Orbion: ISO 27001 certified 39 days after Stage 1

Orbion, a Berlin biotech startup, was certified to ISO/IEC 27001:2022 by Tempo Audits, a UKAS-accredited certification body, in August 2026, 39 days after its Stage 1 audit.

Founded in 2025, Orbion is a small team that builds its own AI models for protein engineering. Its models predict protein expression, stability and developability, helping scientists decide which protein designs to test in the lab. It works with biotech companies and academic researchers. Orbion prepared for ISO 27001 with Kantis, a London-based compliance platform for early-stage startups in the UK and Europe, especially teams in regulated sectors like biotech, fintech and AI.

The challenge: why a biotech startup needed ISO 27001

"Our customers and partners entrust us with sensitive research data and valuable intellectual property," says Aniruddh Goteti, co-founder of Orbion. "We wanted an independent, recognised standard to demonstrate how we protect that information. ISO 27001 gave us a structured way to assess our security, document our controls and have them independently audited."

Preparation: policies, controls and evidence in Kantis

"We used Kantis to organise our policies, controls and supporting evidence," says Aniruddh. "Its draft policies provided a starting point, which we adapted to our biotech work and actual operations. We implemented the controls and prepared the evidence."

"Kantis gave us a clear structure for preparation and connected us with Tempo Audits, a UKAS-accredited certification body," he adds.

Why Tempo: UKAS-accredited and quick to schedule

Aniruddh first spoke with Rob Hall, Tempo's CEO, on 22 June 2026. Rob sent over a proposal and timeline the same day.

Jamie, Tempo's Operations Manager, then put the dates in the calendar. When Orbion asked for an earlier Stage 1 slot in July, Tempo found one and brought Stage 2 forward too.
‍
Tempo also offered a German-speaking auditor, and Orbion chose to run the audit in English. By 30 June, 8 days after Orbion's first call with Tempo, both audit stages were booked. Stage 1 later moved up again, to 16 July.

The audit: Stage 1 in July, Stage 2 in August

Dan Sampson led both audit stages for Tempo. He had read-only access to Orbion's Kantis workspace and reviewed Orbion's documents and evidence there.

The Stage 1 audit took place on 16 July 2026 and focused on Orbion's policies and documentation. After a short opening meeting, Dan worked through them during the day, raising questions over Slack and WhatsApp, and shared his findings at a closing meeting that afternoon. Tempo sent the Stage 1 report the next day. It listed five opportunities for improvement, which Dan called "an excellent result".

The Stage 2 audit followed on 17 and 18 August and examined Orbion's controls and evidence in detail, including physical security. Stage 2 closed with zero non-conformities, and Dan recommended Orbion for certification. For a team certifying for the first time, it was a strong result.

Tempo Audits issued Orbion's ISO/IEC 27001:2022 certificate (TA-01-OG-240826) on 24 August 2026, 6 days after Stage 2 finished and 39 days after Stage 1.

"The audit process was incredibly smooth with Dan, and we really appreciate all the support," Aniruddh wrote to Tempo that day.

The result

Orbion went from Stage 1 to a UKAS-accredited ISO 27001 certificate in 39 days. The certificate's scope covers the people, processes, systems, vendors, facilities and information assets used to operate, secure and support Orbion's protein engineering SaaS platform, production APIs, ML compute workflows, customer support operations and supporting business operations.

"Our certification is now visible on our website and through our Trust Center, where partners can request supporting security documents," says Aniruddh. "We also have a documented framework for policy reviews, risk management and evidence collection. This provides the basis for maintaining our security controls and preparing for annual surveillance audits."

Orbion is based in Berlin and chose a UK certification body. UKAS and DAkkS, Germany's national accreditation body, are both signatories to the European co-operation for Accreditation (EA) multilateral agreement, under which they accept each other's accreditation as equivalent.

Key outcomes

• ISO/IEC 27001:2022 certificate issued 39 days after Stage 1
• Both audit stages booked within 8 days of the first call with Tempo
• Stage 1 report shared the day after the audit
• Zero non-conformities at the close of Stage 2
• Certificate issued 6 days after Stage 2 finished
• Remote audit, with evidence reviewed in Orbion's compliance platform, Kantis

"Working with Kantis, we achieved ISO/IEC 27001:2022 certification with zero outstanding non-conformities at the close of Stage 2," says Aniruddh Goteti, co-founder of Orbion. "Kantis provided structure and support, and Tempo conducted a thorough, fair independent audit. We are proud of the work behind that result."

Your tools, our audit

Orbion needed a certificate its partners could trust. Orbion's team built and ran the system, keeping its compliance work in Kantis. Tempo's job was to test that system against ISO/IEC 27001:2022 and decide whether to certify it.

Tempo prefers to audit in the tools clients already use, whether that is a compliance platform (such as Adoptech, Drata, Kantis, Kertos, Probo, Secfix or Vanta) or a well-organised shared drive. Whichever platform a client uses, the audit is the same independent assessment. Tempo books audits quickly, aims to share the Stage 1 report within 1-2 days, and often issues certificates within a week of Stage 2.

Need ISO 27001 certification? Get a quote or book a call with the Tempo team.

About Orbion. Orbion is a Berlin-based biotech company developing AI models for protein engineering, working with biotech companies and academic researchers. orbion.life

About Kantis. Kantis is a London-based compliance platform for early-stage startups in the UK and Europe, especially teams in regulated sectors like biotech, fintech and AI. It combines software with hands-on support to get ISO 27001, SOC 2 and GDPR in place, from policies and evidence to a Trust Center for customers. getkantis.com