GoRoute is operated by ClayDesk LLC under an ISO/IEC 27001:2022 information security management system and an ISO 22301:2019 business continuity management system, both certified in March 2026 with a scope that names the e-invoicing platform. GoRoute is an OpenPeppol-certified access point and SMP provider (POP000991) and an accredited e-invoicing service provider of the Oman Tax Authority. This page lists each credential with the facts needed to verify it.
Certificate copies and the penetration-test summary are available to customers and auditors on request: admin@goroute.ai.
ClayDesk LLC, 45 Burgundy Hills Lane, Middletown, CT 06457, USA
Certificate 240326050104, issued by ARS Assessment Private Limited under United Accreditation Foundation (UAF) accreditation. Registered 24 March 2026, surveillance audits February 2027 and February 2028, expires 23 March 2029. Scope: protection of data assets and information pertaining to clients and end users relating to the online platform providing e-invoicing solutions, managed DevOps services, ERP integration and consulting.
ClayDesk LLC
Certificate 240326110105, same issuer and accreditation, same registration and expiry dates. Scope: providing e-invoicing solutions, managed DevOps services, ERP integration and consulting.
POP000991
GoRoute operates its own access point (ap.goroute.ai) and service metadata publisher (smp.goroute.ai) on the production Peppol network, under OpenPeppol membership and the Peppol service provider agreement, for the EU, the United Kingdom, Norway, Australia, New Zealand, Singapore and Oman.
Union Digital Technologies SPC, GoRoute's Omani entity
Accredited by the Oman Tax Authority for the Fawtara e-invoicing programme since July 2026; Omani tax data is processed in Oman.
| Control | What is in place |
|---|---|
| Penetration testing | Independent web-application test of app.goroute.ai in September 2026; findings closed within days; repeated annually. Summary available under NDA. |
| Hosting | Amazon Web Services, United States, for the global service; Oracle Cloud Infrastructure, Muscat, for Omani tax data. Encrypted in transit and at rest. |
| Access to your data | Row-level tenant isolation in the database; role-based permissions; every connected app, including AI assistants, acts only within the connecting person's role and can be disconnected by them. |
| Marketplace reviews | Apps published on the Wix App Market and WordPress.org; the Shopify and Microsoft listings are in their stores' review at the time of writing. Microsoft's Publisher Attestation is submitted with the Copilot agent. |
Privacy terms, retention and sub-processors are in the privacy policy. Service terms are in the terms of service.
The four we are asked most often in vendor reviews
ClayDesk LLC, the United States company that operates GoRoute. The ISO 27001 and ISO 22301 certificates are issued in its name and their scope names the e-invoicing platform, so they cover the GoRoute service whichever ClayDesk entity you contract with.
It is issued by ARS Assessment Private Limited under United Accreditation Foundation (UAF) accreditation, which carries the IAF multilateral recognition mark, and it can be verified at the certifier's register and at IAF CertSearch by certificate number.
Yes. An independent web-application penetration test of app.goroute.ai was carried out in September 2026, its findings were closed within days, and the test is repeated annually. The report is available to customers under NDA.
GoRoute's global service runs on Amazon Web Services in the United States. Omani tax data is processed in Oman on Oracle Cloud Infrastructure in Muscat, as the Oman Tax Authority requires. The privacy policy lists sub-processors.
