How Zenning handles your data
Zenning connects to the systems your business runs on. This page sets out how we protect that access: what we encrypt, who can reach your data, where it can be hosted, and what we never do with it.Last updated: August 20, 2026
Where we stand on certifications
Including the one that is not finished yet. We would rather you heard it here than found out when you asked for the report.
- Certified
Cyber Essentials
Certified against the UK government-backed Cyber Essentials standard.
- Compliant
GDPR
Built to meet GDPR requirements for how personal data is handled and how your people exercise their rights over it.
- Aligned
ISO 27001
Our information security controls are mapped to the ISO 27001 framework. Aligned to the standard, not certified against it.
- In progress
SOC 2 Type II
Our controls are built and operating against the SOC 2 Type II framework. The independent audit is underway.
Access, only where you allow it
Choose which apps Zenning connects to and which tools it may use in each, and disconnect any time. Single sign-on with SCIM provisioning, plus granular permissions restricting apps and workspaces to specific people and AI employees.
See how app access worksNothing high-stakes without your say-so
Zenning asks for approval before taking sensitive or high-impact actions. You stay in control of what actually gets done.
The controls behind it
No model training
Your data is never used to train AI models — ours or our providers’.
Zero data retention
We run zero-retention configurations with the model providers that process your prompts, so your prompts and their outputs are not stored by them.
Encryption everywhere
AES-256 at rest and TLS 1.2+ in transit, wherever your data sits or moves.
Round-the-clock monitoring
Hardened infrastructure watched continuously for threats.
Operational security
Confidentiality agreements in place across our staff and our suppliers.
Dedicated data residency
Application data and model inference can both be provisioned in your chosen region — a dedicated deployment, separate from our standard managed service.
Questions reviewers ask us
Something else? Talk to us
No. Your data is never used to train AI models — not ours, and not our providers’. We run zero-retention configurations with the model providers that process your prompts, so your prompts and the outputs generated from them are not stored by them either.
Questions from your security team?
Send us your questionnaire and we will work through it with you.