Can I use CAOS AG's SOC 2 for a vendor risk assessment?

Yes. CAOS AG's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Is CAOS AG penetration tested?

CAOS AG hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but CAOS AG is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Does CAOS AG have a bug bounty or vulnerability disclosure program?

CAOS AG hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@zitadel.com or via a /security page (CAOS AG lists a security contact).

Who are CAOS AG's subprocessors?

CAOS AG lists 3 subprocessors on its trust center, including Google Cloud Platform, Postmark (AC PM LLC), Twillio Inc.. Buyers use this for fourth-party risk review.

Where is CAOS AG's trust center or security page?

CAOS AG's trust center is at https://trust.zitadel.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Is this your company? Buyers are checking CAOS AG here. Claim zitadel.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.

Claim free

CAOS AG

zitadel.com · United States · Security contact

Security overview Compliance Penetration test

Trust level

Listed

Unverified

Listed

Domain

Report

Live

Sourced from public information. Not yet verified by the company.

CAOS AG is SOC 2 Type II compliant. CAOS AG also holds ISO 27001, GDPR, and CCPA.

Request report access Claim this profile

Framework

Auditor

Last report

Renewal

View official trust center ↗

About

Welcome to ZITADEL's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. For security reports, please consult our [security.txt](https://zitadel.com/.well-known/security.txt) how to get in touch and report vulnerabilities. Useful resources: * [Data Processing Agreement](https://zitadel.com/docs/legal/data-processing-agreement) * [Legal Center](https://zitadel.com/legal) * [legal@zitadel.com](mailto:legal@zitadel.com) for legal and complian

Compliance & infrastructure

ISO 27001 SOC 2 Type II GDPRCCPA

Hosting

GCP

Data handled

Customer personally identifiable informationEmployee personally identifiable informationCustomer uploaded data

Subprocessors

G
Google Cloud Platform · [Zitadel Cloud] Cloud provider
Designated by customer
P
Postmark (AC PM LLC) · [Zitadel Cloud] Transactional emails (Optional)
USA
T
Twillio Inc. · [Zitadel Cloud] Communication (Optional)
USA

Compliance leadership

The person who leads CAOS AG's SOC 2 isn't listed yet. Claim this profile to add it.

Penetration test

Unknown. CAOS AG's penetration test vendor isn't listed yet.

Claim this profile to add it.

Recent updates

Updated Privacy Policy and Sub-ProcessorsOct 2025

Privacy Policy We've updated the Zitadel's Privacy Policy to align with the Data Privacy Framework (DPF) principles, a change approved by the U.S. Department of Commerce. This update ensures stronger privacy protections for data transfers from the EU/EEA, UK, and Switzerland to the U.S. and is now reflected in our policy. Zitadel has completed the necessary self-certification and is registered for an independent recourse mechanism (JAMS) to resolve complaints. Key changes: * Zitadel complies with the EU-U.S. DPF and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union, European Economic Area, and Switzerland to the United States. The policy now details our commitment to effective recourse, enforcement, and liability under the DPF. We utilize JAMS (Judicial Arbitration and Mediation Services) as our independent recourse mechanism (IDR) and detail the conditions for binding arbitration as a means of dispute resolution. * Zitadel's HQ address has been updated. * We've removed explicit listings of analytics providers. The policy now links to our sub-processor list. Sub-Processors * Removed Posthog, Inc. * Added Mixpanel for Data Analytics

This listing is partial

6/11 details · 55%

SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.

Auditorraises trust
Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
Report dateraises trust
Add your most recent report period so buyers see how current your SOC 2 is.
Renewal date
Add your renewal window so buyers know your coverage is active.
Documents
List the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
Security controls
Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.

Claim free to control your listing

Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.

Frequently asked

Is CAOS AG SOC 2 compliant?

CAOS AG is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Is CAOS AG ISO 27001 certified?

According to CAOS AG's public trust center, CAOS AG is ISO 27001 certified. On SOC2C this listing is Listed.

Is CAOS AG GDPR compliant?

According to CAOS AG's public trust center, CAOS AG is GDPR compliant. On SOC2C this listing is Listed.

Is CAOS AG CCPA compliant?

According to CAOS AG's public trust center, CAOS AG is CCPA compliant. On SOC2C this listing is Listed.

Is CAOS AG SOC 2 Type I or Type II?

CAOS AG is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Show 7 more questions

Answers published by CAOS AG

Reproduced from CAOS AG's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗

Want to report a potential security issue?

At ZITADEL we are extremely grateful for security aware people who disclose vulnerabilities to us and the open source community. All reports will be investigated by our team and we will work with you closely to validate and fix vulnerabilities reported to us. https://zitadel.com/docs/legal/policies/vulnerability-disclosure-policy We also follow RFC 9116 "A File Format to Aid in Security Vulnerability Disclosure" to find the security information for our websites and services.

