Zeronorth Technologies

Security isn't a single yes/no, but Zeronorth Technologies is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Zeronorth Technologies hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@zeronorth.com or via a /security page (Zeronorth Technologies lists a security contact).

Zeronorth Technologies lists 9 subprocessors on its trust center, including Amazon Web Services, Auth0, Salesforce.com, Intercom, Datadog. Buyers use this for fourth-party risk review.

Zeronorth Technologies hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Zeronorth Technologies's trust center is at https://trust.zeronorth.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Access to the data is available only through the restricted access control layer implemented through the application. We also use various encryption techniques to ensure data residing on the cloud and data transferring over the cloud is protected and accessible only by the authorized users. The following entities or users are covered by this policy: • Full or part-time employees of ZeroNorth who have access to ZeroNorth or customer data. • ZeroNorth vendors or processors who have access to ZeroNorth or customer data. • Other persons, entities, or organizations that have access to ZeroNorth or customer data. All network, system, and application events must only result from allowable actions through access control mechanisms. Permission may be derived directly from an individual’s identity, or from a job classification or administrative privilege based on that individual’s identity. The principle of “least privilege” specifies that individuals only be granted permission for actions needed to perform their jobs. Limiting actions to those properly authorized protects the confidentiality and integrity of data within the ZeroNorth processing environment. In this context, access control refers to a security service that allows or denies a user request based on privilege, group information, or context. Confidentiality refers to a security service that prevents disclosure of information to unauthorized parties while the information is in use or transit or being stored.

Clients have complete control as well as ownership of their data. With necessary access credentials, Client users can access data anytime, anywhere in the world.

ZeroNorth will, unless otherwise specified by the client, aggregate any and all data entered the application to formulate anonymized voyage data, trends and insights that would be beneficial to voyage management. ZeroNorth takes the utmost care in anonymizing this aggregated data so anything published or sent externally could not be identified or tied to any one client of the application.

Appropriate logging techniques are in place at the AWS, local operating system and database levels to capture valuable metrics and events. At the individual application level, audit control is maintained with clear indication of user, date/time capture on creation and modification of data.

Data is encrypted with industry standard AES-256 encryption algorithm in both transit and at rest.

We support (and recommend) Single Sign-On for customer login. We use Auth0 for authentication and support the identity providers that Auth0 supports

All ZN Bunker systems and data are hosted at AWS in the USA. All other systems and data are stored in AWS in EU (Ireland).

All security events are monitored using best-in-class monitoring and analytics tools.