Data you can trust starts here.
One page for everything procurement and security teams ask about: certification, security architecture, privacy, agreements, and service status.
ISO/IEC 27001:2022 certified
Zap holds its own ISO/IEC 27001:2022 certification, covering our information security management system and operating controls. Zap Cloud runs on Microsoft Azure, whose data centers are separately SOC 2 and ISO/IEC 27001:2022 compliant.
Our physical, operational, and application security controls are governed through the ISO 27001 certified ISMS, which has been independently audited and is reviewed and improved on an ongoing basis.
How Zap Cloud protects your data
The highlights, from the same document your security team will read in full.
Encrypted at rest and in transit
Customer data, including backups, are stored on disks that encrypt data at rest with 256-bit AES. All in-transit data is protected with HTTPS, for web traffic and extracted client data alike.
Regional data residency
Customer data is stored in its region of origin except where contractually agreed otherwise. Data and backups remain within the customer's Azure region, on locally redundant storage with point-in-time restore.
Isolated tenancy
Single-tenant plans host each customer on dedicated servers inside an isolating Network Security Group. Multi-tenant environments keep each customer's data in a separate database within its own isolated environment.
Enterprise authentication
Secure authentication with Microsoft Entra ID, including multi-factor authentication and ADFS support. Bring your own Microsoft Entra ID with OpenID Connect and SAML.
Reviewed on every line, independently tested
Development uses processes and tools from the Microsoft SDL, with mandatory reviews on every line of code, automated in-house testing, and periodic third-party penetration tests.
Role-based, down to the row
Role-based security governs access to application resources, and role-based data security restricts access to rows and cells in the analytic reporting database.
Is Zap up right now?
Current availability for Zap Data Hub is published on our status page. Security-related announcements, bug fixes and known vulnerabilities are published on the Zap HelpDesk.
Policies and agreements
Everything a security questionnaire will ask for, in one place.
Security and reliability
Privacy
Reporting a vulnerability
If your team discovers a vulnerability, contact the Zap HelpDesk and our support team may then provide a secure channel to discuss the details. Vulnerability management, incident response, and corrective actions are managed under our ISO 27001 ISMS.