Snapshot 105114
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Zitadel Inc. security@zitadel.com Privacy PolicyOpens in new tab Welcome to Zitadel's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. For security reports, please consult our security.txtOpens in new tab how to get in touch and report vulnerabilities. Useful resources: SOC2 Type II ReportOpens in new tab Data Processing AgreementOpens in new tab Legal AgreementsOpens in new tab Vulnerability DisclosureOpens in new tab legal@zitadel.com for legal and compliance related questions Get notified about changes to our subprocessors and compliance announcements by subscribing to updates. Compliance ISO 27001:2022 SOC 2 Type II OpenSSF Best Practices Data Privacy Framework GDPR CCPA Resources View all Certifications & Attestations ISO 27001:2022 ISO27001:2022 Certificate Opens in new tab 11-ISMS Statement of Applicability SOC 2 Type II View 2 more Operational Policies Acceptable Use Policy Opens in new tab Brand and Trademark Policy Opens in new tab Legal Terms of Service Opens in new tab Data Processing Agreement Opens in new tab Policies Information Security Policy (AUP) Secure Development Policy Operations Security Policy Risk Management Policy View 8 more Penetration Testing Penetration Test Zitadel 2025.pdf Business Continuity Business Continuity and Disaster Recovery Plan Incident Response Plan Corporate Governance Ethical Conduct and Business Practices Policy Other resources Digital Operational Resilience Act (DORA) Compliance Controls View all Organizational security Inventory of assets Ownership of assets Return of assets View 35 more Organizational security controls People security Screening Terms and conditions of employment Responsibilities after termination or change of employment View 5 more People security controls Physical security Physical security perimeters Physical entry Securing offices, rooms and facilities View 10 more Physical security controls Technological security Privileged access rights Information access restriction Access to source code View 30 more Technological security controls Data collected Customer personally identifiable information Employee personally identifiable information Customer uploaded data Subprocessors View all Google Cloud Platform • [Zitadel Cloud] Cloud provider Designated by customer Google Cloud Platform is our cloud infrastructure provider for Zitadel Cloud. Data is stored in regions as designated by the customer. Postmark (AC PM LLC) • [Zitadel Cloud] Transactional emails (Optional) USA We use Postmark to send transactional mails to clients. Your data might be processed by Postmark when using our services, especially when you have not configured your own SMTP service. Twillio Inc. • [Zitadel Cloud] Communication (Optional) USA Twilio provides SMS messaging services for Zitadel Cloud. In case you have not configured your own message gateway in Zitadel Cloud, your data will be processed by Twilio when using features that rely on SMS communication. Updates View all Privacy Updated Privacy Policy and Sub-Processors Published October 23, 2025 Privacy Policy We've updated the Zitadel's Privacy PolicyOpens in new tab to align with the Data Privacy Framework (DPF) principlesOpens in new tab, a change approved by the U.S. Department of Commerce. This update ensures stronger privacy protections for data transfers from the EU/EEA, UK, and Switzerland to the U.S. and is now reflected in our policy. Zitadel has completed the necessary self-certification and is registered for an independent recourse mechanism (JAMS) to resolve complaints. Key changes: Zitadel complies with the EU-U.S. DPF and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union, European Economic Area, and Switzerland to the United States. The policy now details our commitment to effective recourse, enforcement, and liability under the DPF. We utilize JAMS (Judicial Arbitration and Mediation Services) as our independent recourse mechanism (IDR) and detail the conditions for binding arbitration as a means of dispute resolution. Zitadel's HQ address has been updated. We've removed explicit listings of analytics providers. The policy now links to our sub-processor listOpens in new tab. Sub-Processors Removed Posthog, Inc. Added Mixpanel for Data Analytics Read more about Updated Privacy Policy and Sub-Processors Zitadel Inc. security@zitadel.com Privacy PolicyOpens in new tab Welcome to Zitadel's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. For security reports, please consult our security.txtOpens in new tab how to get in touch and report vulnerabilities. Useful resources: SOC2 Type II ReportOpens in new tab Data Processing AgreementOpens in new tab Legal AgreementsOpens in new tab Vulnerability DisclosureOpens in new tab legal@zitadel.com for legal and compliance related questions Get notified about changes to our subprocessors and compliance announcements by subscribing to updates. Compliance ISO 27001:2022 SOC 2 Type II OpenSSF Best Practices Data Privacy Framework GDPR CCPA Resources View all Certifications & Attestations ISO 27001:2022 ISO27001:2022 Certificate Opens in new tab 11-ISMS Statement of Applicability SOC 2 Type II View 2 more Operational Policies Acceptable Use Policy Opens in new tab Brand and Trademark Policy Opens in new tab Legal Terms of Service Opens in new tab Data Processing Agreement Opens in new tab Policies Information Security Policy (AUP) Secure Development Policy Operations Security Policy Risk Management Policy View 8 more Penetration Testing Penetration Test Zitadel 2025.pdf Business Continuity Business Continuity and Disaster Recovery Plan Incident Response Plan Corporate Governance Ethical Conduct and Business Practices Policy Other resources Digital Operational Resilience Act (DORA) Compliance Controls View all Organizational security Inventory of assets Ownership of assets Return of assets View 35 more Organizational security controls People security Screening Terms and conditions of employment Responsibilities after termination or change of employment View 5 more People security controls Physical security Physical security perimeters Physical entry Securing offices, rooms and facilities View 10 more Physical security controls Technological security Privileged access rights Information access restriction Access to source code View 30 more Technological security controls Data collected Customer personally identifiable information Employee personally identifiable information Customer uploaded data Subprocessors View all Google Cloud Platform • [Zitadel Cloud] Cloud provider Designated by customer Google Cloud Platform is our cloud infrastructure provider for Zitadel Cloud. Data is stored in regions as designated by the customer. Postmark (AC PM LLC) • [Zitadel Cloud] Transactional emails (Optional) USA We use Postmark to send transactional mails to clients. Your data might be processed by Postmark when using our services, especially when you have not configured your own SMTP service. Twillio Inc. • [Zitadel Cloud] Communication (Optional) USA Twilio provides SMS messaging services for Zitadel Cloud. In case you have not configured your own message gateway in Zitadel Cloud, your data will be processed by Twilio when using features that rely on SMS communication. Updates View all Privacy Updated Privacy Policy and Sub-Processors Published October 23, 2025 Privacy Policy We've updated the Zitadel's Privacy PolicyOpens in new tab to align with the Data Privacy Framework (DPF) principlesOpens in new tab, a change approved by the U.S. Department of Commerce. This update ensures stronger privacy protections for data transfers from the EU/EEA, UK, and Switzerland to the U.S. and is now reflected in our policy. Zitadel has completed the necessary self-certification and is registered for an independent recourse mechanism (JAMS) to resolve complaints. Key changes: Zitadel complies with the EU-U.S. DPF and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union, European Economic Area, and Switzerland to the United States. The policy now details our commitment to effective recourse, enforcement, and liability under the DPF. We utilize JAMS (Judicial Arbitration and Mediation Services) as our independent recourse mechanism (IDR) and detail the conditions for binding arbitration as a means of dispute resolution. Zitadel's HQ address has been updated. We've removed explicit listings of analytics providers. The policy now links to our sub-processor listOpens in new tab. Sub-Processors Removed Posthog, Inc. Added Mixpanel for Data Analytics