The eight ISO 27001-aligned requirements professional-services teams should verify in any document-sharing tool, each with a quick pass-or-fail question covering encryption, access control, audit logs, and EU data sovereignty.
An ISO 27001 certificate on a vendor's website is a starting point, not an answer. It tells you the provider runs an information security management system, but not whether the specific service you are buying is in scope, where your data lives, or who can see it. These eight checks turn the standard into pass-or-fail questions you can ask any document-sharing tool before client files go near it.
ISO/IEC 27001:2022 certifies that an organization operates a managed information security system, audited by a third party. That is meaningful, and tools like Box, Egnyte, and Alkmist carry it. What a logo on a marketing page does not tell you is the scope of the certificate, whether your data stays in the EU, or how access and logging actually work for external client users.
For an audit or accounting firm, those specifics are the difference between a tool that helps you pass your own assessment and one that becomes a finding. The checklist below maps to the Annex A controls that matter most for client document sharing, so you can verify the substance behind the badge.
A certificate can be expired, narrowly scoped, or held by a parent entity rather than the product you are buying. Ask to see it, not just a badge.
Files must be protected while moving and while stored. Key custody matters too, since who holds the keys decides who can ultimately read the data.
Clients and external advisors should see only what their role allows. Folder-level all-or-nothing access is a common failure point for client work.
A password alone is not enough for client financial data. Look for multi-factor authentication and single sign-on that you can require, not just offer.
If you cannot show who accessed what and when, you cannot evidence the control. The log must be tamper-resistant and yours to export.
Public-by-default links are how data leaks. Shares to clients should be governed, time-bound, and reversible.
Residency is where the data sits; sovereignty is which laws can reach it. A vendor can host in the EU and still be exposed through a non-EU corporate parent.
Holding client data forever is its own risk. You need to set how long data is kept and to delete it for real at engagement close.
Box, Egnyte, and ShareFile are capable, security-certified platforms, and they will pass several of these checks comfortably. The checklist is most useful where the named tools differ, not where they agree.
On encryption and authentication, most enterprise tools pass. The separation tends to appear on checks 1, 3, and 7: the exact scope of the certificate, how granular access control is for external client users, and whether the provider offers EU residency under EU corporate control rather than an EU region operated by a US parent.
That last point is where Alkmist differs from US-headquartered platforms. Alkmist is a Belgian company, ISO 27001 certified and GDPR compliant, that keeps client data on EU infrastructure, with eight permission roles and an immutable audit trail built for external client work. Run all eight checks against any shortlist, and weight checks 1, 3, and 7 heavily for regulated EMEA firms.
Alkmist is an EU-hosted, ISO 27001 certified client portal with role-based access, controlled sharing, and an immutable audit trail, built for audit and accounting firms.
