Compliance evidence with a defined scope.

For vendor evaluation, ask security@zof.ai whether a current SOC 2 Type II report or ISO 27001 certificate is available for the service in scope. Establish any assurance conclusion from the underlying document, including its legal entity, service boundary, assessment period, issuing organization, and exceptions. Confirm availability and scope before treating a procurement requirement as satisfied.

SOC 2 is an independent attestation report, not a product certification. ISO 27001 addresses an information security management system within a defined certification scope. Neither replaces your own review of data flows, permissions, configuration, or contract terms.

GDPR and HIPAA are legal frameworks, not certifications supplied by a security badge. A GDPR assessment depends on the processing purpose, parties, locations, safeguards, and applicable law. A healthcare use case requires an agreed scope and, where required, an executed business associate agreement before protected health information is submitted.

• SOC 2 review guide
• GDPR and data protection

A useful compliance package identifies the supplier entity, purchased service, deployment boundary, data categories, customer responsibilities, and the period covered by each assessment. Map your mandatory requirements to evidence and record any gap or agreed mitigation before approval.

Ask which evidence is available for your evaluation, including any SOC 2 report or ISO certificate, security questionnaire responses, architecture and data-flow description, security measures, DPA, subprocessor information, and relevant service schedule. Identify material that must still be prepared or agreed. Confirm currency, scope, and disclosure conditions for each document.

• Check the legal entity and service named in the report or certificate against your order.
• Review assessment periods, certificate validity, exclusions, findings, and complementary customer controls.
• Record who owns each required control in hosted, customer-managed, and integrated systems.
• Confirm how material service or processing changes will be communicated under the agreement.

Tell Zof about sector-specific requirements during scoping, including protected health information, payment-card data, government information, financial records, or special-category personal data. Do not treat general platform access as authorization to submit every category of regulated information.

For healthcare, confirm whether the intended workflow is supported and execute any required business associate agreement before processing protected health information. For payment data, determine the actual cardholder-data environment and evidence required by your organization. This page makes no PCI DSS Level 1 or CSA STAR registration representation.

Your organization remains responsible for its own lawful basis, notices, user authorizations, risk assessments, and configuration decisions. Supplier assurance is one input to that process.

The privacy notice addresses Zof’s handling of website and business-contact data. Customer personal data processed to provide the service is addressed by the applicable agreement and DPA. Determine the controller, processor, or subprocessor roles for your actual arrangement.

Confirm where data will be stored, accessed, and otherwise processed, including model services, support, logs, and integrations. A regional hosting selection does not itself settle every international-transfer question. Identify the applicable transfer mechanism and supplementary measures in the executed documents.

• Privacy notice
• DPA
• GDPR review

Send your company name, business contact, intended deployment, data classification, procurement deadline, and the questions or questionnaire you need addressed. Identify any mandatory assurance, residency, contractual, or sector-specific requirements before a pilot begins.

Security materials may contain confidential information. We will confirm which materials apply to your evaluation, their availability, and any confidentiality terms. Review the named service, assessment date, coverage period, exclusions, and customer responsibilities in each document; a document about a hosting provider is not an assessment of Zof itself.

Do not send credentials, production datasets, health information, or complete vulnerability exploits in an initial procurement email. Request a suitable transfer method if sensitive material is necessary.

• Contact security@zof.ai
• Deployment review checklist

This page supports vendor evaluation and describes the topics to confirm for your use of Zof. The applicable Terms of Service and DPA, together with any executed agreement, order form, and service schedule, define the commitments for your organization according to their order of precedence. Public security descriptions do not amend those terms or extend a commitment to every deployment.

Security depends on the selected service, configuration, integrations, and customer environment. Confirm the controls and evidence for the actual scope you will purchase before transferring regulated information or enabling production access.