Security & Privacy

We operate a comprehensive Information Security Management System (ISMS) aligned to ISO/IEC 27001:2022 and the SOC 2 Trust Service Criteria. All infrastructure uses AES-256 or higher encryption for data at rest, backed by FIPS 140-3 compliant key management with hardware security modules (HSMs). Databases and backups use rotating keys, and TLS 1.3 protects all data in transit.

Network segmentation isolates systems into discrete zones, complemented by next-generation firewalls and intrusion detection and prevention systems (IDS/IPS). All API calls and user sessions traverse authenticated, encrypted channels. Administrative access requires multi-factor authentication in line with NIST SP 800-63B recommendations. Regular penetration tests and code reviews enforce application security, and continuous monitoring raises alerts on anomalous login or access patterns.

ZazimFind is engineered from the ground up around zero knowledge. The service performs its function without ever learning what you are searching for or who you are. Our AI product lifecycle incorporates privacy by design, in line with GDPR Article 25. Data minimisation is not a policy — it is architecture. No personal information is transmitted to or stored by our servers.

Any technical data that briefly passes through our systems, such as request routing metadata, is immediately discarded and never persisted. Data Protection Impact Assessments (DPIAs) are conducted before any new model or dataset is deployed, mapping data flows and obligations. User accounts carry minimal permissions by default, and consent or lawful basis is documented for every processing activity.

We apply purpose limitation and storage limitation strictly. Log data is retained for one year for security auditing only. All user-identifiable content is either never collected or deleted on session close.

Our Computer Security Incident Response Team (CSIRT) operates a structured playbook covering detection through to post-incident review. In line with GDPR Article 33, we commit to notifying the applicable supervisory authority within 72 hours of a qualifying breach. US state laws, including those in California, similarly require timely consumer notification. We treat those deadlines as a floor, not a ceiling.

Our policies map to international standards and legal frameworks. A dedicated Data Protection Officer ensures alignment with GDPR, UK DPA 2018, CCPA/CPRA, and emerging AI regulations. For EU/UK cross-border transfers we rely on Standard Contractual Clauses (SCCs) or adequacy decisions, ensuring GDPR Articles 44–46 are satisfied.