{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"zeroheight","name":"zeroheight","domain":"zeroheight.com","category":"Developer tools","one_liner":"The design system layer for coding agents","trust_center_url":"https://trust.zeroheight.com/","security_page_url":null,"url":"https://certreports.com/vendors/zeroheight/security","last_verified_at":"2026-09-21T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 21 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 2 Type II on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/zeroheight/soc-2","evidence":[{"source_type":"trust_center","source_name":"zeroheight trust centre (Vanta)","url":"https://trust.zeroheight.com/","fetched_at":"2026-09-21 22:56:32.012031+00","content_hash":"706244ff98ec28440fe52166be94a1251fcb4b575815e11fb6e4990ef9c594ee","wayback_url":null,"quote":"SOC 2 Type II","confidence":1},{"source_type":"trust_center","source_name":"zeroheight trust centre (Vanta)","url":"https://trust.zeroheight.com/","fetched_at":"2026-09-18 23:30:14.129327+00","content_hash":"bd43d4e039d66d8bc60e93f5795b9f7d17bc096cc1b4c7b6a3dd0e0048195dc1","wayback_url":null,"quote":"SOC 2 Type II","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/zeroheight/gdpr","evidence":[{"source_type":"trust_center","source_name":"zeroheight trust centre (Vanta)","url":"https://trust.zeroheight.com/","fetched_at":"2026-09-21 22:56:32.012031+00","content_hash":"706244ff98ec28440fe52166be94a1251fcb4b575815e11fb6e4990ef9c594ee","wayback_url":null,"quote":"GDPR","confidence":1},{"source_type":"trust_center","source_name":"zeroheight trust centre (Vanta)","url":"https://trust.zeroheight.com/","fetched_at":"2026-09-18 23:30:14.129327+00","content_hash":"bd43d4e039d66d8bc60e93f5795b9f7d17bc096cc1b4c7b6a3dd0e0048195dc1","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/zeroheight/iso-27001","evidence":[{"source_type":"trust_center","source_name":"zeroheight trust centre (Vanta)","url":"https://trust.zeroheight.com/","fetched_at":"2026-09-21 22:56:32.012031+00","content_hash":"706244ff98ec28440fe52166be94a1251fcb4b575815e11fb6e4990ef9c594ee","wayback_url":null,"quote":"ISO 27001:2022","confidence":1},{"source_type":"trust_center","source_name":"zeroheight trust centre (Vanta)","url":"https://trust.zeroheight.com/","fetched_at":"2026-09-18 23:30:14.129327+00","content_hash":"bd43d4e039d66d8bc60e93f5795b9f7d17bc096cc1b4c7b6a3dd0e0048195dc1","wayback_url":null,"quote":"ISO 27001:2022","confidence":1}]}],"brief":null,"legal_docs":[{"kind":"subprocessors","url":"https://trust.zeroheight.com/","availability":"public","detail":"2 subprocessors listed on the trust centre","as_of":"2026-09-21"},{"kind":"privacy","url":"https://www.zeroheight.com/privacy","availability":"public","detail":null,"as_of":"2026-09-21"},{"kind":"security_txt","url":"https://trust.zeroheight.com/","availability":"public","detail":"Public documents on the trust centre: ISO 27001:2022 Certificate (2026-2029)","as_of":"2026-09-18"},{"kind":"ai_policy","url":"https://trust.zeroheight.com/","availability":"on_request","detail":"Listed on the trust centre as \"AI Policy\"","as_of":"2026-09-21"}],"documents":[{"type":"ai_policy","title":"AI Policy","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"architecture_diagram","title":"Architecture Diagram","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"business_continuity","title":"Business Continuity and Disaster Recovery Plan","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"incident_response","title":"Incident Response Plan","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"insurance","title":"Insurance policy certificate","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"iso_certificate","title":"ISO 27001:2022 Certificate (2026-2029)","availability":"public","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Penetration Test (Mar 2023)","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Penetration Test (March 2024, updated October 2024)","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Penetration Test (March 2025, updated July 2025)","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Penetration Test (March 2026, updated August 2026)","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Penetration Test Attestation (April 2026)","availability":"public","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Penetration Test Attestation (March 2024, updated October 2024)","availability":"public","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"questionnaire","title":"Vendor Security Alliance (VSA) Core","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Access Control Policy","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Cryptography Policy","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Human Resource Security Policy","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Information Security Policy (AUP)","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Information Security Roles and Responsibilities","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Operations Security Policy","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Physical Security Policy","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"security_policy","title":"Secure Development Policy","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"SOC 2 Type II Report (2022)","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"SOC 2 Type II Report (Dec 2025)","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"SOC 2 Type II Report (Nov 2023)","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"SOC 2 Type II Report (Nov 2024)","availability":"on_request","source_url":"https://trust.zeroheight.com/","last_seen":"2026-09-21"}],"statements":[{"topic":"data_location","question":"Where are your servers located?","answer":"Content uploaded to platform (where zeroheight acts as processor) is stored on AWS in Ireland (EU). We also have a secondary site available for failover on AWS in Germany (EU). Analytics data relating to use of the service (of which we are a controller) is processed in US, UK and EU. Any personal data transferred outside of the UK/EEA to a third country (such as the US) is done so using applicable transfer mechanisms.","value":null,"regions":["EU","UK","US","Ireland","Germany"],"source_url":"https://trust.zeroheight.com/faq?s=78ah09w798dhym677wmz01","as_of":"2026-09-21"},{"topic":"encryption","question":"Do you encrypt data at rest?","answer":"All data at rest is encrypted via AWS-256 or greater (as per Data Management Policy). This includes backups. AWS Macie sweeps our S3 storage to detect and alert on any unencrypted data. All data in transit (internally and outbound) is encrypted with HTTPS TLS 1.2 or greater.","value":null,"regions":[],"source_url":"https://trust.zeroheight.com/faq?s=okpuu9godlsdw87qqmn3nl","as_of":"2026-09-21"}],"security_profile":{"iso42001":null,"trains_on_customer_data":null,"data_residency_regions":["EU","Germany","Ireland","UK","US"],"pen_test_cadence":"annual","as_of":"2026-09-21"},"regulations_url":"https://certreports.com/api/v1/vendors/zeroheight/regulations/{regulation}","subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Processing Customer Content, Name, Email, IP address and location data of each Authorised User","location":"Amazon Web Services EMEA SARL, One Burlington Plaza, Burlington Road, Dublin 4, Dublin","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"OpenAI","domain":"openai.com","purpose":"Customer Content input into AI features","location":"OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110 ","vendor_url":"https://certreports.com/vendors/openai/security"}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-04T20:13:42.352Z"}