GoRoute is operated by ClayDesk LLC under an ISO/IEC 27001:2022 information security management system and an ISO 22301:2019 business continuity management system, both certified in March 2026 with a scope that names the e-invoicing platform. GoRoute is an OpenPeppol-certified access point and SMP provider (POP000991), accredited by the New Zealand Peppol Authority (MBIE) as a Peppol Access Point and Service Metadata Publisher since 16 October 2026, listed on the Australian Taxation Office's Peppol service provider register, and an accredited e-invoicing service provider of the Oman Tax Authority. This page lists each credential with the facts needed to verify it.
Certificate copies and the penetration-test summary are available to customers and auditors on request: admin@goroute.ai.
ClayDesk LLC, 45 Burgundy Hills Lane, Middletown, CT 06457, USA
Certificate 240326050104, issued by ARS Assessment Private Limited under United Accreditation Foundation (UAF) accreditation. Registered 24 March 2026, surveillance audits February 2027 and February 2028, expires 23 March 2029. Scope: protection of data assets and information pertaining to clients and end users relating to the online platform providing e-invoicing solutions, managed DevOps services, ERP integration and consulting.
ClayDesk LLC
Certificate 240326110105, same issuer and accreditation, same registration and expiry dates. Scope: providing e-invoicing solutions, managed DevOps services, ERP integration and consulting.
POP000991
GoRoute operates its own access point (ap.goroute.ai) and service metadata publisher (smp.goroute.ai) on the production Peppol network, under OpenPeppol membership and the Peppol service provider agreement, for the EU, the United Kingdom, Norway, Australia, New Zealand, Singapore and Oman.
Issued 16 October 2026, valid until 31 July 2027
Certificate of Accreditation issued to ClayDesk LLC by the New Zealand Peppol Authority (Ministry of Business, Innovation and Employment, Pūtea Tāhiko) for the Peppol Access Point and Service Metadata Publisher services, signed by the New Zealand Peppol Authority Manager, and GoRoute is listed on the Authority's eInvoicing Access Point providers list. The Authority's year runs to 31 July, so the accreditation is renewed annually. GoRoute is also listed on the Australian Taxation Office's Peppol service provider register, so one provider covers both sides of the Tasman.
Union Digital Technologies SPC, GoRoute's Omani entity
Accredited by the Oman Tax Authority for the Fawtara e-invoicing programme since July 2026; Omani tax data is processed in Oman.
| Control | What is in place |
|---|---|
| Penetration testing | Independent web-application test of app.goroute.ai in September 2026; findings closed within days; repeated annually. Summary available under NDA. |
| Hosting | Amazon Web Services, United States, for the global service; Oracle Cloud Infrastructure, Muscat, for Omani tax data. Encrypted in transit and at rest. |
| Access to your data | Row-level tenant isolation in the database; role-based permissions; every connected app, including AI assistants, acts only within the connecting person's role and can be disconnected by them. |
| Marketplace reviews | Apps published on the Wix App Market, WordPress.org, the Shopify App Store (GoRoute: Verifactu) and Microsoft Marketplace (GoRoute E-Invoicing for Microsoft 365 Copilot). |
Privacy terms, retention and sub-processors are in the privacy policy. Service terms are in the terms of service.
The four we are asked most often in vendor reviews
ClayDesk LLC, the United States company that operates GoRoute. The ISO 27001 and ISO 22301 certificates are issued in its name and their scope names the e-invoicing platform, so they cover the GoRoute service whichever ClayDesk entity you contract with. The OpenPeppol certification, the ATO register entry and the New Zealand Peppol Authority accreditation are all held by ClayDesk LLC as well.
It is issued by ARS Assessment Private Limited under United Accreditation Foundation (UAF) accreditation, which carries the IAF multilateral recognition mark, and it can be verified at the certifier's register and at IAF CertSearch by certificate number.
Yes. An independent web-application penetration test of app.goroute.ai was carried out in September 2026, its findings were closed within days, and the test is repeated annually. The report is available to customers under NDA.
GoRoute's global service runs on Amazon Web Services in the United States. Omani tax data is processed in Oman on Oracle Cloud Infrastructure in Muscat, as the Oman Tax Authority requires. The privacy policy lists sub-processors.
