ZynoviqHow you can check our work.
Every claim on this site has a page that explains how it holds. This is the index of those pages, together with our security position stated plainly: what we hold, where, who can see it, and what we have not yet certified.
The pages behind the claims
Four lines we hold to
- Human answers. AI never sets, changes or certifies professional ground truth. People write, solve, review and certify every answer. Our software routes work and runs fixed, rule-based checks (formats, completeness, duplicates). Marking of your AI is rule-based and human today; AI-assisted marking of free text is planned, opt-in and always checked by people. The AI boundary.
- "Independent" means one thing. Expected answers are set by qualified professionals independently of the vendor of the AI being tested. We publish independently reviewed benchmarks; we do not offer independent evaluation, audit or assurance.
- Findings, not certificates. Our reports are evidence of testing. They are not a certification, approval or assurance of your AI. Evidence.
- Not security testing. Our red team uses professional adversarial scenarios. For security testing of your infrastructure, use a qualified security firm. AI red team.
Security at a glance
| Topic | Our position |
|---|---|
| Customer data needed for a standard test | None; synthetic cases only |
| Access to customer systems | Sandbox or test only; scoped, time-bound, revocable |
| Where data is stored | Indian cloud region; backups in a second Indian region |
| Encryption | In transit and at rest; answer keys double-encrypted in a separate vault |
| Who can access answer keys | Only our marking service; staff access by logged, approved exception |
| Reviewer vetting | Identity and professional register checks; signed confidentiality and conflict agreements |
| AI in our process | AI never sets, changes or certifies ground truth; software only routes work and runs fixed, rule-based checks; marking is rule-based and human today (AI-assisted marking of free text planned, opt-in, always checked by people); this business owns no GPUs |
| Separation from Zynoviq Enterprise AI | Separate delivery teams; we never test, grade or produce data for the division's products; how we stay separate |
| Certifications | No SOC 2 or ISO 27001 yet; ISO 27001 targeted by December 2027 |
| Penetration testing | External test planned before the first enterprise contract (Q1 2027), then yearly |
| Personal data law | Handled under India's DPDP Act; privacy notice |
Security in more detail
- Isolation: the answer vault is in a separate cloud account with no public access.
- Least privilege: each role sees only what it needs; customers see only their own runs.
- Logging: logins, vault reads, exports and downloads are logged and kept for 3 years.
- Secure development: code review, dependency scanning, no secrets in code, separate environments.
- Backups: daily, encrypted, with regular restore tests.
Documents available on request
Security overview, data flow description, standard questionnaire responses, sample licence and data processing agreement, penetration test summary (once the first test is complete). Request our security pack.
Report a security issue
Email support@zynoviq.com with the subject "Security". We acknowledge within two working days and will keep you informed. Please do not test against live customer engagements.
Trust: questions people ask
Is a Zynoviq report a certification of our AI?+
No. Our ground truth is set by qualified professionals independently of the vendor of the AI being tested, and our reports show what the AI got right and wrong, and why. They are findings and evidence, not a certification, audit, approval or assurance of any AI system. What we do not do.
How do you stop benchmark answers leaking into training data?+
Training data and benchmarks come from the same production system but never from the same items. Separate pools, separate access rights, duplicate detection across pools and an isolated answer-key store keep them apart. Training and test separation.
Do you test products made by Zynoviq's Enterprise AI division?+
No. We never test, grade or produce data for the division's products, for any customer, and our delivery teams are separate. How we stay separate.
How do I report a security vulnerability?+
Email support@zynoviq.com with the subject "Security". We acknowledge within two working days. Please do not test against live customer engagements.