Define the boundaries before granting access.

Zof deployment documentation separates execution from the services that coordinate work and provide intelligence. Your review should identify where each part runs, which identities connect them, and the data exchanged between them. Approve a topology for the actual workload before enabling access to sensitive systems.

For a private or hybrid deployment, document network destinations, proxy requirements, artifact routes, update delivery, and support access. An outbound connection can still carry sensitive information. Inspect its payload and destination as well as its direction.

• Review deployment options
• Security documentation

The Zof administration model includes users, teams, roles, API keys, integrations, and audit evidence. Map these to your identity lifecycle and assign the minimum scope needed for each task. Review administrators and service identities separately; a narrowly scoped user role does not by itself constrain a broadly privileged integration token.

Agree who may create tests, schedule runs, approve remediation, change policies, export evidence, and administer connections. Test the approval path with a representative change before permitting production writes. Review generated code and test outcomes in your normal release process.

• Name owners for each integration and service credential; establish rotation and revocation procedures.
• Confirm available SSO, MFA, role, and session controls for the purchased service and selected identity provider.
• Check evidence for approvals, denied actions, configuration changes, and exports; confirm retention and access permissions.
• Remove access promptly when a person, vendor, or automation no longer needs it.

Source code, specifications, test fixtures, application responses, traces, screenshots, and failure logs may contain personal data or confidential information. Use synthetic or minimized data where practical and review diagnostic artifacts before sharing them. Keep passwords, tokens, and private keys out of prompts and test output.

Before enabling a model integration, confirm the provider, model endpoint, categories of data sent, processing location, retention, human access, and permitted use of that data. Confirm any restriction on model training in the applicable contract and provider configuration. A private execution runner does not automatically make an external model endpoint private.

• Data processing addendum
• Subprocessor review

The service agreement and deployment design allocate responsibilities between Zof, the customer, and infrastructure providers. For customer-managed infrastructure, assign ownership for host and cluster updates, network policy, certificate management, monitoring, backups, and recovery. For hosted components, request the applicable operational and security responsibilities from Zof.

Agree retention separately for test artifacts, source snapshots, audit events, support records, and backups. Validate export and deletion procedures, including copies in integrations. Confirm recovery objectives and restoration procedures for the systems on which your workflow depends.

Report suspected vulnerabilities to security@zof.ai using the responsible reporting guidance. For an active customer issue, also use your contracted support channel and provide the affected organization, environment, UTC time range, impact, and a safe reproduction or correlation identifier.

Contain access to affected credentials and preserve relevant evidence under your incident process. Notification obligations, incident cooperation, and service response commitments are governed by applicable law and your agreement. A security mailbox is not a substitute for your contracted emergency escalation path.

• Vulnerability reporting
• Support and escalation

Send your company name, business contact, intended deployment, data classification, procurement deadline, and the questions or questionnaire you need addressed. Identify any mandatory assurance, residency, contractual, or sector-specific requirements before a pilot begins.

Security materials may contain confidential information. We will confirm which materials apply to your evaluation, their availability, and any confidentiality terms. Review the named service, assessment date, coverage period, exclusions, and customer responsibilities in each document; a document about a hosting provider is not an assessment of Zof itself.

Do not send credentials, production datasets, health information, or complete vulnerability exploits in an initial procurement email. Request a suitable transfer method if sensitive material is necessary.

• Contact security@zof.ai
• Deployment review checklist

This page supports vendor evaluation and describes the topics to confirm for your use of Zof. The applicable Terms of Service and DPA, together with any executed agreement, order form, and service schedule, define the commitments for your organization according to their order of precedence. Public security descriptions do not amend those terms or extend a commitment to every deployment.

Security depends on the selected service, configuration, integrations, and customer environment. Confirm the controls and evidence for the actual scope you will purchase before transferring regulated information or enabling production access.