Azeon's Trust Center
Azeon Trust Center
Explore our security controls, compliance certifications, trusted service providers, and the measures we take to protect customer data across our platform.
Welcome to Azeon’s Trust Center, where our commitment to data privacy and security is central to our operations. Azeon’s agentic AI platform helps enterprise support teams resolve customer issues across Zendesk, Salesforce, ServiceNow and Freshdesk.
This Trust Center offers detailed insight into our security practices, including the specific controls and policies implemented by our teams. You can explore our compliance standards, request access to comprehensive security documentation, and understand how we safeguard your data.
Controls
View all- Unique production database authentication enforced
- Encryption key access restricted
- Unique account authentication enforced
- Asset disposal procedures utilized
- Production inventory maintained
- Portable media encrypted
- Data encryption utilized
- Control self-assessments conducted
- Penetration testing performed
- Continuity and Disaster Recovery plans established
- Continuity and Disaster Recovery plans tested
- Cybersecurity insurance maintained
- Data retention procedures established
- Customer data deleted upon leaving
- Data classification policy established
Compliance
SOC 2 Type II
ISO 27001
GDPRExternal Service ProvidersView all
OpenAI, L.L.C. • Underlying language model provider for select agent workflows
Anthropic, PBC • Underlying language model provider for select agent workflows
Microsoft Corporation • Secondary cloud infrastructure and regional hosting
Amazon Web Services, Inc. • Primary cloud infrastructure, hosting and storageUpdatesView all
Compliance
SOC 2 Type II Report Refreshed
Published Jul 15, 2026
Our updated SOC 2 Type II report is now available in the Resources tab, covering the twelve-month period ending May 2026 with no exceptions noted.
AI Governance
Published Responsible AI Framework v1.0
Published Jun 30, 2026
The framework covers agent action approval, reasoning audit logging, hallucination detection and how customers can configure oversight for their own workflows.
Security
Completed Annual Penetration Test
Published Jun 18, 2026
The assessment covered the core platform, agent orchestration layer and customer-facing APIs. An executive summary is available under NDA in the Resources tab.
Infrastructure
Added Azure Sweden Central Region
Published Jun 2, 2026
EU-resident customers can now request data residency in Sweden Central alongside our existing EU-West option.
Controls
Infrastructure security
Control
Unique production database authentication enforced
The company requires authentication to production datastores to use authorized secure authentication mechanisms, such as unique SSH keys.
Encryption key access restricted
The company restricts privileged access to encryption keys to authorized users with a business need.
Unique account authentication enforced
The company requires authentication to systems and applications to use a unique username and password or an authorized SSH key.
Production application access restricted
System access to production applications is restricted to authorized personnel only.
Access control procedures established
The company’s access control policy documents the requirements for adding, modifying, and removing a user’s access.
Production database access restricted
The company restricts privileged access to databases to authorized users with a business need.
Firewall access restricted
The company restricts privileged access to the firewall to authorized users with a business need.
Production OS access restricted
The company restricts privileged access to the operating system to authorized users with a business need.
Production network access restricted
The company restricts privileged access to the production network to authorized users with a business need.
Access revoked upon termination
The company completes termination checklists to ensure that access is revoked for departing employees within service level agreements.
Agent runtime isolation enforced
The company isolates each customer’s agent workloads using tenant-scoped compute boundaries to prevent cross-tenant access.
Redundant infrastructure maintained
The company deploys production infrastructure across multiple availability zones to maintain uptime during localized failures.
1 to 10 of 12 results
Organizational security
Control
Asset disposal procedures utilized
The company has electronic media containing confidential information purged or destroyed in accordance with best practices, and certificates of destruction are issued for each device destroyed.
Production inventory maintained
The company maintains a formal inventory of production system assets.
Portable media encrypted
The company encrypts portable and removable media devices when used.
Anti-malware technology utilized
The company deploys anti-malware technology to environments commonly susceptible to malicious attacks and configures this to be updated routinely, logged, and installed on all relevant systems.
Employee background checks performed
The company performs background checks on new employees, where permitted by local law.
Code of Conduct acknowledged by contractors
The company requires contractor agreements to include a code of conduct or reference to the company code of conduct.
Code of Conduct acknowledged by employees and enforced
The company requires employees to acknowledge a code of conduct at the time of hire. Employees who violate the code of conduct are subject to disciplinary action.
Confidentiality Agreement acknowledged by contractors
The company requires contractors to sign a confidentiality agreement at the time of engagement.
Confidentiality Agreement acknowledged by employees
The company requires employees to sign a confidentiality agreement during onboarding.
Performance evaluations conducted
Company managers are required to complete performance evaluations for direct reports at least annually.
Security awareness training completed
The company requires employees to complete security awareness training upon hire and at least annually thereafter.
1 to 10 of 11 results
Product security
Control
Data encryption utilized
The company’s datastores housing sensitive customer data are encrypted at rest.
Control self-assessments conducted
The company performs control self-assessments at least annually to gain assurance that controls are in place and operating effectively. Corrective actions are tracked to completion.
Penetration testing performed
The company’s penetration testing is performed at least annually. A remediation plan is developed and changes are implemented in accordance with SLAs.
Data transmission encrypted
The company uses secure data transmission protocols to encrypt confidential and sensitive data when transmitted over public networks.
Vulnerability and system monitoring procedures established
The company’s formal policies outline the requirements for vulnerability management and system monitoring.
Agent action approval enforced
The company requires configurable approval checkpoints before an AI agent executes sensitive actions, such as refunds or account changes.
Reasoning audit logging enabled
The company logs agent reasoning steps and tool calls to provide customers an auditable record of agent decisions.
