Security you can verify

Compliance and certifications

Independent audits keep us honest. Reports are available under NDA via the request form below.

• SOC 2 Type IIActive

  Annual examination across security, availability, and confidentiality criteria by an AICPA-registered firm.

• GDPRCompliant

  Aligned with EU 2016/679, including a signed DPA with SCCs and a published subprocessor schedule.

• HIPAABAA available

  Business Associate Agreement available for eligible workspaces with PHI-handling configuration enabled.

• ISO 27001Certified

  Information security management system certified by an accredited registrar; annual surveillance audits.

• CCPA / CPRACompliant

  Honours consumer rights requests including access, deletion, and opt-out of sale or sharing.

• PCI DSSSAQ-A

  All card data is tokenised by Stripe; ZevyAI never stores cardholder data on its own infrastructure.

Security overview

• Encryption everywhere

  TLS 1.2+ in transit and AES-256 at rest. Customer-managed encryption keys are available on the Enterprise plan.

• Automated key rotation

  Cryptographic keys rotate on a 90-day schedule. Key material lives in an HSM-backed key management service.

• Least-privilege access

  Engineer access is just-in-time, scoped to a specific incident, expires automatically, and is fully audited.

• 24/7 monitoring

  Centralised logging, anomaly detection, and on-call paging with a fifteen-minute response SLO for severity-one events.

• Annual penetration tests

  Independent offensive security testing covering the API, web app, and infrastructure. Latest report available on request.

• SSO and SCIM

  SAML 2.0 single sign-on and SCIM 2.0 user provisioning included with Team and Enterprise plans.

How your data is handled

• Data residency

  Choose an EU or US primary region at workspace creation. Data does not leave the selected region unless you enable a feature that requires it.

• Retention controls

  Configure custom retention windows for chats, files, and audit logs. Default retention is 365 days; we never silently extend it.

• Right to deletion

  Workspace admins can purge their data on demand. Backups are overwritten within 90 days; we provide written confirmation when destruction is complete.

• Self-service export

  Export chats, knowledge bases, and audit logs as JSON or CSV at any time, with no rate limits and no support ticket required.

Incident response

• Detection

  Anomalies in auth, API rate, and infrastructure telemetry trigger automated paging routed to the on-call security engineer.

• Response SLO

  Acknowledge within 15 minutes (sev-1), 60 minutes (sev-2). Incident commander assigned within 30 minutes for any customer-impacting event.

• Customer notification

  Confirmed personal data breaches are notified within 72 hours via email to the workspace privacy contact and a banner in the product.

• Public postmortems

  We publish blameless postmortems for severity-one events within ten business days. Past postmortems are linked from status.zevyai.com.

Subprocessors

We use a small set of trusted infrastructure providers. The full schedule, including data categories and locations, lives in the DPA.

• StripePayment processing
• AWSPrimary cloud hosting and storage
• DatadogInfrastructure monitoring
• SentryError monitoring
• OpenAILLM inference (opt-in)
• AnthropicLLM inference (opt-in)

View the full subprocessor schedule in the DPA

Audit log preview

Every admin action is captured in a tamper-evident audit log streamed to your SIEM. The snippet below shows the format your team will see in production.