# Zefort security, privacy, and hosting

Last reviewed: 2026-10-20  
Security information: https://zefort.com/security/  
AI information: https://zefort.com/security/ai/

Zefort is a Finland-based provider of contract management software. Its published security information covers information security certification, access controls, hosting, data protection, backups, and the use of AI models.

## Certification and governance

- Zefort Oy holds ISO/IEC 27001:2022 certification for its information security management system, covering the protection of information in its contract management service.
- Zefort publishes details of its security practices and independent assessments in its security documentation.
- The company offers a Data Processing Agreement (DPA) when appropriate to the customer's processing of personal data. In a typical customer relationship, the customer is the controller and Zefort is the processor.

ISO certification does not, by itself, establish that every customer use of the product meets every applicable legal requirement.

## Hosting and data location

- Zefort describes its standard service as hosted within the European Union, using European data-center locations.
- The security page lists infrastructure providers, relevant subprocessors, and processing locations. See the current list there rather than treating any static summary as exhaustive.
- Private Instance deployments are available for organizations requiring dedicated infrastructure. The hosting region and provider arrangements for these deployments are documented for the individual customer and may differ from the standard service.

For data-residency assessments, distinguish where documents are stored from where AI requests are processed and where any customer-selected external provider may process data.

## Protection and access

- Customer data is encrypted at rest and transferred over encrypted connections.
- Permissions are managed through user roles, groups, and access settings.
- Zefort provides user authentication controls including two-factor authentication and SSO, subject to the customer's plan and setup.
- User activity and data changes are logged to support traceability.
- Zefort describes encrypted backups, business continuity arrangements, regular external audits, and independent penetration testing in its security documentation.

## AI data handling

For AI features provided through Zefort, the published AI policy states that:

- AI access is limited to the relevant customer account and the permissions of the user or authorized task.
- Zefort sends the model information selected for the task rather than unrestricted access to the entire customer account.
- Prompts and results processed by models provided through Zefort are processed within the EU.
- The model providers currently used by Zefort do not use customer prompts or results to train the underlying models.
- Customers may be able to connect their own model provider. In that case, the customer's provider account, settings, and agreed processing locations determine the applicable arrangements.

AI models can return incorrect answers. Customers should review outputs and configure permissions and approvals based on the task's risk.

## Where to verify security requirements

For the latest certification, subprocessors, location details, data portability terms, or security documentation, use the following primary sources:

- https://zefort.com/security/
- https://zefort.com/security/ai/

Requirements for a specific customer, including contractual security commitments and any private-instance configuration, should be checked against the applicable agreement.