How we protect customer data

Our Cryptography Policy requires strong encryption: current TLS for data sent over public networks and AES-256 encryption for confidential data at rest.

Our Access Control Policy requires multi-factor authentication for privileged access to production infrastructure, least-privilege access based on role and business need, and encrypted remote connections. Access is removed promptly when someone leaves or changes roles.

Our Operations Security Policy requires firewalls or equivalent network access controls on production systems, reviewed at least annually. Sign-ins, changes, and administrator access are logged, and log data is protected from tampering. Alerts are configured for suspicious activity, and public-facing systems are scanned for vulnerabilities at least quarterly.

Backups run daily for in-scope systems and are stored separately from production data. Restores are tested at least annually, and we maintain a business continuity and disaster recovery plan that is tested every year.

Changes to production are documented, tested, reviewed, and approved before deployment. Our Secure Development Policy applies security-by-design and privacy-by-design principles.

We maintain a documented incident response plan with severity levels and defined roles. Suspected incidents must be reported immediately, and we notify affected customers and regulators of relevant incidents in accordance with our policies and applicable law.

Before sharing confidential data with a third party, we perform a risk assessment and put a written agreement in place that covers confidentiality and security responsibilities.

Personnel are screened in proportion to the access they receive, sign confidentiality agreements, and complete security awareness training when they join and every year after.

Personal information is kept only as long as there is a legitimate business purpose, and customer data is deleted within 60 days after a contract ends unless an agreement or law requires otherwise. See our Privacy Policy and Terms of Service.

Zudo is working toward SOC 2 compliance. Our security and compliance documentation is available in our Trust Center.

To report a suspected vulnerability or security incident, email security@zudo.work.