Is this your company? Buyers are checking Ziflow Ltd here. Claim ziflow.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Ziflow Ltd
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Ziflow Ltd is SOC 2 Type II compliant. Ziflow Ltd also holds ISO 27001, and GDPR.
About
Ziflow is the only enterprise online proofing platform. We help creative teams handle high workloads, streamline complex workflows, and ensure regulatory and brand compliance.
Compliance & infrastructure
Hosting
AWS
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health informationFor more information check https://www.ziflow.com/data-processing-addendum/version25january2022
Documents
3Subprocessors
19- AAmazon Web Services · HostingUSA
- AAuth0 · Identity providerUSA
- AAvalara · Finance and paymentsUSA
- CChurnZero · Customer supportUSA
- HHubSpot · MarketingUSA
- LLogz.io · LogsUSA
- MMaxio (ex Chargify) · BillingUSA
- OOpenAI · AI language modelUSA
- GGoogle Gemini (Vertex AI) · AI-powered features (e.g. assistant, summarization, search)USA
- AAnthropic · AI-powered features (e.g. assistant, summarization, search)USA
- PPendo · Data analyticsUSA
- SSalesforce · SalesUSA
Show all 19 subprocessorsShow fewer
- SSlack · CollaborationUSA
- SStripe · Finance and paymentsUSA
- XXero · Finance and paymentsUSA
- ZZendesk · Customer supportUSA
- BBrightcove (Zencoder) · Video processingUSA
- CClari · Finance and paymentsUSA
- GGoogle Inc. · MarketingUSA
Compliance leadership
The person who leads Ziflow Ltd's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Ziflow Ltd's penetration test vendor isn't listed yet.
Claim this profile to add it.
Recent updates
Ziflow subprocessor listMay 2025
We’re pleased to announce that we’ve moved the Ziflow subprocessor list to the Ziflow Trust Center to enhance visibility and transparency.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Ziflow Ltd SOC 2 compliant?
Ziflow Ltd is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Ziflow Ltd ISO 27001 certified?
According to Ziflow Ltd's public trust center, Ziflow Ltd is ISO 27001 certified. On SOC2C this listing is Listed.
Is Ziflow Ltd GDPR compliant?
According to Ziflow Ltd's public trust center, Ziflow Ltd is GDPR compliant. On SOC2C this listing is Listed.
Is Ziflow Ltd SOC 2 Type I or Type II?
Ziflow Ltd is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Ziflow Ltd's SOC 2 for a vendor risk assessment?
Yes. Ziflow Ltd's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Ziflow Ltd penetration tested?
Yes — Ziflow Ltd undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.
Does Ziflow Ltd have a penetration test report?
Ziflow Ltd publishes a penetration test summary on its trust center. You can request access to it through SOC2C.
Is Ziflow Ltd secure?
Security isn't a single yes/no, but Ziflow Ltd is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, GDPR, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Ziflow Ltd have a bug bounty or vulnerability disclosure program?
Ziflow Ltd hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@ziflow.com or via a /security page (Ziflow Ltd lists a security contact).
Who are Ziflow Ltd's subprocessors?
Ziflow Ltd lists 19 subprocessors on its trust center, including Amazon Web Services, Auth0, Avalara, ChurnZero, HubSpot. Buyers use this for fourth-party risk review.
Where does Ziflow Ltd host or store data?
Ziflow Ltd hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.
Where is Ziflow Ltd's trust center or security page?
Ziflow Ltd's trust center is at https://trust.ziflow.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Ziflow Ltd
Reproduced from Ziflow Ltd's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
How is access controlled for Ziflow employees
Access is granted by assigning an appropriate role. We use a least privilege policy. MFA is required, and access is only possible through the corporate VPN.
Do you perform Access Reviews on all users?
Yes, every month. Additionally, account activity is continuously monitored using automated tools that send alerts for suspicious/unusual activity.
Do you encrypt data at rest?
Employing BitLocker AES 256-bit encryption for data at rest, we ensure robust security measures are in place. Management of all cryptographic keys is centralized through the AWS Key Management Service (KMS), guaranteeing stringent control and compliance standards. Additionally, the implementation includes an annual rotation protocol for enhanced security posture and adherence to best practices.
Do you encrypt data in transit?
All network communications are safeguarded with Transport Layer Security (TLS), employing a minimum of 128-bit Advanced Encryption Standard (AES) encryption. The TLS protocol version 1.2 is utilized for secure connections, ensuring robust encryption and authentication through AES\_128\_GCM cipher suites. Furthermore, the key exchange mechanism employed is ECDHE\_RSA, further bolstering the integrity and confidentiality of data transmissions. For a comprehensive analysis of our TLS configuration, please refer to the following SSL Labs report: https://www.ssllabs.com/ssltest/analyze.html?d=ziflow.io&latest
Do you support Single Sign-On (SSO)?
Seamless Single Sign-On (SSO) functionality can be achieved through compatibility with any SAML2 solution, as well as via Google Sign-In integration.
Where are your servers located?
Our server infrastructure is exclusively hosted within the United States. Our production environment is strategically deployed within the AWS N. Virginia region, while our disaster recovery infrastructure is redundantly established within the AWS Oregon region. This geographical distribution ensures optimal operational resilience and facilitates seamless continuity in the event of any unforeseen disruptions.
I found a security bug. Do you have an established bug bounty program?
We proudly operate a Bug Bounty Program, governed by the following guidelines: - Compensation is determined by the severity of the identified issue. - The severity is validated by both our in-house security team and an independent third-party vendor. - Known issues do not qualify for rewards. Rewards are calculated considering the severity and potential impact of the reported vulnerabilities.
What data do we collect?
Please read our https://www.ziflow.com/data-processing-addendum section 4.
Do you enforce password complexity requirements?
Yes, passwords should contain a minimum of 8 characters, including both lower and uppercase letters, and at least 1 number.
Is it possible to use MFA?
Yes, we support OTP. Users can utilize applications such as Google Authenticator or Microsoft Authenticator.
Is it possible to restrict access to applications based on specific locations?
Yes, access can be restricted by adding IP addresses to the Allowlist.
Are customer data physically and/or logically separated from data of other customers?
Yes. Ziflow is a multi-tenanted system with logical separation of customer data. Each tenant (customer account) has a unique ID and acts as the top-level container for all customer data, given a unique ID.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public