Key Takeaways
- Most AI visibility vendors advertise SOC 2, not ISO 27001. In the research behind this guide, only BrightEdge was tied to ISO 27001:2022. Ask every vendor for the certificate and its scope.
- SSO and audit logs are usually enterprise-tier features. A checkbox on a feature page means nothing until you know which plan includes it.
- Promptwatch is ISO/IEC 27001 certified and GDPR compliant, with an EU-based company handling the data. Enterprise adds SSO, and the audit log starts at Business.
- Profound, AthenaHQ and Scrunch list SAML/OIDC SSO on public pages. Peec AI lists SAML 2.0 only. Residency and DPA terms are mostly "not publicly verified".
- Run the same 30-day pilot for every shortlisted vendor, and test SSO scoping and exports yourself instead of trusting a demo.
A note on scope: I did not verify Brandlight's own security posture, so this guide does not say what Brandlight has or lacks. It is written for teams who looked at Brandlight, or any monitoring-first tool, and now need to put a security questionnaire next to the feature list. Check Brandlight directly before ruling it in or out.
Why regulated buyers need a different shortlist
Most AI visibility reviews rank tools by prompt counts, model coverage and price. A bank, insurer, healthcare group or public company starts somewhere else. Can the vendor pass a security review? Can we force SSO and revoke access when someone leaves? Can we show an auditor who changed what?
The awkward truth is that this category is young. Many vendors are a couple of years old, and their public trust documentation is thin. The enterprise comparison I relied on (written by LightSite, a competitor, so read it with that in mind) uses the phrase "not publicly verified" a lot. That does not mean the capability is absent. It means you cannot confirm it without asking.
So the job is part shortlisting, part evidence collection.
ISO 27001 vs SOC 2 in this category
ISO/IEC 27001 certifies an information security management system. The 2022 revision has 93 Annex A controls in four themes (organisational, people, physical, technological), down from 114 controls in 14 domains. SOC 2 is an attestation report, common in the US. Neither is better in the abstract, but European and global regulated buyers often write ISO 27001 into procurement policy.
Three things to demand from any vendor:
- The certificate itself, showing the issuing body and expiry date.
- The scope statement. A certificate that covers only the corporate office or one product line tells you little about the platform holding your data.
- The Statement of Applicability, if your risk team wants to see which Annex A controls are in or out.
Compliance software vendors like Drata and Optro publish useful explainers on what auditors check, and they are worth reading before you write your questionnaire.
One more caution. A vendor's location does not establish data residency. "We are a European company" is not a contractual commitment about where prompts, responses and logs are processed. Get residency into the DPA or order form.
What the vendors list publicly
The table below summarizes what the sources I found say. Treat blanks as unknown, not as no. Capabilities change quickly, and I did not check pricing for anyone.
| Vendor | SSO | Audit logs / RBAC | Certification stated | Open questions |
|---|---|---|---|---|
| Promptwatch | SSO on Enterprise | Audit log on Business, Agency Scale, Enterprise; owner/editor/viewer roles | ISO/IEC 27001 certified, GDPR compliant | Confirm certificate scope on its trust page |
| Profound | SAML/OIDC | RBAC listed | SOC 2 Type II stated, report not inspected | Residency, DPA |
| Peec AI | SAML 2.0 only (no OIDC or SCIM) | Company and project-level access | Not publicly verified | SOC report, residency, DPA |
| AthenaHQ | SAML/OIDC (Enterprise) | Activity audit logs, RBAC | Not publicly verified | SOC report, residency, subprocessors |
| Scrunch | SAML/OIDC (Enterprise) | RBAC listed | SOC 2 Type II stated | Scope, residency, DPA, retention |
| Semrush Enterprise | SSO listed | Audit logs listed | Not covered in my sources | May not apply to the base AI toolkit |
| AirOps | SSO listed | Approvals, version history | SOC 2 Type II, AES-256, TLS, DPA available | Residency |
| BrightEdge | Not covered | Not covered | References ISO 27001:2022, ISO 27701, ISO/IEC 42001 | SOC 2 report type unstated |
The Promptwatch row comes from the vendor's own published facts rather than the LightSite comparison, so verify the certificate and scope with the vendor before it goes into a risk register, as you should for everyone else.
Shortlist: alternatives worth evaluating
Promptwatch
Promptwatch is the option on this list that pairs a stated ISO/IEC 27001 certification with an audit log and enterprise SSO, and it is built as an end-to-end AI visibility platform rather than a dashboard. It tracks ChatGPT, Gemini, Claude, Perplexity, Google AI Overviews, Google AI Mode, Copilot and others from the real interfaces, then traces citations, reads IP-verified AI crawler logs, and ships content through a Content Agent with WordPress, Webflow and Framer publishing. Visitor analytics close the loop on traffic and conversions.
The governance details matter more for this audience than the feature list:
- ISO/IEC 27001 certified and GDPR compliant, with data handled by an EU-based company.
- Owner, editor and viewer roles with project-level access.
- An organization audit log on Business, Agency Scale and Enterprise that records each change and whether it came from the dashboard, the API, an MCP client or Agent Chat. That last part is useful when AI agents can act on your behalf.
- Scoped project, organization and read-only API keys.
- SSO, a white-label dashboard and client portal on Enterprise.
Plan boundaries are exactly the pitfall flagged earlier, so here they are: the Business plan is $579/mo and includes the audit log, the Content Agent, Fact Check and faster-than-daily tracking. SSO sits on Enterprise, which is custom priced. Confirm current numbers at promptwatch.com/pricing. There is a 7-day free trial on monthly billing, and a free AI visibility report if you want a no-login look first. For a head-to-head view of the monitoring-first competitor set, see Promptwatch vs Profound.
