How Secure is zipBoard?
zipBoard is hosted on Amazon Web Services (AWS), encrypts all data in transit, and restricts access to the people each customer invites. Enterprise customers can add single sign-on, choose where data is hosted, and keep documents on their own servers. For the full overview, see Security at zipBoard.
Where is zipBoard hosted?
zipBoard is hosted primarily on Amazon Web Services (AWS). AWS maintains independent security and compliance certifications for eligible infrastructure services, including SOC reports and ISO 27001 certification. These certifications apply to AWS's infrastructure and do not constitute certification of the zipBoard application.
- Physical security: zipBoard personnel have no physical access to data centers. zipBoard relies on AWS's physical security controls.
- Microsoft Azure: For organizations standardizing on the Microsoft ecosystem, deployments on Microsoft Azure are available for selected enterprise engagements.
How is my data encrypted?
- Encryption in transit: All traffic between your device and zipBoard uses industry-standard SSL/TLS encryption, including sign-in credentials and payment details.
- Encryption at rest: Application data is encrypted at rest in the managed database.
Who can access my data?
- Your organization: Role-based permissions control what each member can do. See roles and permissions.
- External reviewers: Share links carry set permissions, with an optional password and an optional expiry date. See How to Use the Share Link Security Features and guest reviewer access.
- zipBoard staff: Access to customer data is limited to authorized personnel, for operational or support purposes only, with role-based access and secure credential management. Access is revoked immediately when staff leave.
Does zipBoard support single sign-on (SSO)?
Yes, on the Enterprise plan. Your team can sign in through your identity provider, for example Microsoft, Google or Okta, configured with your IT team. See How to Sign In with the SSO.
How is my data backed up?
zipBoard takes automated, regular snapshots (via Amazon EBS and S3) to protect against accidental data loss and support recovery from system issues.
Does zipBoard back up my data in case of an emergency?
Yes. Automated backups run regularly, using the snapshots described above.
What happens to my data if I delete my account?
zipBoard retains the information you store for as long as it is needed to provide the service. When you delete your account:
- Personal information is deleted within 30 days.
- Removal from backup storage may take longer.
- Some records may be retained where required to comply with legal obligations, resolve disputes or enforce agreements.
For details, see the zipBoard privacy policy.
Can zipBoard meet data-residency or custom hosting requirements?
Yes. For organizations with enhanced security, compliance or data-residency requirements, zipBoard offers additional deployment options on the Enterprise plan:
- Documents on your own servers: submit documents by URL through the API, or use customer-hosted document storage, so files stay on your servers while zipBoard provides the review layer. See Can we review documents that stay on our own servers?
- Region-specific or private cloud hosting
- Deployment on Microsoft Azure
- Custom access, authentication or permission models
These options are evaluated as part of an enterprise or pilot engagement and may involve additional setup and validation.
Can zipBoard support our security and vendor review?
Yes. zipBoard works with organizations that require supplier vetting, risk assessment and procurement review, and supports your IT, risk and legal teams during procurement. zipBoard can:
- Complete security questionnaires
- Provide security documentation, architectural overviews and operational security details
- Meet with your IT and risk teams
Download the zipBoard Security White Paper: Download now for internal policies and technical safeguards.
To request documentation, email support@zipboard.co or book a call.
How do I report a security vulnerability?
Email support@zipboard.co with "Security" in the subject line.