Penetration testing & security assurance
How frequently Zato tests for vulnerabilities, the standards it follows, and how to request security reports for due diligence.
Zato undergoes independent third-party penetration testing after every major release, and at minimum every six months — whichever comes first.
The standard
Testing follows OWASP (Open Web Application Security Project) standards — the recognised international framework for identifying and addressing web application security vulnerabilities.
What happens with results
All identified vulnerabilities are triaged, prioritised, and addressed before the next release. Critical findings are addressed immediately — not deferred to scheduled releases.
Broader security assurance programme
- Continuous monitoring via AWS security tooling across all regional infrastructure
- Regular internal security reviews aligned with ISO 27001:2022 requirements
- AI system governance reviews aligned with ISO 42001
- SOC 2 controls assessment covering security, availability, and confidentiality
- Annual recertification across all four frameworks
Requesting documentation
The following are available for due diligence:
- Penetration test summary reports
- SOC 2 report (available under NDA)
- ISO 27001:2022 and ISO 42001 certificates
- Security overview documentation
- Data processing agreements
Contact security@zatohq.com or speak to your PSM.