Security measures and review scope.

This page supports vendor evaluation and describes the topics to confirm for your use of Zof. The applicable Terms of Service and DPA, together with any executed agreement, order form, and service schedule, define the commitments for your organization according to their order of precedence. Public security descriptions do not amend those terms or extend a commitment to every deployment.

Security depends on the selected service, configuration, integrations, and customer environment. Confirm the controls and evidence for the actual scope you will purchase before transferring regulated information or enabling production access.

A security assessment should connect each safeguard to the system it protects and the party operating it. Request the security schedule or description of measures applicable to your order and DPA. Identify the data, environments, people, and third parties covered by that description.

For transmission and storage protection, review the protocols and encryption configuration at each boundary, key ownership, certificate lifecycle, and administrative access. Do not infer an identical cipher, key model, or security boundary for customer infrastructure, third-party integrations, and hosted services.

• Identity and access: account lifecycle, privileged access, service credentials, authentication, and least privilege.
• System protection: network isolation, configuration management, vulnerability handling, software updates, and endpoint ownership.
• Data lifecycle: collection, classification, access, export, retention, deletion, and backup handling.
• Operational safeguards: security responsibilities, incident procedures, personnel confidentiality, and vendor review.
• Evidence: audit records, assessment scope, test summaries, material exceptions, and agreed review procedures.

Customers determine the applications, repositories, environments, and test data they authorize Zof to access. Establish a permitted-use boundary for each connection, including whether testing may change records, trigger notifications, incur third-party charges, or affect production traffic.

A test artifact can contain the same sensitive information as the system under test. Review screenshots, request and response bodies, logs, and generated reports for secrets and personal data. Define approved destinations and retention periods for the evidence your team exports.

Request the date, scope, methodology, assessor, and applicable summary for any penetration test or control assessment used in your review. Distinguish completed work from a planned assessment and unresolved findings from verified remediation. A public summary may omit technical exploit details and sensitive infrastructure information.

Testing Zof or a customer environment requires appropriate authorization. Use the reporting policy for suspected vulnerabilities and obtain written scope before testing systems that are not explicitly authorized. Do not use a security review to access another customer’s data.

• Vulnerability reporting policy

For vendor evaluation, ask security@zof.ai whether a current SOC 2 Type II report or ISO 27001 certificate is available for the service in scope. Establish any assurance conclusion from the underlying document, including its legal entity, service boundary, assessment period, issuing organization, and exceptions. Confirm availability and scope before treating a procurement requirement as satisfied.

SOC 2 is an independent attestation report, not a product certification. ISO 27001 addresses an information security management system within a defined certification scope. Neither replaces your own review of data flows, permissions, configuration, or contract terms.

GDPR and HIPAA are legal frameworks, not certifications supplied by a security badge. A GDPR assessment depends on the processing purpose, parties, locations, safeguards, and applicable law. A healthcare use case requires an agreed scope and, where required, an executed business associate agreement before protected health information is submitted.

• SOC 2 review guide
• GDPR and data protection

Send your company name, business contact, intended deployment, data classification, procurement deadline, and the questions or questionnaire you need addressed. Identify any mandatory assurance, residency, contractual, or sector-specific requirements before a pilot begins.

Security materials may contain confidential information. We will confirm which materials apply to your evaluation, their availability, and any confidentiality terms. Review the named service, assessment date, coverage period, exclusions, and customer responsibilities in each document; a document about a hosting provider is not an assessment of Zof itself.

Do not send credentials, production datasets, health information, or complete vulnerability exploits in an initial procurement email. Request a suitable transfer method if sensitive material is necessary.

• Contact security@zof.ai
• Deployment review checklist