Security & trust
Security information for technical and procurement review.
Understand the hosting architecture, tenant model, delivery controls, audit approach and data portability before implementation starts.
Independent assurance
Certification status, stated clearly.
Zuduno does not currently provide an ISO 27001 certificate or SOC 2 report. Procurement reviews are based on the documented controls, architecture and contractual scope available for inspection.
- Control review
- Review the architecture and operating controls below, then send any questionnaire-specific requirements to the team.
- Evidence
- Technical documentation and answers are scoped to the implementation under review.
- Security contact
- Send procurement and security questions to hello@zuduno.com.
The control inventory
Six areas to include in your review.
- 01
EU hosting architecture
The Zuduno application is designed for EU-hosted infrastructure. This marketing site is served separately from Cloudflare's edge and does not host application accounts or customer operational data.
- 02
Tenant isolation
Tenant identity is part of the application data contract. Queries are scoped to the organisation, with no global fallback path for operational records.
- 03
Access model
Application roles and operational access are scoped by responsibility. Administrative access requirements and customer-specific controls are reviewed during procurement and implementation.
- 04
Auditability
Activity, audit and readiness are separate record types so operational decisions can be reviewed independently from the feature that produced them.
- 05
Secure development
Changes pass code review and continuous integration before release. Database changes follow an additive migration approach so application data remains compatible across releases.
- 06
Data portability
Export, retention and transition requirements are included in the commercial and implementation review. The goal is a practical path into Zuduno and a practical path out.
Verify it yourself
What a reviewer can check today, without asking us.
- This site's response headers: a hash-pinned Content-Security-Policy, HSTS, X-Content-Type-Options, Referrer-Policy and a restrictive Permissions-Policy. Every inline script is hashed at build time and the build fails if one is not.
- The published import contract, including the entities, required fields and staged validation path used for onboarding.
- The migration approach, including validation before commit, parallel running, controlled channel activation and data export requirements.
Bring security into the evaluation early.
Send your questionnaire, data-processing requirements and procurement checklist before the call.