Question 1

Is CAOS AG SOC 2 compliant?

Accepted Answer

CAOS AG is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is CAOS AG ISO 27001 certified?

Accepted Answer

According to CAOS AG's public trust center, CAOS AG is ISO 27001 certified. On SOC2C this listing is Listed.

Question 3

Is CAOS AG GDPR compliant?

Accepted Answer

According to CAOS AG's public trust center, CAOS AG is GDPR compliant. On SOC2C this listing is Listed.

Question 4

Is CAOS AG CCPA compliant?

Accepted Answer

According to CAOS AG's public trust center, CAOS AG is CCPA compliant. On SOC2C this listing is Listed.

Question 5

Is CAOS AG SOC 2 Type I or Type II?

Accepted Answer

CAOS AG is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 6

Can I use CAOS AG's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. CAOS AG's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 7

Is CAOS AG penetration tested?

Accepted Answer

CAOS AG hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 8

Is CAOS AG secure?

Accepted Answer

Security isn't a single yes/no, but CAOS AG is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 9

Does CAOS AG have a bug bounty or vulnerability disclosure program?

Accepted Answer

CAOS AG hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@zitadel.com or via a /security page (CAOS AG lists a security contact).

Question 10

Who are CAOS AG's subprocessors?

Accepted Answer

CAOS AG lists 3 subprocessors on its trust center, including Google Cloud Platform, Postmark (AC PM LLC), Twillio Inc.. Buyers use this for fourth-party risk review.

Question 11

Where does CAOS AG host or store data?

Accepted Answer

CAOS AG hosts on GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Customer uploaded data. Data residency details are on its trust center.

Question 12

Where is CAOS AG's trust center or security page?

Accepted Answer

CAOS AG's trust center is at https://trust.zitadel.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 13

Want to report a potential security issue?

Accepted Answer

At ZITADEL we are extremely grateful for security aware people who disclose vulnerabilities to us and the open source community. All reports will be investigated by our team and we will work with you closely to validate and fix vulnerabilities reported to us. https://zitadel.com/docs/legal/policies/vulnerability-disclosure-policy We also follow RFC 9116 "A File Format to Aid in Security Vulnerability Disclosure" to find the security information for our websites and services.

Question 14

Do you do regular penetration testing?

Accepted Answer

We conduct annual Penetration tests. At ZITADEL we believe that working transparently creates trust in our project and cloud service. With this mantra as one of the cornerstones of ZITADEL we actively and regularly engage with external security testers to test different scopes of our offerings. You can download the most recent reports under resources. We encourage security aware people to find and disclose vulnerabilities of our products. The process and scope can be reviewed in our vulnerability disclosure policy.

Question 15

How can I get informed about security advisories?

Accepted Answer

We have set up an automated dependency management process to manage upstream dependencies of our products. The engineering team is automatically being privately notified when security issues are found. Depending on the criticality fixes are deployed in the regular release cycle, or shipped as hot-fix, published as security advisory on Github and clients are informed. Advisories are published on our Github repository: https://github.com/zitadel/zitadel/security/advisories

Question 16

How can I get a bilaterally signed DPA?

Accepted Answer

Our DPA can be found in our legal section. The data processing agreement is part of our terms that you accept when you sign-up to our services. We don't provide a countersigned copy of the agreement by default. GDPR law requires a contract or legal act according to Art 28, 3.. We consider acceptance of our terms a sufficient legal act for this purpose.

Question 17

Do you sign a HIPAA Business Associate Agreement (BAA)?

Accepted Answer

You can find all our certifications in our trust center. At this time, ZITADEL Cloud is not HIPAA compliant. If you want to enquire about the roadmap, please book a call to discuss your options. Since we are already compliant to some of the most strict compliance frameworks, we can provide a certification in a timely manner if a significant number of clients request HIPAA compliance.

Question 18

Is there a compliance roadmap addressing upcoming regulations?

Accepted Answer

We have information security management system (ISMS) in place that is certified according to the ISO2700x standard. The goal is continuous improvement and ongoing compliance to protect confidentiality, integrity, and availability of customer's information. An integral part of the ISMS is the periodic review and adjustment according to internal and external factors, such as changing regulations that might affect our business.

Question 19

Do you provide the ISO27001 Certificate?

Accepted Answer

The ISO27001 certificate is available here and can be validated on the British Assessment Bureau's website.

Question 20

Is Zitadel compliant to BSI Cloud Computing Compliance Criteria Catalogue (C5)?

Accepted Answer

The Cloud Computing Compliance Criteria Catalogue (C5) is a "cloud computing IT-Security" standard in Germany. SecNumCloud is the equivalent label in France. Together they seek mutual recognition under the European Secure Cloud (ESCloud) label. All technical and organizational controls are in place. We can monitor compliance and provide evidence for the controls through Vanta. In case you require us to be C5 compliant, please get in touch with us for a custom enterprise agreement. We will then provide you with the relevant compliance documents.

Question 21

How do you protect against bot and DDoS attacks?

Accepted Answer

ZITADEL offers different levels of protection against bot and DDoS attacks depending on your deployment model: ZITADEL Cloud: We leverage the robust security infrastructure of Google Cloud Armor to safeguard against these threats. This includes features like: - Web Application Firewall (WAF) to filter malicious traffic. - DDoS protection to absorb and mitigate volumetric attacks. - Bot management to identify and block automated bots. Self-Hosted ZITADEL: You are responsible for the security of your infrastructure. This means: - Implementing your own DDoS mitigation solutions. - Setting up bot detection and prevention mechanisms. - Regularly updating and patching your systems. - Monitoring for suspicious activity. While ZITADEL Cloud handles these security aspects for you, a self-hosted setup provides more flexibility and control. However, it also requires you to invest in the necessary tools and expertise to ensure the protection of your ZITADEL instance.

Question 22

Do you encrypt all backups and store them in a secure location that is physically separated from the production environment?

Accepted Answer

Zitadel encrypts backup copies of information, software, and systems, as confirmed by their ISO 27001 audit report, which states that SQL databases, datastores, and user data are encrypted. We don't host our own servers or data centers but rely on backup-as-a-service from our infrastructure provider (Google Cloud Platform): "Backups are stored in a centralized location called a backup vault. A backup vault is a secured and isolated storage, managed by Backup and DR. A backup vault stores backups in a single region, as long as the selected location is compatible with your instance's location." (https://docs.cloud.google.com/sql/docs/mysql/backup-recovery/backup-options)

Question 23

What third party analytics tools are being used?

Accepted Answer

We use Google Analytics and Plausible for web analytics of our websites and services. You can manage your consent on our websites. You can learn about the analytics providers' practices by visiting https://www.google.com/policies/privacy/partners or https://plausible.io/ We collect anonymous product analytics. Sensitive information or PII is redacted on your browser before being sent to Mixpanel. You can manage your consent on our websites. You can learn about the analytics providers' practices by visiting their Privacy Policy as well as https://docs.mixpanel.com/docs/session-replay/session-replay-privacy-controls

CAOS AG

About

Compliance & infrastructure

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Technology peers that completed SOC 2

Action1

ELJUN LLC

equipifi

IntelligentSystems Corp