SOC 2 Type II
Audit underway
Last updated
ZygenTrust is built to be audited. Our compliance program is structured around SOC 2 Type II, GDPR-aligned data handling, and standard contractual clauses for international transfer. The badges below represent the live state of our compliance work; status updates ship in our changelog whenever a milestone moves.
SOC 2 Type II
Audit underway
GDPR aligned
EU data handling
DPA
On request
Annual pen-test
Independent review
Detailed architecture, encryption, and access control documentation lives on our Security page. The summary:
ZygenTrust processes only the domain name you submit and the public web data that domain resolves to. We do not collect or store the personal data of end-users of the websites we analyze.
Customer-side data (your account, your API keys, your usage logs) is governed by our Privacy Policy. Customers acting as data controllers can request our Data Processing Addendum.
Our incident process is documented internally and follows a four-stage flow: detect, contain, eradicate, communicate. Material customer-impacting incidents are disclosed in the changelog with a post-mortem within 7 calendar days.
For active service issues, see our status page.
The current list of subprocessors and their data-handling roles is maintained in this section and updated whenever a new subprocessor is added. Customers will receive at least 30 days' notice via the changelog before a new subprocessor begins processing their data.
The subprocessor list will be published with provider names once the compliance review is complete. Customers under DPA may request the current list at any time.
Found a vulnerability? Email us at
security@zygentrust.com.
We aim to acknowledge within 24 hours and triage within 3 business days. We do
not currently run a paid bounty program; recognition is offered for
responsibly disclosed issues.