Browse Trust Center documents
← Trust Center

Legal

Privacy & data

AI & safety

Security

Trust Center Security

Compliance

Where Zero Human AI stands on SOC 2, ISO/IEC 27001, ISO/IEC 42001, data protection laws in the GCC, EU, UK and US, the EU AI Act and content provenance, with dates.

Last updated 16 October 2026

The short version

  • Ori is in pilot. We’d rather show an honest roadmap with dates than badges we haven’t earned.
  • Data protection: aligned with GDPR, CCPA/CPRA and the UAE, Saudi and Bahrain laws, with a DPA available now.
  • SOC 2 Type I is in progress, targeted for Q1 2027; ISO/IEC 27001 and 42001 are targeted for 2027.

1. Certifications and audits#

FrameworkStatusWhen
SOC 2 Type IIn progressReport targeted Q1 2027
SOC 2 Type IIPlannedReport targeted Q3 2027
ISO/IEC 27001 (information security)PlannedTargeted 2027
ISO/IEC 42001 (AI management)PlannedTargeted 2027
Independent penetration testScheduledBefore general availability
C2PA content credentialsLive in pilotOn every export

Every date here is a commitment. When one moves, we update this page.

2. Laws and regulations#

LawHow we address it
UAE Federal Decree-Law No. 45 of 2021 (PDPL)Privacy Policy, DPA, data residency in the GCC
Saudi Personal Data Protection LawPrivacy Policy, DPA, data residency in the GCC, transfer safeguards
Bahrain Law No. 30 of 2018 (PDPL)Privacy Policy, DPA
Qatar, Oman and Kuwait data protection lawsPrivacy Policy rights and transfer safeguards
GDPR and UK GDPRPrivacy Policy, DPA with standard contractual clauses, EU data residency on Enterprise
CCPA/CPRA and other US state privacy lawsPrivacy Policy; no sale or sharing for targeted advertising; DPA service-provider terms
EU AI ActMachine-readable marking of every output; disclosure tools for customers; training-content summary before general-purpose release in the EU
Advertising rules of each market and platformUsage Policy, per-market checks, platform AI labels

3. Documents for your review#

  • Security overview
  • Penetration-test summary (under NDA)
  • Data Processing Addendum
  • Named subprocessor list (under NDA)
  • Security questionnaire (CAIQ Lite)
  • AI governance statement
Request documentsSecurity overview, DPA, penetration-test summary, CAIQ Lite and more. We reply within two business days.
Request →
SecuritySecurityHow Zero Human AI protects Ori and your data: infrastructure, encryption, access control, application and sign-in security, monitoring, vulnerability management, incident response and business continuity.LegalData Processing AddendumA summary of the Data Processing Addendum that governs personal data Zero Human AI processes on behalf of customers, and how to get a signed copy.AI & safetyResponsible AI & model governanceHow Zero Human AI builds, tests, releases and monitors Origin, the video model behind Ori: principles, release gates, evaluations, red-teaming, training-data governance and regulatory alignment.

Questions about this document? Write to security@zerohuman.co.