SOC 2Global
Built to meet SOC 2
Access controls, change management, logging and evidence collection mapped to the Trust Services Criteria.
- Change management in CI/CD
- Access reviews
- Audit-ready evidence
Security & compliance
How we build secure systems
Security, privacy and AI governance are engineered into every system we build, from the first threat model to the day it goes live. Your data stays in your cloud. Your code stays in your repos.
Secure by design
Threat modelling and security reviews before a line of code.
Your cloud accounts
Deployed into tenancies you own and control.
Compliance-ready
Controls and evidence mapped to your frameworks.
You own the IP
Code in your repositories from the first commit.
Secure SDLC
Security built into every sprint
Our secure software development lifecycle runs from design to production. Controls are automated in CI wherever possible, so they happen every time, not just before an audit.
- 01Design
Threat modelling
STRIDE-based threat models and data-flow diagrams for every system, reviewed with your security team before we write code.
Threat modelData classificationArchitecture review - 02Build
Secure coding & review
Two-person code review on every change, secure coding standards, secrets kept in vaults and branch protection in your repos.
Peer reviewSecrets scanningSigned commits - 03Test
Automated security testing
SAST, DAST, dependency and container scanning plus infrastructure-as-code checks run in CI on every pull request.
SASTDASTSCA & SBOMIaC scanning - 04Release
Pen testing before launch
Independent penetration testing before every major release, with findings remediated and retested before go-live.
Pen testRemediationGo-live sign-off - 05Run
Monitor & respond
Centralised logging, alerting, patch management and an agreed incident response runbook for every system we operate.
SIEM alertsPatching SLAsIR runbook
PR #482 · security checksCI
Static analysis (SAST)0 high
Dependency scan (SCA)2 low · patched
Secrets scanClean
IaC policy checks38 / 38
Dynamic scan (DAST)Running
Required reviewers 2 approved
Nothing ships without passing
Security gates are enforced in the pipeline, not in a checklist. A failing scan blocks the merge, and every exception is recorded with an owner and an expiry date.
- of changes peer reviewed
100%
of changes peer reviewed
- scanned for code, deps & secrets
Every PR
scanned for code, deps & secrets
- independent pen test
Pre-launch
independent pen test
- generated for every build
SBOM
generated for every build
Compliance-ready builds
We build systems that meet your frameworks
We design controls in from the start and hand over the documentation and evidence your auditors expect, so certification is a formality, not a rebuild.
ISO 27001Global
Built to meet ISO 27001
Systems designed to slot into your ISMS, with controls mapped to Annex A and documented for your auditors.
- Annex A control mapping
- Asset & risk registers
- Documented procedures
HIPAAUnited States
Built to meet HIPAA
PHI isolation, encryption, access logging and BAA-eligible cloud services for healthcare workloads.
- PHI segregation
- Access logging
- BAA-eligible services
GDPREuropean Union
Built to meet GDPR
Privacy by design: data minimisation, residency, retention policies and data-subject request tooling.
- EU data residency
- DSAR workflows
- Retention & deletion
PCI DSSGlobal
Built to meet PCI DSS
Reduced cardholder-data scope through tokenisation, network segmentation and hardened payment flows.
- Tokenisation
- Scope reduction
- Segmented networks
EU AI ActEuropean Union
Built to meet EU AI Act
Risk classification, technical documentation, human oversight and logging for AI systems in scope.
- Risk tiering
- Model documentation
- Human oversight
Certification is awarded to your organisation and its systems by independent auditors. We engineer the controls, produce the evidence and support you through the audit.
Data handling
Your data never leaves your control
We build and run systems inside your own cloud accounts, with access that's minimal, time-bound and logged, and encryption everywhere.
Data residency
your cloud account
Deployed in your own cloud, in your regions
Systems run in AWS, Azure or Google Cloud tenancies you own. We routinely build for data-residency requirements across four regions.
US
United States
us-east · us-west
EU
European Union
Frankfurt · Dublin · Amsterdam
IN
India
Mumbai · Pune
AU
Australia
Sydney · Melbourne
Least-privilege access
Engineers access systems through your identity provider with MFA. Production access is role-scoped, time-bound and logged.
AES-256
Encryption at rest
TLS 1.3
Encryption in transit
Customer-managed keys
Keys live in your KMS or Key Vault. Revoke them and the data is unreadable, including to us.
Minimisation & retention
We collect only what the system needs, mask PII in non-production environments and enforce retention policies automatically.
Responsible AI
AI you can explain to your board and your regulator
Every AI system we build is governed from the start: grounded in your data, measured with evals, overseen by people and fully auditable.
No training on your data
Model providers are configured with no-training and zero-retention settings wherever available. Your data is never used to train anyone's model.
Evaluated before and after launch
Eval suites measure accuracy, safety and bias on every change, and production monitoring catches drift.
Human in the loop
High-impact actions route to a person for approval. Confidence thresholds decide what's automated and what isn't.
Full audit trails
Every prompt, retrieval, tool call and decision is logged and explainable, ready for your risk team or regulator.
Agent audit trailclaims-triage · v3.2
09:41:02Claim #88213 classified · motor, low severityauto
09:41:03Retrieved policy wording §4.2 (2 sources cited)trace
09:41:05Payout above threshold → routed to handlerreview
09:44:17Approved by J. Moreau · reason recordedhuman
98.1%
Eval accuracy
0
Policy violations
100%
Actions logged
Model: routed per task · no-training modeEU region
IP & confidentiality
Your code, your IP, your secrets
- NDAs before discoveryWe'll sign your NDA before the first detailed conversation.
- Code in your repositoriesEverything lives in your GitHub, GitLab or Azure DevOps from day one.
- IP assigned to youYou own the code, designs, models and documentation we produce.
- Vetted, named engineersBackground-checked team members, bound by confidentiality agreements.
Responsible disclosure
security@zovralabs.comFound a vulnerability? Tell us.
If you believe you've found a security issue in a Zovra Labs website or a system we operate, please report it privately. We acknowledge reports within two business days, keep you updated while we fix it, and credit researchers who want recognition.
- Include steps to reproduce and the potential impact
- Give us reasonable time to fix before public disclosure
- Don't access, modify or delete data that isn't yours
FAQ
Security questions, answered
The questions CISOs, risk teams and procurement ask us most. Something else? We're happy to walk through it.
Our job is to build systems that meet the frameworks your organisation is certified against, and to produce the evidence your auditors need. We'll share our own security policies, controls and insurance details as part of due diligence. Ask for our security overview.
Request our security overview
Architecture patterns, SDLC controls, data-handling practices and sample evidence packs, ready for your security and procurement teams.