# Zephior Trust Center

Security assurance, privacy resources and controlled access to Zephior compliance documents.

Reviewed: 2026-08-30

## Independent assurance

Zephior completed a SOC 2 Type II examination covering the ai enterprise rfp management platform described in the report for 31 October 2024 to 31 January 2025. Issued 17 October 2025 by Prescient Assurance LLC. Criteria: Security, Confidentiality, Availability. Unmodified opinion for the examination period.

The examination covers the described system and historical period. It does not attest to every current product, deployment or control.

## Frameworks

- ISO/IEC 27001: Certification preparation. Information security management.
- ISO/IEC 42001: Programme preparation. AI management systems.

These programme statements are not ISO certification claims.

## Control areas

These are control areas addressed in the SOC 2 examination, not a live control-status feed. The report contains the scope, testing and qualifications.

- Security governance: Security responsibilities, documented policies and oversight.
- Risk management: Identification, assessment and treatment of security risks.
- Identity and access: Authorized access, least privilege and access lifecycle reviews.
- Data protection: Protection of sensitive information in storage and transmission.
- Secure development: Development practices and review of production changes.
- Vulnerability management: Vulnerability assessment, prioritization and remediation processes.
- Security monitoring: Logging and monitoring of security-relevant events.
- Incident preparedness: Response responsibilities, procedures and exercises.
- Continuity and recovery: Continuity planning, backups and recovery controls.
- Information lifecycle: Data classification, confidentiality, retention and disposal policies.
- Personnel security: Security awareness, confidentiality obligations and personnel lifecycle controls.
- Third-party risk: Vendor review and contractual security obligations.
- Asset management: Asset inventory, configuration and system-hardening processes.

## Documents

- SOC 2 Type II report: Restricted. Request at https://trust.zephior.com/#documents
- Privacy notice: Public (https://zephior.com/privacy)
- Data processing agreement: Public (https://zephior.com/dpa)
- Terms of service: Public (https://zephior.com/terms)

Restricted reports require a verified email address, an eligible business purpose and individual approval. Access is time-limited and may be revoked. Documents must not be redistributed.

Public JSON: https://trust.zephior.com/api/v1/trust