Security & trust
Independent assurance, ready for review
Zentrik completed an independent SOC 2 Type II examination of the Zentrik Platform against the Security criteria. Review how we protect your customer evidence and product plans, or request the report for your security review.
Report access is subject to approval and may require an NDA.
Protecting your workspace
- Your data stays yours
- You retain ownership of your workspace data and the output generated from it.
- No public-model training
- Customer data is not used to train public AI models. Workspace AI features use OpenAI through its API.
- Encryption
- TLS 1.2+ protects data in transit. Postgres and object storage use provider-managed encryption at rest.
- Controlled workspace access
- Workspace membership and role-based permissions govern access. Production credentials and administrative tools follow least-privilege access.
Data location and control
Primary database and object storage are in the United States. Application hosting also runs in the European Union. Our subprocessor list identifies each provider, the data it processes, and its locations.
Export and deletion requests are completed within 30 days of a verified request, subject to the exceptions in our Terms.
Optional analytics and masked session recordings follow regional consent rules and workspace restrictions. See our Privacy Policy for data collected, recording defaults, and privacy choices.
Agreements for your review
Request a DPA for your procurement review. Where applicable, transfer terms such as the EU Standard Contractual Clauses and UK IDTA are executed as part of the DPA.
A BAA is available on Scale and Enterprise. Before processing PHI, we require an executed BAA and an approved workspace configuration. Review PHI requirements and request a BAA.
For security questionnaires, backup retention, or recovery objectives, contact security@zentrik.ai. Contractual commitments are set out in your Order Form, Terms, and executed agreements.
Technical security details
Security monitoring and response
We monitor application dependencies for known vulnerabilities and use automated checks in our build pipeline. Security issues have defined triage and ownership.
We maintain an incident response playbook and escalation process. Customers are notified of personal data breaches without undue delay, in accordance with applicable law and executed agreements.
Processing locations and infrastructure
This operational summary does not define or extend the scope of the SOC 2 report; the report defines its assessed systems and controls.
| Component | Provider | Region | Data processed |
|---|---|---|---|
| Database | Fly.io managed Postgres | sjc (US) | Primary relational data store for workspace data. |
| Hosting | Fly.io machines | mad (EU) and sjc (US) | Application runtime and service infrastructure. |
| Object storage | AWS S3 | us-east-2 (US) | Uploaded files, text extracted from them, imported source text, and generated documents. |
| Email delivery | Postmark (AC PM LLC) | United States | Delivery of account, product, and update email, with delivery and suppression event processing. |
| AI provider processing | OpenAI | United States (provider-dependent) | Prompt text and the workspace context it needs, sent through the API. |
Company legal contact
Zentrik Company
490 Post St, Ste 500, PMB 2017
San Francisco, CA 94102, USA
Legal: legal@zentrik.ai | Privacy: privacy@zentrik.ai | Security: security@zentrik.ai