Do you do regular penetration testing?

We conduct annual Penetration tests. At ZITADEL we believe that working transparently creates trust in our project and cloud service. With this mantra as one of the cornerstones of ZITADEL we actively and regularly engage with external security testers to test different scopes of our offerings. You can download the most recent reports under resources. We encourage security aware people to find and disclose vulnerabilities of our products. The process and scope can be reviewed in our vulnerability disclosure policy.

How can I get informed about security advisories?

We have set up an automated dependency management process to manage upstream dependencies of our products. The engineering team is automatically being privately notified when security issues are found. Depending on the criticality fixes are deployed in the regular release cycle, or shipped as hot-fix, published as security advisory on Github and clients are informed. Advisories are published on our Github repository: https://github.com/zitadel/zitadel/security/advisories

How can I get a bilaterally signed DPA?

Our DPA can be found in our legal section. The data processing agreement is part of our terms that you accept when you sign-up to our services. We don't provide a countersigned copy of the agreement by default. GDPR law requires a contract or legal act according to Art 28, 3.. We consider acceptance of our terms a sufficient legal act for this purpose.

Do you sign a HIPAA Business Associate Agreement (BAA)?

You can find all our certifications in our trust center. At this time, ZITADEL Cloud is not HIPAA compliant. If you want to enquire about the roadmap, please book a call to discuss your options. Since we are already compliant to some of the most strict compliance frameworks, we can provide a certification in a timely manner if a significant number of clients request HIPAA compliance.

Is there a compliance roadmap addressing upcoming regulations?

We have information security management system (ISMS) in place that is certified according to the ISO2700x standard. The goal is continuous improvement and ongoing compliance to protect confidentiality, integrity, and availability of customer's information. An integral part of the ISMS is the periodic review and adjustment according to internal and external factors, such as changing regulations that might affect our business.

Do you provide the ISO27001 Certificate?

The ISO27001 certificate is available here and can be validated on the British Assessment Bureau's website.

Is Zitadel compliant to BSI Cloud Computing Compliance Criteria Catalogue (C5)?

The Cloud Computing Compliance Criteria Catalogue (C5) is a "cloud computing IT-Security" standard in Germany. SecNumCloud is the equivalent label in France. Together they seek mutual recognition under the European Secure Cloud (ESCloud) label. All technical and organizational controls are in place. We can monitor compliance and provide evidence for the controls through Vanta. In case you require us to be C5 compliant, please get in touch with us for a custom enterprise agreement. We will then provide you with the relevant compliance documents.

How do you protect against bot and DDoS attacks?

ZITADEL offers different levels of protection against bot and DDoS attacks depending on your deployment model: ZITADEL Cloud: We leverage the robust security infrastructure of Google Cloud Armor to safeguard against these threats. This includes features like: - Web Application Firewall (WAF) to filter malicious traffic. - DDoS protection to absorb and mitigate volumetric attacks. - Bot management to identify and block automated bots. Self-Hosted ZITADEL: You are responsible for the security of your infrastructure. This means: - Implementing your own DDoS mitigation solutions. - Setting up bot detection and prevention mechanisms. - Regularly updating and patching your systems. - Monitoring for suspicious activity. While ZITADEL Cloud handles these security aspects for you, a self-hosted setup provides more flexibility and control. However, it also requires you to invest in the necessary tools and expertise to ensure the protection of your ZITADEL instance.

Do you encrypt all backups and store them in a secure location that is physically separated from the production environment?

Zitadel encrypts backup copies of information, software, and systems, as confirmed by their ISO 27001 audit report, which states that SQL databases, datastores, and user data are encrypted. We don't host our own servers or data centers but rely on backup-as-a-service from our infrastructure provider (Google Cloud Platform): "Backups are stored in a centralized location called a backup vault. A backup vault is a secured and isolated storage, managed by Backup and DR. A backup vault stores backups in a single region, as long as the selected location is compatible with your instance's location." (https://docs.cloud.google.com/sql/docs/mysql/backup-recovery/backup-options)

What third party analytics tools are being used?

We use Google Analytics and Plausible for web analytics of our websites and services. You can manage your consent on our websites. You can learn about the analytics providers' practices by visiting https://www.google.com/policies/privacy/partners or https://plausible.io/ We collect anonymous product analytics. Sensitive information or PII is redacted on your browser before being sent to Mixpanel. You can manage your consent on our websites. You can learn about the analytics providers' practices by visiting their Privacy Policy as well as https://docs.mixpanel.com/docs/session-replay/session-replay-privacy-controls

Show 6 more questions

Technology peers that completed SOC 2

Compare vs Action1 Compare vs ELJUN LLC Compare vs equipifi