SOC 2 Type II: evidence and scope.

Ask security@zof.ai whether a current SOC 2 Type II report is available for the Zof service you are evaluating and what conditions apply to its disclosure. If a report is provided, review its stated entity, scope, and period before drawing a conclusion about the controls examined. Record any evidence that remains unavailable in your vendor assessment.

This public page does not identify an auditor, examination period, audit opinion, or set of covered Trust Services Categories. Where a report is provided, confirm those details in the report itself. Do not assume that every Zof deployment, integration, or customer-managed component is included.

• Contact security@zof.ai

SOC 2 is an attestation engagement performed by an independent CPA firm using the AICPA Trust Services Criteria. A Type II report addresses the design and operating effectiveness of specified controls over a defined period. It is not a certification that every system is secure or that future incidents cannot occur.

Security is the common category; availability, processing integrity, confidentiality, and privacy may be included when relevant to the engagement. Review which categories the actual report covers. An availability criterion does not by itself create a customer uptime SLA.

Read the auditor’s opinion together with management’s assertion, the system description, tests and results, and customer control responsibilities. A cover page or badge does not supply enough information for a risk decision.

• Scope: legal entity, services, locations, system boundaries, and excluded components.
• Time: start and end of the examination period and whether later changes require additional information.
• Opinion and exceptions: relevant qualifications, control deviations, and their effect on your use case.
• Subservice organizations: treatment of infrastructure and other providers and whether their controls are included or carved out.
• Complementary user entity controls: the identity, access, configuration, monitoring, or other controls your organization must operate.
• Follow-up: material changes after the report period and any additional current-period information available from Zof.

Match the report to the service you intend to use and review the architecture, security schedule, DPA, and service commitments separately. A customer-managed runner, a third-party model endpoint, or a new integration can introduce responsibilities outside the examined system.

Document your conclusions and unresolved questions in your vendor assessment. If a requirement needs a contractual commitment, address it in the agreement; a report request or marketing statement does not amend the contract.

• Deployment architecture
• Compliance overview

Send your company name, business contact, intended deployment, data classification, procurement deadline, and the questions or questionnaire you need addressed. Identify any mandatory assurance, residency, contractual, or sector-specific requirements before a pilot begins.

Security materials may contain confidential information. We will confirm which materials apply to your evaluation, their availability, and any confidentiality terms. Review the named service, assessment date, coverage period, exclusions, and customer responsibilities in each document; a document about a hosting provider is not an assessment of Zof itself.

Do not send credentials, production datasets, health information, or complete vulnerability exploits in an initial procurement email. Request a suitable transfer method if sensitive material is necessary.

• Contact security@zof.ai
• Deployment review checklist