Trust, Security & Privacy

Zorvetiq BuzSight AI is engineered to align with the ISO/IEC 27000 family of information-security standards. This page summarizes the controls that protect your data and how we handle personal information.

ISO/IEC 27001

Information Security Management

Role-based access control (platform owner, organization admin, member) enforced on every server route and data query.
Strict multi-tenant isolation — all business data is scoped to the signed-in user’s organization; cross-tenant access is not possible.
Tamper-evident audit logging of create, update, delete and export actions, scoped per organization.
Passwords stored only as bcrypt hashes (work factor 12); credentials are never logged or returned.

ISO/IEC 27017

Cloud Services Security

Secure baseline configuration: hardened HTTP security headers and a Content Security Policy on every response.
Encryption in transit enforced with HSTS (HTTP Strict Transport Security) across all subdomains.
File uploads are scoped to the owning user’s namespace and validated server-side to prevent cross-account access.
Payment webhooks are verified with HMAC-SHA512 signatures before any state change is applied.

ISO/IEC 27018

Protection of Personal Data in the Cloud

Data minimization: analytics never receive personally identifiable information — names, emails, phone numbers, company and organization names are stripped before any event is sent.
Analytics identifiers are derived one-way (hashed) so individuals cannot be re-identified from telemetry.
Telemetry is collected only on production domains; development and preview traffic is excluded.
Transparency: this notice describes what personal data is processed and why.

ISO/IEC 27110

Cybersecurity Framework

Identify — documented data flows, roles and this public trust posture.
Protect — access control, encryption, secure headers and least-privilege browser permissions.
Detect — audit logging and server-side monitoring of security-relevant actions.
Respond & Recover — a published coordinated vulnerability disclosure channel and managed, versioned deployments.

Report a security concern

We welcome coordinated disclosure of security issues. Email [email protected] or see our security.txt policy. Please do not publicly disclose an issue until we have had a reasonable opportunity to remediate it.

The ISO/IEC standards referenced describe the control framework this platform is designed to align with. Alignment reflects implemented technical and organizational controls and does not by itself constitute formal certification.