Encrypted at rest, encrypted in transit
Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Customer records, lead data and conversation history are protected by the same audited control set — not by a policy page.
Security & compliance
Security at Zrevick.
Audited. Encrypted. Boring by design.
Zrevick is SOC 2 compliant, with AES-256 encryption at rest, TLS 1.2+ in transit, single sign-on, multi-factor authentication and role-based access control across the workspace. By default, AI model providers are held to a no-training policy with zero data retention where supported. The full report is available to customers and prospects under NDA.
Audits and compliance
SOC 2 compliant,
with the report to prove it.
Our SOC 2 Type I report was issued on June 19, 2026 by Johanson Group LLP (License #5000094), an independent licensed CPA firm. The report covers the design and implementation of our controls against the AICPA Trust Services Criteria for security — a Type I report attests to the suitability of control design as of a specified date. The Type II observation period is now underway, and ISO 27001 and HIPAA are expected in Q4 2026.
AchievedSOC 2 Type I
Issued June 19, 2026 by Johanson Group LLP (License #5000094) against the AICPA Trust Services Criteria for security.
In progressSOC 2 Type II
The observation period is underway, moving from control design to tested operating effectiveness over time.
AchievedCSA STAR Level 1
Registry listing of our cloud security controls through the Cloud Security Alliance.
AlignedGDPR
European data protection requirements are reflected in how we process and protect customer data.
AlignedCCPA
California consumer privacy requirements are reflected in how we handle personal information.
In forceCyber insurance
Active cyber liability coverage supporting our incident response commitments.
Planned Q4 2026ISO 27001
Certification against the international standard for information security management systems.
Planned Q4 2026HIPAA
Safeguards for handling protected health information for teams that need it.
The full report is available to customers and prospects under NDA — request it from your account team or email platform@zrevick.com. For background on what the criteria cover, see the AICPA SOC for service organizations overview.
Core controls
Your data, protected end to end.
Logs that do not expose anyone
Logs are scrubbed of personally identifiable information automatically rather than by manual review, so support and debugging work does not require reading your customer data.
Least privilege, revocable keys
Accounts support single sign-on, multi-factor authentication and role-based access control. Sessions run on JWT-based authentication, API keys are scoped and revocable, and administrative actions are recorded in audit logs.
Zrevick holds your lead records, outreach history, customer conversations and agent activity in one system, so these controls are designed for the whole platform rather than one app. They are the same controls the SOC 2 report attests to.
AI-specific safeguards
Your prompts are not training data.
Zrevick runs your agents, outreach and content generation through third-party AI model providers, so the terms with those providers matter as much as our own controls. A no-training policy applies by default across our model providers: what you write and what we process for you is never used to train anyone's models.
Where a provider supports it, we use zero-data-retention configurations — prompts and completions are not retained after the request completes. Your work is processed, returned to your workspace and gone from the model provider.
How agents and MCP work in ZrevickSubprocessors
Model providers process prompts and completions under the terms above. Infrastructure providers host the workspace itself.
- AI model providers
LLM inference for agents and generation, routed across multiple providers under no-training and zero-data-retention terms.
- OpenRouter
Routing layer that directs LLM requests to the model provider for each task.
- DigitalOcean
Cloud infrastructure running the Zrevick platform.
Responsible disclosure
Found something?
Tell us first.
If you have found a vulnerability in Zrevick, send it to the team that can act on it. Include the affected feature, the steps to reproduce and any proof of concept — a specific report gets a faster response than a general one.
We practice coordinated disclosure: report to us first and we will agree on timing together before anything is published.
platform@zrevick.com ↗Please do not test against other customers' accounts or data. Reports about your own workspace are all we need.
What happens after you report
- 01Acknowledged within 48 hours
You get a human confirmation within 48 hours or two business days — not an auto-reply.
- 02Progress updates as we work
We keep you informed while we reproduce, assess and fix the issue.
- 03Notice when the fix ships
You hear from us when a fix is live, before the issue is described publicly.
- 04Credit where it is due
Researchers who want public recognition are credited in our security hall of fame.
Questions founders ask
Before you start.
Is Zrevick SOC 2 compliant?
Yes. Our SOC 2 Type I report was issued on June 19, 2026 by Johanson Group LLP (License #5000094), an independent licensed CPA firm, and covers the design and implementation of our controls against the AICPA Trust Services Criteria for security. The SOC 2 Type II observation period is underway.
Can we get a copy of the SOC 2 report?
Yes. The full report is available to customers and prospects under NDA. Request it from your account team or email platform@zrevick.com.
Does Zrevick train AI models on our data?
No. A no-training policy applies by default across our model providers, and zero-data-retention configurations are used where the provider supports them, so prompts and completions are not retained after the request completes.
How is our data encrypted?
Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Logs are also scrubbed of personally identifiable information automatically, so support work does not require reading customer data.
How do we report a security vulnerability?
Email platform@zrevick.com with the affected feature, reproduction steps and any proof of concept. We acknowledge reports within 48 hours, provide progress updates, notify you when a fix ships and credit researchers who want public recognition.
Which certifications are coming next?
ISO 27001 and HIPAA are expected in Q4 2026, alongside the completion of the SOC 2 Type II observation period. CSA STAR Level 1, GDPR and CCPA alignment and cyber insurance are already in place.