Our infrastructure security posture, described plainly.
ZeroDrift sits in the request path between your application and your AI model. We take that position seriously. This page describes what we do to protect data in transit and at rest, how we handle the AI responses we process, and where we are in our compliance certification work.
Built on hardened AWS infrastructure with network isolation.
AWS us-east-1 and us-west-2
ZeroDrift runs on AWS infrastructure in two regions with automatic failover. All compute runs in private VPCs with no public ingress except the load balancer endpoints. Outbound traffic to AI model APIs routes through NAT gateways with static IP allowlisting.
TLS 1.3 in transit
All communication between your application and ZeroDrift uses TLS 1.3 with certificate pinning available for Enterprise deployments. TLS 1.0 and 1.1 are disabled. Internal service-to-service traffic inside the VPC also uses mutual TLS.
AES-256-GCM at rest
Audit log data stored by ZeroDrift is encrypted at rest using AES-256-GCM with keys managed through AWS KMS. Encryption keys are rotated annually. Customer-managed key (BYOK) support is available on the Enterprise tier.
Access controls and secrets management
Production access follows least-privilege IAM policies. No engineer has standing root access to production. Secrets (API keys, database credentials) are stored in AWS Secrets Manager with automatic rotation. All privileged access is logged and reviewed quarterly.
How ZeroDrift processes and stores AI response data.
What ZeroDrift stores
By default, ZeroDrift logs only requests where a policy action was taken (rewrite or block). Pass-through requests are not stored. Stored records include the original response, the policy triggered, the action taken, the timestamp, and the API key identifier. Request body content (your user's input) is not stored unless you enable full logging.
Data residency
Log data is stored in the AWS region you select at account creation. US region customers default to us-east-1. European customers default to eu-west-1. Data does not cross regions unless you configure multi-region replication. Enterprise customers can specify a single-region constraint in their data processing agreement.
Retention and deletion
Log data defaults to a 90-day retention period on the Starter and Growth tiers. Enterprise customers configure their own retention period in the agreement. Data deletion requests are processed within 72 hours and apply to all regional copies. We do not maintain backups beyond the configured retention period.
Data processing agreement
ZeroDrift provides a standard data processing agreement (DPA) for Growth and Enterprise customers. The DPA covers our role as a data processor under GDPR, CCPA, and other applicable frameworks. Customized DPAs are available for Enterprise customers with specific contractual requirements. Contact [email protected] to request a DPA.
Where we are on formal certifications.
We are candid about where ZeroDrift is in its compliance certification work. We are a 2023-founded company, and we want to describe our posture accurately rather than list certifications we are still working toward.
We are currently in the preparation phase for SOC 2 Type II. We have engaged a third-party auditor and are in the observation period. We expect to complete the audit process and have results available in the second half of 2026. We will update this page when the report is available.
For HIPAA: ZeroDrift's infrastructure is built to support HIPAA-compliant configurations. We can execute a Business Associate Agreement (BAA) with Enterprise customers who require it. HIPAA applicability depends on the data your application sends through ZeroDrift. Contact us if you are evaluating ZeroDrift for a healthcare AI deployment and have specific questions about your configuration.
We provide a security questionnaire response and architecture documentation to Enterprise customers during procurement. If you need specific documentation for your organization's vendor review, contact [email protected] and let us know what your review requires.