Compliance
Where Nozero stands on each framework, in plain words. Each statement describes how the service works today.
| Framework | Status | What it means |
|---|---|---|
| SOC 2 | Ready | Our controls are designed to the AICPA Trust Services Criteria for security, availability and confidentiality. An independent SOC 2 examination has not yet been completed; when it has, the report will be available here under NDA. |
| ISO/IEC 27002:2022 | Aligned | Our controls follow ISO/IEC 27002 guidance. ISO/IEC 27002 is a code of practice and is not itself certified. |
| GDPR and UK GDPR | Processor terms in place | We process your personal data as a processor under our data processing addendum, with the EU Standard Contractual Clauses and the UK Addendum where transfers occur. |
| CCPA / CPRA | Service provider | We do not sell or share personal information and use it only to provide the service. |
| DPDP Act, 2023 (India) | In place | We process personal data of Indian data principals under the Act, with a grievance contact and breach notification. |
How our controls map to ISO/IEC 27002
| Theme | Controls in Nozero |
|---|---|
| Organisational | Information security and privacy policies, supplier management through sub-processor agreements, incident management, and documented data processing. |
| People | Confidentiality obligations for everyone with access, and least privilege through staff roles. |
| Technological | Encryption and key management, access control and two-factor authentication, logging and monitoring, backup and restore testing, secure configuration, and change management with rollback. |
Your own compliance
Nozero gives you evidence for your audits: restore test records with file hashes, an append-only audit log, restore and download audits with optional four-eyes approval, and exports of each. For questionnaires or a countersigned DPA, email connect@activejoules.com.