Honest caveat: I did not confirm Promptwatch's certificate scope or SSO protocol details independently. Request both during the pilot like you would for anyone else.
Profound
Profound lists SAML/OIDC SSO and role-based access control, plus server-log integrations with Cloudflare, AWS and Vercel. Its Enterprise page states SOC 2 Type II, though the report was not inspected in my sources. Residency and DPA terms were not publicly verified. It is a strong monitoring product, usually at a higher price point.
AthenaHQ
The Enterprise plan lists SAML/OIDC SSO, activity audit logs and RBAC, with API access included (a paid add-on on Starter). That is one of the clearer public statements of the three controls you asked about. SOC report, residency, subprocessors and DPA were not publicly verified, so those go on your question list.
Scrunch
Scrunch lists SAML/OIDC on its Enterprise plan and RBAC on its enterprise page, and states SOC 2 Type II compliance. One procurement-specific wrinkle: Scrunch became a Sitecore company on 3 June 2026. If you are not already a Sitecore customer, get the standalone roadmap and renewal terms in writing.
Peec AI
Peec AI supports company-level and project-level full and read-only access, and has an API. SSO is SAML 2.0 only, with no OIDC or SCIM in the source. That may be fine, or a blocker, depending on your identity provider. SOC report, residency and DPA were not publicly verified.
BrightEdge
If ISO 27001 is a hard requirement, BrightEdge is the only vendor in my sources tied to it: a seoClarity page references ISO/IEC 42001, ISO 27001:2022 and ISO 27701, and a SOC 2 examination without stating the report type. It is a broader enterprise SEO suite, so you are buying more platform than a pure AI visibility tracker. I only saw a search snippet of that source, so confirm directly.
Semrush Enterprise and AirOps
Semrush's Enterprise offering lists SSO, team governance and audit logs, alongside multi-brand tracking and API. Do not assume those apply to the base AI toolkit. AirOps lists SSO, approvals and version history, and its security docs state SOC 2 Type II, AES-256, TLS and DPA availability. AirOps is a content engineering platform, so it fits if your main need is governed content production.
For wider browsing, the GEO software directory at bestgeosoftware.com lists many more tools in the category.
Questions that should block a purchase
These come from the LightSite pilot guide, and I would adopt them nearly unchanged.
Identity and access
- Which SSO protocol is supported? SAML, OIDC, or both?
- Can SSO be enforced, personal logins disabled, and access revoked centrally?
- Is SCIM provisioning included, or does offboarding stay manual?
- Can a regional editor see only their own brand? Can an agency user export another brand's data?
Data handling
- Request the DPA, security report scope, subprocessor list, incident process, model-provider retention terms, deletion schedule and processing locations.
- Get data residency as a contractual term, not a marketing line.
- Ask whether your prompts or content are used to train anything.
Auditability
- Is there a visible record of who approved content, changed crawler access or published a page?
- Can you roll those changes back?
- Does the audit log distinguish a human click from an API call or an AI agent action?
Commercial terms
- Put usage limits, overages, support response times, availability commitments, renewal terms and an exit export into the order form.
- Ask which tier holds each feature. An API for prompt reports is not necessarily an API for crawler logs or publishing.
A 30-day pilot that exposes the gaps
Use the same prompt set and markets for every vendor, or the comparison is worthless.
| Week | What to do | What you learn |
|---|---|---|
| 1 | Agree 50 to 100 prompts, markets and engines in writing. Configure SSO, two roles and one restricted brand. Confirm a restricted user cannot see data outside their brand. | Whether access controls work as advertised |
| 2 | Export answer text, cited URLs and dates. Spot-check 10 answers against the live assistants. | Data fidelity and export quality |
| 3 | Take one page through approval to publication and record who did what. | Whether the audit trail is usable |
| 4 | Measure AI-referred visits and qualified inquiries in your own analytics. | Whether visibility scores connect to outcomes |
| Exit | Disable the integration and confirm the site and data return to normal. | Lock-in risk |
Week 3 is where audit logs earn their keep. Do not just look for a log page. Ask your internal auditor to read an entry and say whether they could reconstruct an event from it.
What this means for your own trust pages
If you run a regulated company, there is a flip side. Buyers now ask AI assistants about vendor compliance before they ever email you. According to Promptwatch Data's report on which content types ChatGPT cites the most (Sep 28 to Oct 4, 2026), product pages take 22.4% of classified citations and landing pages 16.8%. Documentation is 7.5% and FAQ pages 3.3%. For branded prompts, product pages hold 23.3% and landing pages 22.8%.
The practical read: your security, trust and compliance pages, docs and FAQs are the material an assistant can cite when someone asks "is this vendor ISO 27001 certified?" Keep them public and crawlable. Promptwatch Data's content half-life report also found that landing pages and docs stay cited longest, while news loses half its pages in about 36 days. A well-kept trust page ages better than a press release announcing your certification.
To check whether AI crawlers can actually read those pages, a crawler log view or the AI crawler URL inspector is a fast first test. For a broader category view, ai-rank-tools.com lists AI rank trackers.
How to pick
- You need ISO 27001 specifically, plus a tool that does the optimization work: start with Promptwatch and verify the certificate scope.
- You want the broadest enterprise SEO suite with ISO references: look at BrightEdge.
- SSO and audit logs on a single enterprise plan matter most: AthenaHQ and Profound both list them publicly, and so does Promptwatch on its Business and Enterprise tiers.
- You already run Sitecore: Scrunch becomes more interesting.
- Your identity provider only speaks SAML: Peec AI may work, but confirm SCIM needs first.
Whatever you choose, the paperwork is the product at this stage. Ask for the certificate, the scope, the DPA and the plan boundary in writing, then run the pilot. A vendor that answers those questions quickly and specifically is telling you something useful before you sign anything.