SECURITY
How we protect your business systems and data.
Plain-language answers for business owners and the security questions your team or insurer will ask.
Our controls
Our commitments
| Commitment | Detail |
|---|---|
| Incident notice | We tell you within 24 hours of any suspected incident |
| Clean exit | Access removed the same day; documentation returned within 5 business days |
| Data protection | Agreement, signed before work starts, covering US privacy laws, UK GDPR, EU GDPR and the Australian Privacy Act |
| Certification | ISO 27001 readiness under way (see the certification roadmap) |
Questions
Do you store our data?
No. We work inside your systems through logged access and keep no copies.
Can we see who accessed what?
Yes. Sessions are logged, and only your named team has access.
Will you complete our security questionnaire?
Yes, in full within 3 business days.
For procurement and vendor reviews
Zaivit is a brand of Diversacrest Private Limited, a company registered in India (CIN U46909MH2024PTC420015), registered office Nashik, Maharashtra 422009. Everything your vendor-onboarding team needs is below; for anything else, email hello@zaivit.com.
- Data processing agreement
Signed before work starts; summary publishedRead the summary of the data processing agreement - Sub-processor list
Every third party that may handle your data, and how we tell you about changesView the sub-processor list - Security overview
Our controls, access model and incident process in one documentRequest the security overview - Your security questionnaire
SIG, CAIQ or your own format, completed in full within 3 business daysSend it to us (security questionnaire) - Accessibility statement
WCAG 2.2 AA target, test results and known limitationsRead the accessibility statement - Vulnerability disclosure
How to report an issue, and our safe-harbour termsRead how to report a vulnerability
Report a security issue
Found a vulnerability in our website or services? Email hello@zaivit.com with the subject "Security report", what you found and how to reproduce it. We reply within 2 business days and keep you updated until it's fixed.
Please test only against your own accounts, don't access or change other people's data, and give us reasonable time to fix the issue before you share it. We won't take legal action against good-faith research that follows these rules. Our contact file is at /.well-known/security.txt.
Security questions? Ask an expert.
We answer them on a 20-minute call, or in writing within 3 business days.