Security at zipBoard
Security, privacy and data protection
zipBoard is hosted on Amazon Web Services, encrypts all data in transit and limits access to the people each customer invites. Enterprise customers can add single sign-on and, as additional deployment options, choose where their data is hosted or keep documents on their own servers. This page summarizes the controls in place and how zipBoard supports vendor security assessments.
Security questionnaires (SIG, CAIQ or your own format) are completed on request.
- Hosted on Amazon Web Services
- Encrypted in transit (SSL/TLS) and at rest
- Role-based access and secure share links
- Single sign-on on the Enterprise plan
- Optional private cloud and customer-hosted deployment
- Security questionnaires completed on request
Hosted on Amazon Web Services
Encrypted in transit with SSL/TLS
Single sign-on on the Enterprise plan
Security overview
A summary of zipBoard's security controls for IT, risk and procurement reviewers.
| Area | Control | Availability |
|---|---|---|
| Hosting | Amazon Web Services. Microsoft Azure deployments for selected enterprise engagements. | All plans; Azure on Enterprise |
| Encryption in transit | All connections use SSL/TLS, including sign-in and payment details. | All plans |
| Encryption at rest | Application data is encrypted at rest in the managed database. | All plans |
| Access control | Role-based permissions within each organization. Share links with set permissions, optional password and expiry date. | All plans |
| Single sign-on | Sign-in through the customer's identity provider, such as Microsoft, Google or Okta. | Enterprise |
| Additional deployment options | Documents kept on customer servers, customer-hosted storage, region-specific or private cloud hosting and Microsoft Azure. See below. | Enterprise, on request |
| Backups | Automated, regular snapshots for recovery from accidental loss or system issues. | All plans |
| Data deletion | Personal information is deleted within 30 days of account deletion. | All plans |
| Certifications | No SOC 2 report or ISO 27001 certification of zipBoard's own at present. AWS certifications cover the underlying infrastructure. | Not applicable |
Watch: zipBoard security overview (90 seconds)
Infrastructure and hosting
zipBoard is hosted on Amazon Web Services (AWS). Documents and files are held in cloud object storage, and project data such as comments, statuses and version history is held in a managed database hosted on AWS. For selected enterprise engagements, zipBoard can be deployed on Microsoft Azure.
AWS maintains its own certifications for its data centres and infrastructure. These certifications apply to AWS, not to the zipBoard application.
Data encryption
All traffic between users and zipBoard is encrypted in transit using SSL/TLS, including sign-in credentials and payment details.
Application data is encrypted at rest in zipBoard’s managed database.
Access control
Access to customer content is limited to the people each customer invites and to the zipBoard personnel who need it to provide the service.
- Within your organization: role-based permissions determine what each person can do. Super Admins manage members and billing, Admins configure workflows, and Managers, Collaborators and Reviewers work within the projects they are added to. Roles and permissions
- External reviewers: content can be shared through a link instead of an account. Each link carries its own permissions and can be protected with a password and an expiry date. Share link security
- zipBoard personnel: access to customer data is restricted to authorized staff for support and operational purposes, with role-based access and secure credential management. Access is revoked immediately when a staff member leaves.
Authentication and single sign-on
Enterprise customers can require sign-in through their own identity provider, such as Microsoft, Google or Okta. zipBoard configures single sign-on together with the customer’s IT team, including the email domain and attribute mapping.
Single sign-on changes how users sign in; roles and project access remain as the customer sets them. How single sign-on works
Backup, retention and deletion
zipBoard takes automated, regular snapshots of its systems to support recovery from accidental loss or system issues. Customer data is retained for as long as needed to provide the service.
When an account is deleted, personal information is deleted within 30 days. Removal from backups may take longer, and certain records, such as billing records, are retained where required by law. Projects can also be archived and restored without being deleted.
Customers with specific retention requirements, such as removing markups and attachments when a review closes, can raise them during their security review.
Compliance and certifications
zipBoard does not currently hold its own SOC 2 report or ISO 27001 certification. To support vendor assessments, zipBoard:
- completes security questionnaires, including SIG, CAIQ and customer-specific formats;
- provides security documentation, including an architecture and data-flow overview;
- meets with customer IT, risk and legal teams.
The third-party processors zipBoard uses are listed in the Data & Privacy Policy.
Artificial intelligence features
zipBoard’s AI-assisted review is currently offered only to organizations participating in a private beta.
Customers may request that AI features be excluded from the scope of their agreement.
Reporting a security vulnerability
To report a suspected vulnerability, email [email protected] with “Security” in the subject line. Please include a description of the issue, the affected URL and the steps to reproduce it. zipBoard will acknowledge the report and investigate.
Please do not access, modify or retain data that does not belong to you, and allow reasonable time for the issue to be resolved before any public disclosure.
Frequently asked questions
zipBoard is hosted on Amazon Web Services, encrypts all data in transit with SSL/TLS, encrypts application data at rest, restricts staff access to authorized personnel and takes automated, regular backups. Enterprise customers can add single sign-on and, as additional deployment options, keep documents on their own servers or choose where data is hosted.
On Amazon Web Services. Microsoft Azure deployments, region-specific hosting and private instances are available to enterprise customers.
Yes, on the Enterprise plan. Users sign in through the customer’s identity provider, such as Microsoft, Google or Okta.
Not at present. zipBoard does not hold its own SOC 2 report or ISO 27001 certification; AWS certifications cover the underlying infrastructure. zipBoard completes security questionnaires and provides security documentation on request.
No. Content can be shared through a link with its own permissions, an optional password and an expiry date.
Yes, as an additional deployment option for enterprise customers. Documents can be submitted for review by URL through the API, or held in customer-hosted storage. These options are scoped with your IT team as part of an enterprise engagement or pilot.
Personal information is deleted within 30 days of account deletion. Certain records, such as billing records, are retained where required by law.
Email your questionnaire to [email protected] or book a call. zipBoard will complete it and can meet with your IT, risk or legal team.
Start your security review
Send your questionnaire or request security documentation. Our team will respond and can join a call with your IT, risk or legal reviewers.
Related: Data & Privacy Policy · Terms of Service · How secure is zipBoard? (Help Center)
©️ Copyright 2026 zipBoard Tech. All rights reserved.