Security questionnaires for video tools have started asking about ISO 27001 by default, and "we use Jitsi" isn't an answer an auditor accepts. This article is for the person who has to fill that questionnaire in: what ISO 27000 actually covers, why a self-hosted Jitsi WebRTC platform is easier to fit into an ISMS than a SaaS tool, and which controls the deployment has to show evidence for.
ISO 27000 and WebRTC Security Framework
What is ISO 27000?
ISO 27000 is a family of standards about information security management. The one people mean in practice is ISO 27001, which sets the requirements for an Information Security Management System (ISMS) and is the one organisations get certified against. The current edition is ISO 27001:2022, whose Annex A lists 93 controls grouped into four themes: organisational, people, physical and technological. ISO 27002 is the companion guide explaining how to implement each control. Certificates against the older 2013 edition had to move to 2022 by October 2025, so any questionnaire you get now refers to the 2022 control numbers.
WebRTC and Jitsi, briefly
WebRTC is the browser standard for real-time audio and video; Jitsi Meet is an open source platform built on it, with Prosody for signaling, Jicofo to manage conferences and the Jitsi Videobridge to route media. Media is always encrypted in transit with DTLS-SRTP, and Jitsi adds optional end-to-end encryption. If you want the full component picture, our Jitsi architecture breakdown covers it.
Why self-hosting makes the audit easier
With a SaaS video tool, half of your ISO 27001 evidence for that tool is the vendor's: their certificate, their subprocessor list, their data locations, their answers on retention. With a self-hosted Jitsi server, the controls are yours to configure and yours to prove. That's more work up front, but the answers are precise ("recordings live in this bucket in eu-central-1 and are deleted after 30 days") instead of "per the vendor's DPA". For teams in regulated sectors that precision is usually the point.
Mapping ISO 27001 Annex A Controls to a Jitsi WebRTC Deployment
This is the table an auditor actually wants. The control numbers are from ISO 27001:2022; the right-hand column is what you configure on a self-hosted Jitsi server to have something to show for each.
| Annex A control | What it asks | Jitsi evidence |
|---|---|---|
| A.5.15 Access control | Only authorised people get access | JWT or LDAP authentication for room creation, lobby and room passwords (see Jitsi authentication methods) |
| A.8.24 Use of cryptography | Encryption is defined and applied | TLS on 443, DTLS-SRTP on all media, optional E2EE (how Jitsi encryption works) |
| A.8.15 Logging | Events are logged and protected | Prosody, Jicofo and JVB logs shipped to central storage with retention set |
| A.8.8 Technical vulnerabilities | Known vulnerabilities are patched | An update schedule and a record of patched Jitsi CVEs |
| A.8.20 Network security | Networks are protected | Firewall limited to 443/tcp and 10000/udp, admin ports by source IP |
| A.5.23 Cloud services | Cloud use is managed | Chosen cloud region, account access and the provider's shared responsibility split |
| A.8.10 Information deletion | Data is deleted when no longer needed | A retention period for Jibri recordings in S3 or Cloud Storage, enforced by a lifecycle rule |
Most of this is configuration you'd want anyway; the ISO work is writing it down and proving it keeps happening. Our Jitsi Meet security checklist covers the settings in detail. If the deployment handles patient data, HIPAA adds its own requirements on top, covered in our HIPAA telehealth guide.
Building a Jitsi Deployment That Sits Inside Your ISO 27001 Scope
If the video platform is in scope for your ISO 27001 certification, a few build decisions are worth making on day one rather than retrofitting before the audit:
- Authentication is on from day one, usually JWT tied to your identity provider, so meeting access follows your existing joiner and leaver process.
- The region is chosen deliberately and written down, along with where recordings and logs are stored.
- Logs from Prosody, Jicofo and the bridges go to central storage with a retention period you set, not just the instance disk.
- Recordings, if enabled, go to a bucket with encryption and a lifecycle rule for deletion.
- Updates follow a schedule, and each upgrade is recorded, which becomes the evidence for vulnerability management.
None of that makes a Jitsi server certified. It means that when the auditor asks how a control is met for the video platform, there's a configuration and a record to point at. Meetrix can set a deployment up this way if you'd rather not build it yourself.
Is Jitsi ISO 27001 compliant?
Not on its own, and no video tool is. ISO 27001 certifies an organisation's information security management system after an independent audit, not a piece of software. What a self-hosted Jitsi deployment gives you is the controls an auditor will ask about: authentication (JWT or LDAP) for access control, DTLS-SRTP and optional E2EE for cryptography, server logs for logging and monitoring, and the choice of region for where data lives. Your ISMS documents and runs those controls; the certificate belongs to your organisation.
Jitsi Meet's Security vs. Other Platforms
| Feature | Jitsi Meet (with Meetrix) | Zoom | Microsoft Teams | Google Meet |
|---|---|---|---|---|
| End-to-End Encryption | Supported (via Jitsi Meet features) | Supported (with limitations) | Supported (with limitations) | Supported (client-side) |
| Data Control | Full control (self-hosted) | Limited (data processed on Zoom servers) | Limited (data processed on Microsoft servers) | Limited (data processed on Google servers) |
| Customization | Highly customizable | Limited | Limited | Limited |
| Compliance | Runs inside your ISO 27001 ISMS; GDPR and HIPAA capable when self-hosted | Various certifications | Various certifications | Various certifications |
Frequently Asked Questions
What is ISO 27000?
ISO 27000 is a family of standards that provide a framework for information security management. ISO 27001, the most popular standard in the family, specifies the requirements for an Information Security Management System (ISMS).
Why is ISO 27000 compliance important for WebRTC?
Compliance with ISO 27000 ensures that a WebRTC application has a structured approach to managing sensitive information, mitigating risks like unauthorized access and data breaches, which is crucial for real-time communications.
Is Jitsi ISO 27001 compliant?
Software can't be ISO 27001 certified; organisations are. A self-hosted Jitsi server gives you the controls auditors ask about (authentication, encryption, logs, data location), and your ISMS documents and operates them. The certificate is your organisation's, not Jitsi's.
Which ISO 27001 Annex A controls does a Jitsi deployment touch?
Mainly A.5.15 access control, A.8.24 use of cryptography, A.8.15 logging, A.8.8 technical vulnerability management, A.8.20 network security, A.5.23 cloud services and A.8.10 information deletion for recordings.
What are the benefits of running Jitsi yourself for ISO 27001 work?
You decide where data lives, who can create meetings, how long logs and recordings are kept, and when patches go in. With a SaaS tool you inherit the vendor's answers and have to collect their evidence instead.
Secure Your Communications Today
Learn more about how Meetrix can help you achieve ISO 27000 compliance with our secure, customizable Jitsi-based video conferencing solutions.
Contact Us
