Compliance & Certifications

Our ISO 27001 and SOC 2 Type II certifications cover all aspects of the Actualize platform, including our infrastructure, development processes, security controls, and internal operations. The scope includes our core services, data storage, secure enclaves, identity management, and all related support systems.

Yes, our SOC 2 Type II report, ISO 27001 certificate, and other compliance documentation will be available to customers and prospects under NDA. Current customers will be able to access these documents through the customer portal, and prospects can request access or other materials by contacting our sales team at sales@zerosumdefense.co.

Actualize is designed to help organizations meet HIPAA requirements. We will provide a Business Associate Agreement (BAA) to covered entities and implement the necessary technical, physical, and administrative safeguards required by HIPAA. Our zero-knowledge architecture will provide additional protection for ePHI beyond the standard HIPAA requirements.

We offer several mechanisms to deliver compliant international data transfers. These include Standard Contractual Clauses (SCCs), data residency options for customers who need to keep data in specific regions, and our Data Transfer Addendum which incorporates the latest requirements following the Schrems II decision. Our zero-knowledge architecture also provides additional safeguards by ensuring that encrypted data cannot be accessed even if transferred internationally.

Yes, we conduct both internal and third-party penetration testing at least quarterly. This includes black-box, gray-box, and white-box testing methodologies. We also maintain a public bug bounty program that invites security researchers to identify and report potential vulnerabilities. Summary results of penetration tests are available to customers under NDA.

Actualize includes features specifically designed to help organizations meet their compliance obligations. These include comprehensive audit logs, customizable access controls, data classification tools, encryption key management, and compliance reporting capabilities. We also provide documentation that customers can use in their own compliance programs, such as our security controls mapping to various regulatory frameworks.