Enterprise-grade security.

Certifications and standards

Zynoviq holds no security certifications, and none are in progress. We state that plainly rather than implying otherwise — and we would suggest treating any supplier who implies otherwise as a risk in itself. What follows is what is actually true of the architecture.

SOC 2 Type II and ISO 27001

Not held, and not currently being pursued. A certification demonstrates that an organisation manages the risks created by the data it holds. Zynoviq’s software deploys inside your own infrastructure — including air-gapped — and your data is never transmitted to us or to any third party. The risk a certificate is designed to govern is largely absent from the deployment rather than controlled within it.

That is not a substitute for a certificate and we do not present it as one. If your procurement process requires a specific certification regardless, tell us early and we will say plainly that we cannot meet it — rather than after you have spent weeks on a review.

GDPR

Full compliance with the EU General Data Protection Regulation. Data Processing Agreements and Standard Contractual Clauses available for all customers.

HIPAA

Technical safeguards, administrative controls, and Business Associate Agreements (BAAs) for healthcare customers handling protected health information.

PCI-DSS

Payment Card Industry Data Security Standard compliance for customers in the financial services sector handling payment card data.

DPDPA 2023

Full compliance with India's Digital Personal Data Protection Act, 2023. Data fiduciary obligations, consent management, and data principal rights built in.

SOX 404

Sarbanes-Oxley Section 404 compliance capabilities with automated internal controls, audit trail generation, and financial reporting integrity checks.

Defense in depth

Multiple layers of security controls protect your data at every level of the stack, from network infrastructure to application logic.

Encryption at Rest and in Transit

All data is encrypted using AES-256 at rest and TLS 1.3 in transit. Customer-managed encryption keys (CMEK) supported for enterprise deployments. Perfect forward secrecy enabled on all connections.

Role-Based Access Control and SSO

Granular RBAC with attribute-based policies and least-privilege enforcement. Single sign-on via SAML 2.0 and OIDC with Okta, Azure AD, Google Workspace, and all major identity providers.

Audit Logging and Real-Time Monitoring

Every user action, API call, and configuration change is logged with tamper-proof audit trails. SOX 404 compliant audit capabilities with real-time alerting and anomaly detection.

Penetration Testing

Quarterly penetration testing by independent, CREST-certified security firms. Full-scope assessments including application, network, and infrastructure layers. Remediation tracked to completion.

Vulnerability Management

Continuous CVE scanning across all dependencies and infrastructure. Critical vulnerabilities patched within 24 hours. Automated dependency auditing integrated into CI/CD pipelines.

Incident Response

24/7 dedicated security operations team. P1 security incidents acknowledged within 15 minutes and response initiated within 1 hour. Detailed post-incident reports provided to affected customers.

Bug bounty program

We welcome responsible security researchers to help us identify vulnerabilities across our platform and services. Our bug bounty program offers rewards based on severity, with payouts up to $10,000 for critical findings. All reports are triaged within 24 hours and we work with researchers to verify, remediate, and publicly credit discoveries.

To report a vulnerability, please email security@zynoviq.com with a detailed description, steps to reproduce, and potential impact assessment. Please do not disclose vulnerabilities publicly until we have had a reasonable opportunity to investigate and remediate.

Compliance automation built in

ProfitGuard includes built-in compliance automation that reduces audit preparation time by up to 60% while improving accuracy and coverage. Automate the controls that matter most to your organization.

SOX 404 Automation

Automated internal control testing, evidence collection, and deficiency tracking. Generate audit-ready reports that map directly to PCAOB standards.

HIPAA Safeguards

Automated access reviews, encryption verification, and audit trail generation for protected health information. BAAs executed within 24 hours.

Continuous Monitoring

Real-time control monitoring replaces periodic sampling. Deviations are flagged immediately with automated remediation workflows.

Audit Trail Generation

Tamper-proof, immutable audit logs with cryptographic verification. Export in standard formats for external auditor review.

Learn more about our compliance capabilities on our Compliance page.