generated: '2026-09-05'
method: searched
probe: true
source: https://www.zayzoon.com/security
url: https://app.vanta.com/zayzoon/trust/3q6v6nbz0d1g20l1brgbhs
name: ZayZoon Trust Center
platform: Vanta
note: >-
  ZayZoon links a Vanta-hosted Trust Center from the footer of its own security page.
  The Vanta page returns HTTP 200 but renders client-side, so its document list could
  not be read anonymously; the certifications below are taken from ZayZoon's own
  first-party security page, which is server-rendered.
certifications:
- name: SOC 2 Type II
  scope: security, availability, confidentiality
  holder: ZayZoon
  status: attested
  availability: on request
  evidence: https://www.zayzoon.com/security
  quote: >-
    "ZayZoon has a SOC 2 Type II report. Our SOC 2 report attests to the controls we
    have in place governing the availability, confidentiality, and security of customer
    data as they map to Trust Service Principles (TSPs) established by the American
    Institute of Certified Public Accountants (AICPA)."
inherited_certifications:
- name: ISO 27001
  holder: cloud infrastructure providers (AWS, GCP)
  note: >-
    NOT held by ZayZoon. The security page states "ZayZoon products are hosted with
    cloud infrastructure providers with SOC 2 Type II and ISO 27001 certifications".
    Recorded separately so it is never credited to ZayZoon itself.
  evidence: https://www.zayzoon.com/security
security_practices:
- practice: in-transit encryption
  detail: TLS 1.2 or above, 2,048-bit or better keys
- practice: third-party penetration testing
  detail: performed several times a year against products and product infrastructure
- practice: vulnerability assessment
  detail: recurring static code analysis and infrastructure vulnerability scans
- practice: web application firewall, network firewalling, DDoS prevention
- practice: patch management with server-level instrumentation
- practice: defined security incident response process
regulatory:
- item: NMLS ID 2635812
  source: https://www.zayzoon.com/security
  note: Nationwide Multistate Licensing System identifier published in the site footer.
not_found:
- PCI DSS
- HIPAA
- FedRAMP
- ISO 27001 held by ZayZoon itself
- a published bug bounty program
checked: '2026-09-05'