trust

Zitadel Inc.

Welcome to Zitadel's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation.

For security reports, please consult our security.txt how to get in touch and report vulnerabilities.

Useful resources:

SOC2 Type II Report
Data Processing Agreement
Legal Agreements
Vulnerability Disclosure
legal@zitadel.com for legal and compliance related questions.

Compliance

ISO 27001:2022

SOC 2 Type II

OpenSSF Best Practices

Data Privacy Framework

GDPR

CCPACOMPLIANT

CCPA

Resources

Certifications & Attestations

ISO 27001:2022

ISO27001:2022 Certificate

11-ISMS Statement of Applicability

SOC 2 Type II

Operational Policies

Acceptable Use Policy

Zitadel Vulnerability Disclosure Policy

Brand and Trademark Policy

Legal

Data Processing Agreement

Zitadel Self-Hosted Enterprise Master Service Agreement

Zitadel Cloud Enterprise Master Service Agreement

Corporate Governance

Code of Conduct

Modern Slavery and Human Trafficking Statement

Ethical Conduct and Business Practices Policy

Other resources

Digital Operational Resilience Act (DORA) Compliance

Controls

Updated 2 minutes ago

Organizational security

Inventory of assets
Ownership of assets
Return of assets

People security

Screening
Terms and conditions of employment
Responsibilities after termination or change of employment

Physical security

Physical security perimeters
Physical entry
Securing offices, rooms and facilities

Technological security

Privileged access rights
Information access restriction
Access to source code

Data collected

Customer personally identifiable information

Employee personally identifiable information

Customer uploaded data

Subprocessors

Google Cloud Platform • [Zitadel Cloud] Cloud provider

Designated by customer.

Postmark (AC PM LLC) • [Zitadel Cloud] Transactional emails (Optional)

USA

Twillio Inc. • [Zitadel Cloud] Communication (Optional)

USA

Updates

Updated Privacy Policy and Sub-Processors

Published October 23, 2025

Privacy Policy

We've updated the Zitadel's Privacy Policy to align with the Data Privacy Framework (DPF) principles, a change approved by the U.S. Department of Commerce.

This update ensures stronger privacy protections for data transfers from the EU/EEA, UK, and Switzerland to the U.S. and is now reflected in our policy. Zitadel has completed the necessary self-certification and is registered for an independent recourse mechanism (JAMS) to resolve complaints.

Key changes:

Zitadel complies with the EU-U.S. DPF and the Swiss-U.S. DPF regarding the collection, use, and retention of personal data transferred from the European Union, European Economic Area, and Switzerland to the United States. The policy now details our commitment to effective recourse, enforcement, and liability under the DPF. We utilize JAMS (Judicial Arbitration and Mediation Services) as our independent recourse mechanism (IDR) and detail the conditions for binding arbitration as a means of dispute resolution.
Zitadel's HQ address has been updated.
We've removed explicit listings of analytics providers. The policy now links to our sub-processor list.

Sub-Processors

Removed Posthog, Inc.
Added Mixpanel for Data Analytics.

Read more about Updated Privacy Policy and Sub-Processors.