Question 1

Is ZenHR SOC 2 compliant?

Accepted Answer

ZenHR is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is ZenHR SOC 2 Type I or Type II?

Accepted Answer

ZenHR is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 3

Can I use ZenHR's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. ZenHR's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 4

Is ZenHR penetration tested?

Accepted Answer

ZenHR hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 5

Can I get ZenHR's SOC 2 report?

Accepted Answer

ZenHR's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Question 6

Is ZenHR secure?

Accepted Answer

Security isn't a single yes/no, but ZenHR is SOC 2 Type II compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 7

Does ZenHR have a bug bounty or vulnerability disclosure program?

Accepted Answer

ZenHR hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@zenhr.com or via a /security page (ZenHR lists a security contact).

Question 8

Who are ZenHR's subprocessors?

Accepted Answer

ZenHR's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Question 9

Where does ZenHR host or store data?

Accepted Answer

ZenHR's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Question 10

Where is ZenHR's trust center or security page?

Accepted Answer

ZenHR's trust center is at https://trust.zenhr.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 11

What security measures are in place to protect employee data?

Accepted Answer

Our HRMS product employs various security measures including encryption of data at rest and in transit, role-based access control, multi-factor authentication, regular security audits, and compliance with industry standards such as SOC 2 type II, or other relevant regulations depending on the jurisdiction.

Question 12

Does ZenHR encrypt data at rest?

Accepted Answer

All datastores with customer data, in addition to S3 buckets, are encrypted at rest. Sensitive collections and tables also use row-level encryption. This means the data is encrypted even before it hits the database so that neither physical access, nor logical access to the database, is enough to read the most sensitive information

Question 13

How does ZenHR encrypt data in-transit?

Accepted Answer

ZenHR uses TLS 1.2 or higher everywhere data is transmitted over potentially insecure networks. We also use features such as HSTS (HTTP Strict Transport Security) to maximize the security of our data in transit. Server TLS keys and certificates are managed through Application and deployed via Application Load Balancers."

Question 14

Where are your servers located?

Accepted Answer

ZenHR's servers are located in the Cloud services, with options for data residency in the EU or MidEast regions.

Question 15

Does ZenHR conduct penetration tests?

Accepted Answer

Annually, we rigorously conduct penetration tests, adhering to professional standards and employing exhaustive methodologies to comprehensively assess our systems' security posture.

Question 16

How do you ensure data privacy and confidentiality?

Accepted Answer

ZenHR ensures data privacy and confidentiality through strict access controls, encryption, regular security training for employees handling sensitive data, and adherence to data protection regulations.

Question 17

How is user access managed within the ZenHR?

Accepted Answer

User access is managed through role-based access control (RBAC) where permissions are assigned based on job roles and responsibilities. This ensures that employees only have access to the data and features necessary for their job functions.

Question 18

What measures are in place to protect against insider threats?

Accepted Answer

ZenHR has strict access controls, monitoring systems, and policies in place to mitigate insider threats. Employee access to sensitive data is limited to what is necessary for their job functions, and all access and activities are logged and monitored for suspicious behavior.

Question 19

How do you handle data backups and disaster recovery in the ZenHR product?

Accepted Answer

We regularly back up all data stored in the ZenHR product to secure offsite locations. Additionally, we have robust disaster recovery plans in place to ensure minimal data loss and downtime in the event of any unforeseen incidents.

Question 20

Does the ZenHR product undergo third-party security audits and certifications?

Accepted Answer

Yes, we regularly engage third-party security firms to conduct comprehensive security audits and assessments of the HRMS product. Additionally, we obtained relevant security certifications such as SOC 2 to demonstrate our commitment to security best practices.

ZenHR

About

Compliance & infrastructure

Documents

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Business & Industrial peers that completed SOC 2

Octopus Deploy

Newsworthy.ai

1099-Prep

Ask Ai