Data Privacy & Security Brief

Gazzebo’s security brief for procurement reviewers: data protection, privacy practices, access controls, platform security, and compliance posture.

• Data protection: encryption in transit and at rest, logical tenant isolation, and server-side session storage.
• Privacy practices: data minimization, customer ownership, retention policies, and no training of external foundation models on customer content.
• Access controls: role-based authorization, multi-factor authentication, and brute-force resistance.
• Platform security: application hardening, monitoring, audit logging, and documented incident response.
• Compliance posture: controls engineered against SOC 2 Trust Services Criteria; formal Type I audit is in preparation, not a completed Gazzebo certification.
• GDPR- and CCPA/CPRA-aligned consent and data-subject-rights handling, with a standard Data Processing Addendum available.