> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> Sazabi's compliance program — its SOC 2 Type II, SOC 1, ISO 27001 and ISO 27017 certifications, how to get the audit reports under NDA, privacy regulations, subprocessors, security testing, and availability.

Sazabi holds its own security certifications, processes data under recognized privacy regulations, and tests its security continuously. This page summarizes that posture; for contractual specifics, see the [Data Processing Addendum](https://www.sazabi.com/legal/product/data-processing-addendum).

## Certifications

Sazabi itself is audited and certified, not only the infrastructure it runs on:

* **SOC 2 Type II**
* **SOC 1**
* **ISO/IEC 27001**
* **ISO/IEC 27017**

These apply to every Sazabi plan. Sazabi also supports GDPR; see [Privacy and data protection](#privacy-and-data-protection).

## Get the audit reports

Sazabi shares its SOC 2 Type II report and ISO 27001 audit reports with anyone who signs a non-disclosure agreement. You don't need to be a customer or on a particular plan. Request them from the [Sazabi Trust Center](https://sazabi.secureframetrust.com), which also shows the security controls Sazabi monitors continuously, or email [security@sazabi.ai](mailto:security@sazabi.ai).

## HIPAA

HIPAA safeguards are available on select plans. To discuss HIPAA requirements, contact [sales@sazabi.ai](mailto:sales@sazabi.ai).

## Privacy and data protection

Sazabi is a data processor: it processes your data on your instructions and for no other purpose. Sazabi supports GDPR and CCPA, including data subject requests — deletion, correction, and export — and follows data-minimization and purpose-limitation principles. Sazabi's [Data Processing Addendum](https://www.sazabi.com/legal/product/data-processing-addendum) formalizes these responsibilities. See [Data handling](https://docs.sazabi.com/security/data-handling.md) for how this maps to what happens to your telemetry.

## Payment data

Sazabi deliberately scopes cardholder data out of the platform, so PCI-DSS does not apply. Payments are handled by a dedicated payment processor.

## Subprocessors

Sazabi uses a defined set of subprocessors to run the platform — infrastructure, storage, AI model providers, and operational tooling. Each carries its own SOC 2 and/or ISO 27001 attestation, in addition to Sazabi's own certifications above. The current list, with each subprocessor's purpose and location, is in Annex 5 of the [Data Processing Addendum](https://www.sazabi.com/legal/product/data-processing-addendum).

## Security testing

Sazabi tests its security continuously: dependencies and container images are scanned on every build, code changes go through mandatory review, and automated vulnerability scanning runs against production. On top of that, Sazabi engages independent third parties to penetration-test the platform.

## Availability

Sazabi monitors uptime and availability continuously and maintains business continuity, disaster recovery, and backup restoration testing as part of its audited controls. For a contractual uptime commitment, contact [sales@sazabi.ai](mailto:sales@sazabi.ai).

## Report a vulnerability

To report a security issue, contact [security@sazabi.ai](mailto:security@sazabi.ai). Sazabi maintains a direct path for disclosures and responds to reported issues.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.