Built for pharma.
Designed around trust.
Zentiz is built for pharmaceutical marketing teams where data confidentiality, regulatory compliance, and audit integrity are non-negotiable. This page outlines exactly how we protect your data.
Our infrastructure is certified to these standards - your data benefits from them
SOC 2 Type II
Cloud infrastructure
ISO 27001
Google Cloud Platform
POPIA-aligned
Zentiz data practices
TLS + AES-256
Active on Zentiz
MCA Accredited Member
Zentiz is built by Creative Crew, an accredited member of the Marketing Code Authority — South Africa's ethical marketing body for health products.
SOC 2 Type II and ISO 27001 are held by our underlying cloud infrastructure providers - not by Zentiz directly. Zentiz itself is not independently certified to these standards yet - a Zentiz-specific SOC 2 audit is on our 12-month roadmap. TLS 1.2+ and AES-256 encryption are actively implemented on the Zentiz platform.
Enterprise cloud infrastructure
Zentiz is deployed on Google Cloud Platform - one of the world's leading enterprise cloud providers, used by thousands of regulated industries globally including healthcare, finance, and government.
Google Cloud Platform
Enterprise-grade cloud infrastructure used by Spotify, HSBC, Airbus, and thousands of regulated industries worldwide.
SOC 2 Type II certified
Our cloud infrastructure holds SOC 2 Type II certification - independently audited security, availability, and confidentiality controls.
ISO 27001
Google Cloud Platform is certified for ISO 27001 information security management.
Strong logical isolation
Each organisation's data is isolated. No cross-client data access is architecturally possible.
Encrypted at every layer
Your data is protected whether it's moving between devices and our servers, or sitting at rest in the database.
| Layer | Standard | What it protects |
|---|---|---|
| Data in transit | TLS 1.2+ | All communications between your browser/device and Zentiz servers are encrypted end-to-end |
| Data at rest | AES-256 | All data stored on Zentiz servers - brand data, assets, claims, users - is encrypted at rest |
| Secrets & credentials | AES-256 | All API keys, database credentials, and application secrets are encrypted and never exposed in code |
| HTTPS everywhere | Automatic HTTPS | Every Zentiz endpoint is HTTPS-only. No unencrypted HTTP access is permitted |
Role-based access control
Every user is assigned a role that defines exactly what they can see and do - nothing more. Brand data is siloed per brand; a user with access to Brand A cannot access Brand B.
| Role | Access scope |
|---|---|
| Brand Owner | Full access to their specific brand. No access to other brands. |
| Marketing Manager | Campaign management, asset access, claims viewing, brief creation. |
| Regulatory | Compliance review queue, artwork approval/rejection. Read-only access to claims and assets. |
| Agency Partner | Access only to artwork submissions assigned to them. No access to brand strategy, claims library, or unassigned content. |
| Rep | Sales module only. No access to marketing content, compliance, or brand management. |
Authentication
Invitation-only onboarding
Users cannot self-register. Every account must be explicitly provisioned by an authorised admin or Brand Owner.
SSO / SAML
Integrate with your existing Identity Provider - Microsoft Entra, Okta, or Google Workspace. Available on all plans.
30-minute idle timeout
Sessions automatically expire after 30 minutes of inactivity. A 5-minute warning is shown before logout, with the option to stay logged in.
Password security
All passwords are hashed with bcrypt. Forced password reset capability is available to administrators.
Every action logged. Nothing hidden.
A tamper-evident audit trail is built into the core of the platform - not bolted on as an afterthought. This makes Zentiz fully defensible in any regulatory inspection.
User actions
Every login, content creation, edit, upload, download, and deletion - logged with user identity and timestamp.
Approval decisions
Every artwork approval, rejection, and revision request - who decided, when, and any comments.
Claims changes
Every claim addition, edit, status change, and expiry update is fully traceable.
Asset access
Who accessed, viewed, or downloaded which asset and when.
Team changes
User invitations, role assignments, and access removals are all recorded.
Immutable logs
Audit logs cannot be edited, deleted, or altered by any user - including Zentiz administrators.
