SOC 2 Type II, ISO 27001, HIPAA, and GDPR: what this means for you

Four certifications sound like paperwork. What they actually buy you is trust you don't have to take on faith.

Your vendor review moves faster. The questions every enterprise security questionnaire asks, encryption, access control, change management, incident response, already have answers in writing, verified by an independent third party.

Every change to the systems handling your data is reviewed and tested before it ships. Nothing goes to production on one person's say-so.

Access to your data is logged, reviewed, and limited to people who need it. No one, including our own leadership, grants themselves access.

We get tested by people whose only job is to break in. Independent penetration testers probe our systems every year, the same way a real attacker would.

If you handle protected health information, we can sign a BAA. If you're moving personal data out of the EU, our documentation already exists. You won't be improvising a compliance program alongside us.

How we got there

We started in February by wiring Vanta into our infrastructure so our controls would generate continuous evidence instead of a scramble before an audit, and brought on an outside compliance agency to run the program across all four frameworks at once.

Before any external auditor looked at us, we ran our own internal ISO 27001 audit and fixed what it found, closing everything out ahead of our first ISMS management review in April. That meant we walked into the real audits already knowing our own house was in order.

May was the busy month. ISO 27001 moved through Stage 1 and Stage 2, closing on the 28th with zero non-conformities, certified by Prescient Assurance, a CREST-accredited certification body. SOC 2 Type II ran as an observation window rather than a single exam: auditors from Zero Day CPA sampled how our controls performed in production over several months and closed with zero exceptions. In parallel, we strengthened endpoint security, rolled out HIPAA training company-wide, and stood up our GDPR program, including an EU Article 27 representative through GDPR Local.

The discipline behind the badges

Certifications are the outcome. In practice, that means every code change gets a second set of eyes and automated checks before it ships, our code and infrastructure are scanned for vulnerabilities continuously rather than on a schedule, and every request for access to production or customer data is logged and reviewed individually, no exceptions. It runs year-round, not just in the weeks before an audit.

Built by people who've done this before

Our engineering leadership came in with a head start. Ashok Loganathan, our Head of Engineering, was previously Global Head of Engineering at Goldman Sachs and helped build core Microsoft systems including Bing Search. Anand Loganathan, our Head of Platform Engineering, led Chrome OS Enterprise at Google and spent 18 years building large-scale infrastructure across Google and Microsoft. Between them, and Christy Warren, our Head of Operations, running the program day to day, we had a team that had already built regulated infrastructure before, just not yet for ourselves.

Four certifications, zero non-conformities, zero exceptions, and a program we intend to keep running exactly this way as we scale.

Get the paperwork

Customers and prospects can request our SOC 2 report, ISO certificate, and full security documentation under NDA. Reach out to your ZeroDrift contact, or talk to our team.