Security and compliance, treated as product requirements.

Our control environment is designed against the AICPA Trust Services Criteria — security, availability, and confidentiality — with continuous control monitoring in place ahead of formal attestation.

Our security program is organized around the CSF functions: Govern, Identify, Protect, Detect, Respond, Recover. Risk assessments are performed at least annually and after material architecture changes.

Because our clients serve local government, we map internal controls to the moderate baseline families most relevant to our data flows: access control, audit, configuration management, and incident response.

We screen collected public-source data to ensure we do not ingest criminal-justice or otherwise restricted records. Our collection scope is limited to public procurement, code, and infrastructure portals.

Data-subject rights (access, correction, deletion, portability) are supported through our privacy request process. We do not sell personal information.

All cardholder data is handled exclusively by Stripe, a PCI DSS Level 1 service provider. Card numbers never touch Zimtelligence systems.

Encryption

TLS 1.2+ in transit; AES-256 at rest. Keys are managed by our cloud provider with rotation policies enforced.

Access control

Least-privilege, role-based access with MFA required on all internal systems. Access reviews quarterly; deprovisioning within 24 hours of role change.

Logging & monitoring

Centralized, tamper-evident audit logs for authentication, data access, and administrative actions, with alerting on anomalous activity.

Vulnerability management

Dependency scanning on every release, periodic penetration testing, and a responsible-disclosure channel for researchers.

Incident response

A documented IR plan with defined severity levels, customer notification commitments consistent with law, and post-incident reviews.

Data minimization

We collect only what the product needs, screen public sources for restricted record types, and enforce retention schedules with automated deletion.