Review the evidence for your deployment.

Zof supports AI testing and governed remediation across software systems. A security review should cover what the platform can read, where tests execute, which actions require approval, what evidence is retained, and how access is removed. These decisions matter as much as the selection of a hosting region.

Use this trust center to assemble a review package for engineering, security, privacy, legal, and procurement. Begin with the intended environment and data classification, then map each requirement to an applicable document, configuration, or contractual commitment.

• Architecture: execution placement, control and intelligence services, integrations, and permitted network destinations.
• Data protection: source code, test inputs, logs, traces, screenshots, model requests, retention, and deletion.
• Governance: user and service identities, roles, credentials, approval policy, and evidence export.
• Operations: support contacts, incident escalation, recovery expectations, and the service schedule in your agreement.

For vendor evaluation, ask security@zof.ai whether a current SOC 2 Type II report or ISO 27001 certificate is available for the service in scope. Establish any assurance conclusion from the underlying document, including its legal entity, service boundary, assessment period, issuing organization, and exceptions. Confirm availability and scope before treating a procurement requirement as satisfied.

SOC 2 is an independent attestation report, not a product certification. ISO 27001 addresses an information security management system within a defined certification scope. Neither replaces your own review of data flows, permissions, configuration, or contract terms.

GDPR and HIPAA are legal frameworks, not certifications supplied by a security badge. A GDPR assessment depends on the processing purpose, parties, locations, safeguards, and applicable law. A healthcare use case requires an agreed scope and, where required, an executed business associate agreement before protected health information is submitted.

• SOC 2 review guide
• GDPR and data protection

Zof documents private cloud, on-premises, Kubernetes, hybrid, edge-runner, and secure-enclave deployment approaches. Customer-controlled execution can place work near the applications under test. Execution location alone does not establish where every piece of data is processed.

Review control-plane communication, model-provider requests, artifact uploads, logging, support access, and connected tools separately. Identify what leaves the execution boundary, the destination and purpose, and who approves the flow. Confirm the implementation and service scope for your deployment with the Zof team.

• Deployment architecture
• Security and shared responsibility

Each document addresses a different part of the relationship. Read the privacy notice for website and business-contact data, the DPA for customer personal data, the subprocessor information for service-provider review, and the agreed service schedule for availability and support.

• Privacy notice
• Terms of service
• Data processing addendum
• Subprocessors
• Security overview
• Service level terms
• Acceptable use policy
• Vulnerability reporting

Send your company name, business contact, intended deployment, data classification, procurement deadline, and the questions or questionnaire you need addressed. Identify any mandatory assurance, residency, contractual, or sector-specific requirements before a pilot begins.

Security materials may contain confidential information. We will confirm which materials apply to your evaluation, their availability, and any confidentiality terms. Review the named service, assessment date, coverage period, exclusions, and customer responsibilities in each document; a document about a hosting provider is not an assessment of Zof itself.

Do not send credentials, production datasets, health information, or complete vulnerability exploits in an initial procurement email. Request a suitable transfer method if sensitive material is necessary.

• Contact security@zof.ai
• Deployment review checklist

This page supports vendor evaluation and describes the topics to confirm for your use of Zof. The applicable Terms of Service and DPA, together with any executed agreement, order form, and service schedule, define the commitments for your organization according to their order of precedence. Public security descriptions do not amend those terms or extend a commitment to every deployment.

Security depends on the selected service, configuration, integrations, and customer environment. Confirm the controls and evidence for the actual scope you will purchase before transferring regulated information or enabling production access.