ISO/IEC 27001
Information Security Management
- Role-based access control (super admin, tenant admin, HR, dept manager, employee) enforced on every API route.
- Strict tenant isolation — all records are scoped to { id, tenantId }; cross-tenant references are validated and rejected.
- Centralised audit trail of authentication, data create/update/delete and personal-data export/erasure events.
- Deactivated accounts are denied authentication; passwords stored using bcrypt hashing.
- Baseline HTTP security headers (HSTS, nosniff, Referrer-Policy, Permissions-Policy) on every response.
ISO/IEC 27017
Cloud Services Security
- Data encrypted in transit (TLS/HSTS) between the browser, application and cloud services.
- Document storage on hardened cloud object storage using short-lived, scoped pre-signed URLs — no public bucket listing.
- Administrative and data-access operations are logged for cloud-side accountability.
- Clear shared-responsibility model between Zorvetska Limited and its cloud infrastructure provider.
ISO/IEC 27018
Protection of PII in the Cloud
- Analytics are consent-gated (Google Consent Mode) and carry no personally identifiable information.
- PII is filtered from every analytics payload by key and by pattern before it leaves the server.
- Data-subject rights: users can export their own personal data and request erasure in-app.
- Personal data is processed only for the workforce-intelligence purposes the customer controls.
ISO/IEC 29110
Software Lifecycle (VSE Profile)
- Documented, versioned change management with reviewable checkpoints for every release.
- Requirements, security controls and integrations are recorded and maintained across releases.
- Automated build, type and runtime verification run before each deployment.
- Defined project management and implementation practices suited to a very small entity (VSE).
Alignment reflects the technical and organisational controls implemented in the platform. Formal certification is a separate, audited process undertaken by Zorvetska Limited. Questions? Contact your Zorvetska account representative.