| Standard | Status | Detail |
|---|---|---|
| SOC 2 Type II | Report issued | SOC 2 Type II report covering all five Trust Services Categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Period covered: 26 September 2024 to 25 September 2025. The next report is in progress. |
| ISO/IEC 27001:2022 | Certified | Certified to ISO/IEC 27001:2022 (certificate 305025111319IS, valid until 12 November 2028). |
| HIPAA | Compliant | Zime does not collect, process, store or transmit protected health information, as stated in an independent HIPAA assessment (October 2025). |
| GDPR | Compliant | Independent assessment completed in December 2025. The DPA includes the EU Standard Contractual Clauses. |
| Penetration testing | Tested yearly | Latest independent test: August 2026. Every critical, high and medium finding was fixed and verified on retest. Grade A+. |
What we share, and how
On this hub: security practices, privacy terms, AI data use, the sub-processor list and integration permissions.
Under NDA: the SOC 2 Type II report, the penetration test summary and certificate, and Zime's security policies. Request the reports through the trust center (trust.zime.ai), and the policies from support@zime.ai.
Policies available under NDA
- Access Control Policy and Procedure
- Business Continuity and Disaster Recovery Policy
- Business Continuity Plan
- Data Retention Policy
- Encryption Policy
- Endpoint Security Policy
- Incident Management Policy and Procedure
- Operation Security Policy
- Physical and Environmental Security Policy
- SDLC Procedure
- System Acquisition and Development Lifecycle Policy
- Vendor Management Policy
Looking for a policy by another name? Change management, vulnerability and patch management, and backup and recovery are sections of the Operation Security Policy. Personal devices (BYOD) are covered by the Endpoint Security Policy. Third party risk is covered by the Vendor Management Policy. API security is governed by the Access Control, Encryption and System Acquisition and Development Lifecycle policies and the SDLC Procedure.