Ziflow Ltd

Yes — Ziflow Ltd undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.

Ziflow Ltd publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Security isn't a single yes/no, but Ziflow Ltd is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, GDPR, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Ziflow Ltd hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@ziflow.com or via a /security page (Ziflow Ltd lists a security contact).

Ziflow Ltd lists 19 subprocessors on its trust center, including Amazon Web Services, Auth0, Avalara, ChurnZero, HubSpot. Buyers use this for fourth-party risk review.

Ziflow Ltd hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Ziflow Ltd's trust center is at https://trust.ziflow.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Access is granted by assigning an appropriate role. We use a least privilege policy. MFA is required, and access is only possible through the corporate VPN.

Yes, every month. Additionally, account activity is continuously monitored using automated tools that send alerts for suspicious/unusual activity.

Employing BitLocker AES 256-bit encryption for data at rest, we ensure robust security measures are in place. Management of all cryptographic keys is centralized through the AWS Key Management Service (KMS), guaranteeing stringent control and compliance standards. Additionally, the implementation includes an annual rotation protocol for enhanced security posture and adherence to best practices.

All network communications are safeguarded with Transport Layer Security (TLS), employing a minimum of 128-bit Advanced Encryption Standard (AES) encryption. The TLS protocol version 1.2 is utilized for secure connections, ensuring robust encryption and authentication through AES\_128\_GCM cipher suites. Furthermore, the key exchange mechanism employed is ECDHE\_RSA, further bolstering the integrity and confidentiality of data transmissions. For a comprehensive analysis of our TLS configuration, please refer to the following SSL Labs report: https://www.ssllabs.com/ssltest/analyze.html?d=ziflow.io&latest

Seamless Single Sign-On (SSO) functionality can be achieved through compatibility with any SAML2 solution, as well as via Google Sign-In integration.

Our server infrastructure is exclusively hosted within the United States. Our production environment is strategically deployed within the AWS N. Virginia region, while our disaster recovery infrastructure is redundantly established within the AWS Oregon region. This geographical distribution ensures optimal operational resilience and facilitates seamless continuity in the event of any unforeseen disruptions.

We proudly operate a Bug Bounty Program, governed by the following guidelines: - Compensation is determined by the severity of the identified issue. - The severity is validated by both our in-house security team and an independent third-party vendor. - Known issues do not qualify for rewards. Rewards are calculated considering the severity and potential impact of the reported vulnerabilities.

Please read our https://www.ziflow.com/data-processing-addendum section 4.

Yes, passwords should contain a minimum of 8 characters, including both lower and uppercase letters, and at least 1 number.

Yes, we support OTP. Users can utilize applications such as Google Authenticator or Microsoft Authenticator.

Yes, access can be restricted by adding IP addresses to the Allowlist.

Yes. Ziflow is a multi-tenanted system with logical separation of customer data. Each tenant (customer account) has a unique ID and acts as the top-level container for all customer data, given a unique ID.