- About Us
- Trust & Compliance
Security, governance and compliance built into engineering
Your applications, information, and intellectual property deserve better than a security policy. We incorporate security and governance into how we architect, develop, deploy and run software.
SOC 2 Type II Audited
Security controls designed around recognised standards.
Zediant is a SOC 2 Type II audited company, which means our controls around security, availability, processing integrity, and confidentiality have been assessed according to trust service criteria during the audit period.
What this means for clients:
- Security measures and control mechanisms
- Procedures for controlled access and authorization
- Protection of client data and intellectual property
- Documented engineering and delivery processes
- Controls intended to meet enterprise security needs
Security controls at a glance.
Data Protection
Encryption, secure data storage and access control on sensitive data.
Identity & Access
Role based access and least privilege approach.
Secure Development
Security incorporated in software development lifecycle.
Infrastructure Security
Controlled environment and security focused infrastructure practices.
Monitoring & Logging
Monitoring, logging and alerting to detect unusual activity and operation risk.
Backup & Recovery
Process designed to ensure availability and recovery of data.
Incident Response
Process to detect, respond and recover from security incidents.
Vendor & Third-Party Risk
Security around external tools and services used in delivery environments.
Our security framework.
Security is implemented throughout the software development life cycle, including the development process and the post-development phase, which includes deployment.
Data Protection
End-to-end encryption and access control protect the client's data and intellectual property at all stages of the process.
Secure Development Lifecycle
Security is engineered into the design, development, test, and deployment stages, as opposed to being an afterthought.
Identity & Access Management
Role-based access means that only people who are meant to have access get access.
Continuous Monitoring & Risk Management
Continual monitoring helps detect and prevent risks before they become problems.
Operational Integrity
Standardized and audited workflows ensure reliable delivery in all projects.
Compliance-Ready Engineering
Our workflow is designed to meet the compliance needs of our clients.
Client Environment Security
Controlled development environments.
Access to client environments is controlled according to project requirements, role responsibilities and security policies.
Supporting global privacy and data requirements.
Our engineering processes have been crafted to help our customers operate within different regulation systems. We take care of data protection, privacy, and data handling issues as part of architecture and delivery.
UK & Europe
GDPR and UK GDPR considerations
Australia
Australian Privacy Principles
UAE
UAE data protection requirements
Regulatory requirements depend on the application, the type of data, and the jurisdiction. We help our clients include these regulatory requirements in the design and implementation process.
How we handle client data.
It is only natural for enterprise customers to want to know what will happen to their data after a project is initiated. This is how we handle that.
The storage will be based on whether we have client-managed infrastructures, Zediant-managed infrastructures, or a combination of both, depending on the requirements of the engagement.
It is restricted to the engineering pod for the specific engagement and not the whole organization.
The access is through role-based, whereby the engineers can access systems and data that pertain to their roles.
Credentials are managed through a rotation process and not the usual one-time issue of credentials.
The production environment sits at a higher tier of access control than the development and staging environments.
Development and testing should, wherever possible, use anonymized data and not live client data.
Data for the project will be disposed of after a specified period following the end of the engagement.
Secure use of AI in software engineering.
AI-enabled development can improve engineering productivity, but it also presents new security and governance challenges. When we use AI tools, our engineers apply judgment and follow security protocols that we have in place to protect client code, data and intellectual property.
Careful AI Tool Usage
Engineers utilise AI tools with full knowledge of client confidentiality and the sensitivity of the project, following the same security protocols that we adhere to in the rest of our engineering process.
Protection of Client Data
Client code, credentials, and other sensitive information are not provided to the AI tool beyond the engineering scope.
Human Engineering Oversight
The output from the AI is still reviewed through the usual engineering testing.
Secure Integration
AI assisted tools are integrated within development flows with the same security protocols that are followed in other parts of engineering.
Client code and confidential information are never shared with AI tools outside the controlled engineering environment.
Let's review your security requirements.
Have security, compliance or data protection requirements for an upcoming engineering engagement? Talk with our team about your environment, requirements and due-diligence process.
Talk to Our Security & Engineering Team
Reducing risk across the engineering lifecycle.
Protect Client Data
Security policies aimed at protecting sensitive information and intellectual property.
Control Access
Well-defined access and authorization policies reduce unnecessary exposure.
Improve Operational Resilience
Engineering and operational practices that contribute towards building reliable systems and controlled change.
Support Due Diligence
Documentation and security practices that aid clients in evaluating engineering risks.
Supporting your security & procurement process.
Security reviews are part of selecting the right engineering partner. We work with client security, procurement and technology teams to address requirements during due diligence.
Security Questionnaires
Support client-led security assessments.
Technical Reviews
Discuss architecture, environments and engineering controls.
Documentation
Provide relevant security and engineering documentation where applicable.
Ongoing Reviews
Support security requirements as the engagement evolves.
Need security or compliance documentation?
Security reviews always involve documentation - this may include anything from our SOC 2 Type II compliance overview to applicable policies. In order to avoid posting any sensitive material on our public web site, we make such documentation available to you directly.
What you can request
- SOC 2 Type II alignment overview
- Relevant security and engineering policies
- Data handling and processing information
- Answers to your security questionnaire