Galaxies earns ISO 27001 certification and becomes the first synthetic personas company in the world with this level of information security

Galaxies, a Brazilian market research startup based on artificial intelligence, has earned ISO 27001 certification, the most recognized international standard for information security. With this achievement, the company becomes the first in the synthetic personas segment in the world to reach this level of audited governance over data, models, and research processes.

A first-of-its-kind milestone in AI-powered market research

Founded in 2022 in São Paulo, Galaxies has just reached a milestone no other company in the synthetic personas sector had achieved: ISO/IEC 27001 certification, issued by an internationally accredited certification body. The seal recognizes that the company operates with documented processes, formal controls, continuous monitoring, and external audit over its Information Security Management System.

For a market where consumer data, proprietary research, and AI-trained models move between client companies and AI platforms, certification is not just a diploma. It is auditable evidence that every process involving sensitive information follows recognized standards for security, traceability, and accountability.

What ISO 27001 is and why it matters for the AI market

ISO/IEC 27001 is the most widely adopted international standard for information security management. It does not certify isolated products or technologies. It certifies the complete management system of an organization. To obtain certification, a company must demonstrate through independent external audit that it has documented controls for risk identification, data protection, incident response, access management, business continuity, and continuous improvement.

For companies that operate with consumer data, quantitative and qualitative research, and AI models trained with proprietary information from clients such as Nestlé, Magalu, O Boticário, Bradesco Seguros, and Meta, ISO 27001 represents assurance that the full data lifecycle, from collection to disposal, is managed under clear security criteria.

In the Brazilian context, this also means alignment with LGPD requirements, which establish concrete obligations around governance, privacy by design, and accountability in the event of incidents. For companies that handle sensitive data, the standard becomes an essential foundation for scaling AI safely.

Security that was born with the platform

ISO 27001 certification did not represent a sudden architectural shift for Galaxies. It formalized and externally audited practices that had already been part of the Nexus platform infrastructure since the beginning of operations.

The solution was built on four data protection pillars:

• Secure transmission and storage: all data travels through encrypted channels and is stored with advanced encryption in private buckets, with versioning and strict access control.

• Full compliance with LGPD and GDPR: the platform adopts governance, privacy, and processing practices aligned with Brazilian and European data protection requirements.

• Governance and access control: permissions, credentials, and operating routines follow documented policies and are reviewed to reduce exposure to unnecessary access.

• Granular authorization for internal services: documents and data are accessed only by authorized services within the platform architecture, with monitoring and traceability.

The platform also operates with a standardized Data Contract, delivered to each client before the start of the project, defining data structure, expected typing, integrity rules, and secure transfer standards. This ensures that data enters the platform in a controlled way, reducing operational risk and avoiding inconsistent handling of sensitive information.

What changes for Galaxies clients

ISO 27001 certification has direct impact on the due diligence processes that large companies perform before hiring technology vendors. Public companies, multinationals with global security policies, and organizations in regulated sectors such as finance, healthcare, and retail increasingly require objective evidence of information security maturity.

With ISO 27001, Galaxies removes a qualification step that used to require technical visits, extensive questionnaires, and internal risk analyses. Certification issued by an accredited external auditor replaces that process with objective, internationally recognized evidence.

For clients already using the platform, certification confirms that research data, trained models, and generated insights are under an audited protection regime, without depending on unilateral statements from the company.

Context: a startup with technology excellence credentials

Galaxies has accumulated a set of recognitions that place the company among the most qualified AI startups in the Brazilian ecosystem. The technology was developed with Google Cloud acceleration, published as a success case in the program, and the company is part of an environment of applied innovation in synthetic data, consumer intelligence, and predictive simulation.

In 2025, HSR Specialist Researchers acquired a stake in the company, bringing Galaxies the methodological backing of one of Brazil’s largest specialized research firms. The partnership expanded the platform’s application scope across qualitative research, quantitative research, creative validation, and strategic decision-making.

ISO 27001 certification adds to this portfolio of credentials and responds to a growing demand in the B2B market: companies that need fast and reliable insights do not want to choose between speed and security. With Galaxies, both dimensions are part of the same architecture.

Platform results: the numbers that support trust

Security certification gains weight when accompanied by concrete operating results. Nexus platform indicators document what the technology delivers in practice:

• 97% reduction in research time: projects that used to take two and a half years can now be completed in two weeks per research wave.

• 85% savings in direct costs: the cost per research project fell from R$1 million to R$150,000.

• From 1,000 respondents to 10,000 simulated profiles: the platform expands processing capacity from 1,000 to 33,000 synthetic respondents per study.

• 2,700% database expansion: more than 81,000 participants registered in the platform base.

• 91% accuracy compared with real respondents: validation studies show strong alignment between Synthetic Personas and real consumer responses.

• 60x more qualitative responses: in a quarter of the time and at one tenth of the cost per respondent, according to a client report from the insurance sector.

Next steps and market vision

Daniel Victorino has already signaled that ISO 27001 is not the endpoint of Galaxies’ governance plan. Certification represents the foundation on which new controls, audits, and compliance processes will be built as the company expands its presence with large enterprise clients in Brazil and abroad.

The AI-powered market research sector is entering a consolidation phase. Companies that can combine speed, accuracy, and auditable security will be ahead in the qualification process for large corporate accounts. In this context, ISO 27001 turns information security from a technical requirement into a competitive advantage.

Frequently asked questions about ISO 27001 and Galaxies

What is ISO 27001 certification?

ISO 27001 is the international reference standard for Information Security Management Systems, also known as ISMS. It certifies that an organization has implemented documented and audited processes to protect data, control access, respond to incidents, and ensure operational continuity.

Is Galaxies really the first synthetic personas company with ISO 27001?

Yes. According to the announcement by CEO Daniel Victorino, Galaxies is the first company in the synthetic personas segment in the world to obtain ISO 27001 certification, representing a competitive advantage in qualification processes with large B2B companies that require auditable evidence of information security.

Does ISO 27001 guarantee compliance with LGPD?

ISO 27001 and LGPD are complementary. The international standard structures the information security management system, while LGPD defines legal obligations for personal data processing in Brazil. Galaxies operates in compliance with both and also follows GDPR requirements for clients with operations in Europe.

How does ISO 27001 certification impact current Galaxies clients?

For active clients, certification confirms that research data, trained models, and generated insights are under a protection regime audited by independent third parties. For new clients, ISO 27001 helps eliminate due diligence steps, reduce extensive security questionnaires, and accelerate qualification and contracting processes.

What data is protected by Galaxies’ security system?

The security system covers quantitative and qualitative research data provided by clients, synthetic persona models generated on the platform, system access and operation data, and all communication between the client environment and Galaxies infrastructure. No real consumer data is stored in an identifiable way.

Does Galaxies use internet data to create synthetic personas?

No. The platform uses exclusively quantitative and qualitative research data provided by Galaxies, by the client, or by the client’s partners. This approach ensures that synthetic personas reflect the client’s real audience without contamination from unaudited external data.