Security at ZemKit

Security is a first-class engineering concern at ZemKit — not a policy document. We build the platform with defense in depth, use vetted infrastructure, and give you the controls to enforce your own policies on top of ours.

ZemKit runs on top-tier cloud infrastructure with data centers that hold SOC 2, ISO 27001, and PCI DSS certifications. We deploy across multiple availability zones for resilience.

Production environments are isolated from development and staging. Access to production is restricted, logged, and requires multi-factor authentication.

In transit. All connections to ZemKit — web, API, widget, voice, phone signaling — use TLS 1.2 or higher with strong cipher suites. HSTS is enforced.

At rest. Customer content — knowledge bases, conversations, recordings — is encrypted at rest using AES-256. Encryption keys are managed by our cloud provider's key management service.

Secrets. Credentials and API keys for your integrations are stored encrypted with per-tenant keys and are never exposed to our staff in plaintext.

Least privilege internally. ZemKit employees only get the access they need to do their jobs. Production data access is granted per-incident, time-boxed, and audited.

Role-based access for you. Owner, admin, and member roles are available on Growth. Partner plans add custom roles, SSO/SAML, and per-customer permission scoping.

Multi-tenant isolation. Every account is logically isolated. Queries are scoped to the tenant on every read and write — a customer can never see another customer's data.

We monitor the platform 24/7 for availability, performance, and security events. Audit logs capture administrative actions and are retained for at least one year.

If a security incident occurs, we investigate immediately, contain the impact, and notify affected customers within 72 hours — sooner if the situation warrants. You can subscribe to status.zemkit.com for real-time updates.

All code changes go through peer review. Dependencies are scanned continuously for known vulnerabilities. Static analysis and secret-detection run in CI on every commit.

We conduct third-party penetration tests annually and remediate findings on defined SLAs based on severity.

• SOC 2 Type II — audit in progress. Report available under NDA to enterprise prospects and customers.
• GDPR & UK GDPR — we act as a data processor for our customers and offer a Data Processing Agreement (DPA) on request.
• HIPAA — available for enterprise healthcare customers under a Business Associate Agreement (BAA). Standard plans are not HIPAA-eligible.
• Regional data residency — US and EU regions available today. Additional regions available on Partner plans.

• Retention policies per agent and per channel
• Whether call recording is enabled
• PII redaction rules in transcripts
• Team roles, SSO, and API-key scopes
• Which integrations your agent can use
• Data export at any time — full account or per agent

If you believe you've found a security vulnerability in ZemKit, please report it to security@zemkit.com. We'll acknowledge within one business day and work with you on a fix.

We don't take legal action against researchers who act in good faith, respect user privacy, and give us reasonable time to remediate before public disclosure.