKAS CertCheck or IAF CertSearch, or view our certificate page on the Tempo website.

What does the certification cover?

The Brarista platform, including Fit AI, Style AI, Care AI and the AI bra fitting chatbot embedded on retailers' websites, plus the information security management system behind it.

What data does the Brarista chatbot handle?

The fit details shoppers choose to share in the chat, such as their current bra size, how it fits and their style preferences. How that information is stored, accessed and deleted is covered by our certified management system.

Is Brarista a secure AI bra fitting solution for lingerie retailers?

Yes. Brarista is the world's first AI bra fitting chatbot trained by professional fitters, and its platform and security management are independently certified to ISO 27001.

How long is the certification valid?

Three years, with a surveillance audit every year. If a surveillance audit isn't passed, the certificate lapses.

About Brarista

Brarista is the world's first AI bra fitting chatbot trained by professional bra fitters. Conversational AI engineered for lingerie retailers, it reimagines how bras are sized and sold, with boutique-level expertise available 24/7. Co-branded rather than white-label, and co-created and trusted by expert bra fitters, Brarista helps brands boost sales, enhance customer satisfaction and reduce lingerie returns.

For security documentation, press materials or interview requests, email hello@brarista.fit or book a demo.