Regulatory posture
We are transparent about where we are in our compliance journey. These are the standards that matter for pharmaceutical marketing clients in South Africa and globally.
| Standard | Status | Notes |
|---|---|---|
| SOC 2 Type II | Compliant (infrastructure) | Our cloud infrastructure holds SOC 2 Type II certification. Documentation available on request. |
| ISO 27001 | GCP certified | Google Cloud Platform, our underlying infrastructure, is ISO 27001 certified. |
| POPIA (South Africa) | Compliant | Data handling, breach notification within 72 hours, and data subject rights aligned with POPIA. DPA available. |
| GDPR (EU) | Compliant (infrastructure) | Our cloud infrastructure maintains GDPR compliance. EU data residency available on Enterprise plans. |
| Penetration testing | Roadmap - Q4 2026 | First independent penetration test scheduled as we scale to Enterprise clients. Results shared with clients on request. |
| Zentiz SOC 2 Type II | Roadmap - 12 months | Zentiz-specific SOC 2 audit planned as the platform scales. Currently covered by infrastructure-level certification. |
Breach notification policy
In the event of a confirmed data breach, affected clients will be notified within 72 hours of Zentiz becoming aware - aligned with POPIA requirements.
Detect & contain
Isolate affected systems, prevent further exposure.
Assess
Determine scope, what data was affected, and how.
Notify
Alert affected clients per POPIA breach notification obligations.
Remediate
Fix the vulnerability, restore affected systems.
Post-incident review
Document learnings, update procedures, share findings.
What we do - and don't do - with your data
We process only the data necessary to operate the platform and do not use client data for any other purpose.
What we do
- Store brand content in encrypted cloud databases and object storage
- Log every user action in an immutable audit trail
- Encrypt all data in transit (TLS 1.2+) and at rest (AES-256)
- Notify you within 72 hours of any confirmed data breach
- Provide full data export before contract termination
- Permanently delete your data after the agreed retention period
What we never do
- Sell, share, or license your data to any third party
- Use your brand content to train AI models for other clients
- Access your content for commercial or competitive purposes
- Retain data after contract termination beyond the agreed period
- Allow users to access data outside their assigned role scope
- Give platform admins access to client data without logging it
IT team questions - answered
The questions we get from IT and security reviewers, answered directly.
Where is our data hosted?
Zentiz is hosted on Google Cloud Platform (GCP) infrastructure - one of the world's leading enterprise cloud providers, ISO 27001 certified and SOC 2 Type II compliant. For organisations requiring SA or EU data residency, Enterprise-tier regional hosting options are available on request.
Who at Zentiz can access our data?
Only a minimal number of authorised Zentiz personnel have admin-level platform access. This access is used only for support, incident response, and platform maintenance - never for commercial purposes - and every admin action is logged in the audit trail. Within your organisation, only users you have explicitly invited and role-assigned can access your brand data.
Is data encrypted?
Yes, at all times. Data in transit is encrypted using TLS 1.2+. Data at rest - including brand content, assets, claims, users, and audit logs - is encrypted using AES-256. Application secrets and credentials are encrypted with AES-256 and never exposed in application code.
Do you have a Data Processing Agreement (DPA)?
Yes. Zentiz provides a DPA to all Enterprise clients. It covers how we collect, process, and store data; our cloud infrastructure sub-processors; data subject rights; breach notification obligations; and data retention and deletion procedures. Contact us to receive a copy before signing.
What is your breach notification policy?
Affected clients are notified within 72 hours of a confirmed breach - aligned with POPIA requirements. Notification includes what data was affected, how the breach occurred, what steps are being taken, and recommended client actions.
Have you had a penetration test?
Our first independent penetration test is scheduled for Q4 2026 as we scale to Enterprise clients. Our current security posture is underpinned by SOC 2 Type II certification at the infrastructure level, which includes ongoing security testing as part of that audit process.
What is your uptime SLA?
Zentiz runs on GCP's high-availability cloud infrastructure. Formal SLA terms are included in Enterprise subscription agreements. Contact us to discuss terms appropriate for your organisation.
What happens if we cancel our subscription?
Your data is retained for a short transition period to allow for data export, then permanently deleted from all systems. Full data export is available on request before termination. These terms are detailed in the DPA and subscription agreement.
Ready for your IT review?
We actively encourage security reviews. We can provide our full Security Overview document, our cloud infrastructure's SOC 2 Type II compliance documentation, our Data Processing Agreement, and our security roadmap. We're happy to join a technical call with your IT or security team.
Security contact: security@getzentiz.com · Privacy contact: privacy@getzentiz.com