GlobalSign nv-sa Due Diligence

Run due diligence on GlobalSign nv-sa: check compliance and get alerts when suppliers or ownership change.

Belgium · owned by GMO Internet Group, Inc. (Japan) · www.globalsign.com · 29 vendors

GlobalSign is a WebTrust-certified certificate authority and provider of identity services. The company also sells and manages SSL certificates.

Resilience scores

Technology vendors

Services catalogue

12 services in catalogue across 3 categories; runs on 29 sub-vendors.

Insights

Last updated 2026-09-26 · revision 2

29 direct vendors, 251 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

7 in-scope frameworks identified; showing 3.

ISO 27001 (source) — Evidence found

Evidence: https://www.globalsign.com/en/repository/GlobalSign_KK_ISMS.pdf

NIS2 (source) — No public evidence

ISAE 3000 (source) — No public evidence

Financials

Three-year financials

Financial Resilience Score: 8/10

GlobalSign nv-sa demonstrates strong financial resilience primarily through its ownership by GMO Internet Group, a profitable, multi-billion-USD revenue listed Japanese internet conglomerate (TSE: 9449). This parent backing provides capital access, group-shared infrastructure, and stability through economic cycles. The business model is built on recurring revenue from certificates, managed PKI, and signing services, which are largely subscription-based and renewal-heavy, producing predictable cash flows. The company benefits from a substantial regulatory moat: status as a Qualified Trust Service Provider under eIDAS, inclusion in browser/OS root trust stores, and AATL/Microsoft/Adobe trust list inclusion are high barriers to entry built over 25+ years. Founded in 1996, it is one of the world's oldest certificate authorities with a diversified product mix across SSL/TLS, IoT identity, document signing, code signing, and S/MIME, serving enterprise, government, finance, healthcare, and energy verticals globally. Key risks include price pressure from free CAs (Let's Encrypt, ZeroSSL) compressing commodity DV SSL margins, shortening certificate lifetimes (industry move to ~47-day validity) increasing automation requirements, and existential trust-incident risk where any mis-issuance or audit failure could lead to root-store distrust events. Concentration in digital trust services makes the business vulnerable to technology shifts like post-quantum migration. Note that specific three-year financial figures could not be verified in the source report.

Key strengths: Strong, deep-pocketed parent (GMO Internet Group, TSE-listed), Recurring subscription revenue model with high renewal rates, Regulatory moat via eIDAS qualified trust status and root trust store inclusion, Diversified product portfolio across SSL/TLS, PKI, IoT, document/code signing, Global delivery footprint across EMEA, Americas, and APAC, 25+ year operating history as one of the oldest CAs, Blue-chip customer references (Microsoft, Cisco, J&J, AT&T)

Risk factors: Price pressure from free CAs (Let's Encrypt, ZeroSSL) on commodity SSL, Shortening certificate lifetimes (~47-day validity) pressuring unit economics, Trust-incident risk — mis-issuance could trigger root-store distrust, Concentration in digital trust vertical vulnerable to tech shifts (post-quantum, passwordless), FX and intra-group transfer-pricing exposure, Limited transparency at the Belgian entity level

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report