Prompt injection defenses tested
The company performs regular red-team testing against prompt injection and adversarial input attacks on agent workflows.
Hallucination detection implemented
The company applies grounding checks and confidence scoring to flag low-confidence agent responses before they reach a customer.
Internal security procedures
Control
Continuity and Disaster Recovery plans established
The company has Business Continuity and Disaster Recovery plans in place that outline communication plans in order to maintain information security continuity in the event of the unavailability of key personnel.
Continuity and Disaster Recovery plans tested
The company has a documented Business Continuity and Disaster Recovery plan and tests it at least annually.
Cybersecurity insurance maintained
The company maintains cybersecurity insurance to mitigate the financial impact of business disruptions.
Configuration management system established
The company has a configuration management procedure in place to ensure that system configurations are deployed consistently throughout the environment.
Change management procedures enforced
The company requires changes to software and infrastructure components of the service to be authorized, formally documented, tested, reviewed, and approved prior to being implemented in the production environment.
Production deployment access restricted
The company restricts access to migrate changes to production to authorized personnel.
Development lifecycle established
The company has a formal systems development lifecycle methodology in place that governs the development, acquisition, implementation, and maintenance of information systems and related technology.
Whistleblower policy established
The company has established a formalized whistleblower policy, and an anonymous communication channel is in place for users to report potential issues or fraud concerns.
Backup processes established
The company’s data backup policy documents requirements for backup and recovery of customer data.
System changes externally communicated
The company notifies customers of critical system changes that may affect their processing.
Incident response plan established
The company maintains an incident response plan that defines roles, responsibilities, and communication procedures during a security incident.
Vendor risk assessments conducted
The company performs risk assessments of external service providers and vendors prior to engagement and at least annually thereafter.
Risk assessments performed at least annually
The company conducts a formal risk assessment at least annually to identify threats that could impair information security commitments.
1 to 10 of 13 results
Data and privacy
Control
Data retention procedures established
The company has formal retention and disposal procedures in place to guide the secure retention and disposal of company and customer data.
Customer data deleted upon leaving
The company purges or removes customer data containing confidential information from the application environment, in accordance with best practices, when customers leave the service.
Data classification policy established
The company has a data classification policy in place to help ensure that confidential data is properly secured and restricted to authorized personnel.
Customer data isolation enforced
The company logically isolates each customer’s data using tenant-scoped partitioning at the database and storage layer.
Data subject request process established
The company maintains a documented process for responding to data subject access, correction, and deletion requests within required timelines.
Model training exclusion enforced
The company does not use customer data to train or fine-tune underlying language models without explicit customer consent.
Data Processing Addendum available
The company makes a Data Processing Addendum available to customers describing the terms and safeguards applied to data processing.
Cross-border transfer mechanisms documented
The company documents the legal mechanisms used for cross-border transfers of personal data, including standard contractual clauses where applicable.
Data retention schedules enforced
The company enforces configurable data retention schedules for conversational and agent memory data on a per-tenant basis.
No controls match your search.
External Service Providers
OpenAI, L.L.C. • Underlying language model provider for select agent workflowsAnthropic, PBC • Underlying language model provider for select agent workflowsMicrosoft Corporation • Secondary cloud infrastructure and regional hostingAmazon Web Services, Inc. • Primary cloud infrastructure, hosting and storage
Gemini, Inc. • Underlying language model provider for select agent workflows
Stripe, Inc. • Billing and payment processing
Salesforce Inc. • CRM and Service Cloud integration for customer records, case management, and ticket synchronization
HubSpot Inc. • CRM integration for customer records, ticket context, and engagement history
Zoho Corporation Pvt. Ltd. • CRM integration for customer data synchronization and support workflows
Zendesk, Inc. • Customer support platform integration for ticket management and case synchronization
Shopify, Inc. • E-commerce platform integration for order management and customer purchase contextNo external service providers match your search.
Updates
Compliance
SOC 2 Type II Report Refreshed
Published Jul 15, 2026
Our updated SOC 2 Type II report is now available in the Resources tab, covering the twelve-month period ending May 2026 with no exceptions noted.
AI Governance
Published Responsible AI Framework v1.0
Published Jun 30, 2026
The framework covers agent action approval, reasoning audit logging, hallucination detection and how customers can configure oversight for their own workflows.
Read more
Security
Completed Annual Penetration Test
Published Jun 18, 2026
The assessment covered the core platform, agent orchestration layer and customer-facing APIs. An executive summary is available under NDA in the Resources tab.
Infrastructure
Added Azure Sweden Central Region
Published Jun 2, 2026
EU-resident customers can now request data residency in Sweden Central alongside our existing EU-West option.
Privacy
Updated Data Processing Addendum
Published May 20, 2026
The refreshed DPA clarifies retention timelines for agent memory data and documents the standard contractual clauses used for cross-border transfers.
General
New Subprocessor: Pinecone
Published May 5, 2026
Pinecone is being added to support vector-based knowledge retrieval for agent workflows. For more information, please visit the External Service Providers tab within this Trust Center.
Read more
Compliance
Achieved ISO/IEC 42001:2023 Certification
Published Apr 22, 2026
ISO/IEC 42001 is the international standard for AI management systems. Our certificate is available in the Resources tab under 3rd Party Assessments and Certifications.
AI Governance
Published AI Governance Policy
Published Apr 8, 2026
The policy documents our approval workflows, monitoring practices and escalation paths for agentic actions taken on behalf of customers.
Security
Security Whitepaper Updated
Published Mar 25, 2026
The updated whitepaper reflects our current production architecture, encryption standards and incident response practices.
General
Trust Center Launched
Published Mar 10, 2026
From here you can review our compliance certifications, browse security controls, see our subprocessor list and subscribe to future updates.