Security & Compliance
Security & Compliance
Zep provides security controls and compliance capabilities for enterprises handling sensitive data — certifications, customer-managed encryption, model credentials you control, and deployment models that move the trust boundary with your requirements.
SOC 2 Type II Certified — Zep maintains SOC 2 Type II certification. View our real-time compliance status at trust.getzep.com. Compliance reports and supporting documentation are available to Enterprise subscribers.
Role-based access control (RBAC), policy-based access control (ABAC), audit logs, and API logs live under Governance.
Application security
Zep retrieves context for your agent. Your application remains responsible for prompt construction, memory admission, tool permissions, and action authorization.
Compliance & encryption
Meet regulatory requirements and keep control over encryption keys and model provider credentials.
Guidelines for building healthcare applications that handle protected health information. Business Associate Agreements available for Enterprise customers.
Encrypt data at rest using your own AWS KMS Customer Master Key. Maintain full control over encryption keys, including revocation.
Use your own LLM provider credentials with OpenAI, Anthropic, Google, AWS Bedrock, or Azure. Apply your negotiated pricing and compliance commitments.
Deployment models
The trust boundary moves with your deployment. Choose where compute, data, and keys live.
Zep’s managed service. SOC 2 Type II certified, with HIPAA Business Associate Agreements available for Enterprise customers.
Zep’s managed service with encryption keys you control in your own AWS KMS account, including the ability to revoke access.
Zep deployed inside your own VPC for a full network and compliance boundary. Contact the Zep Enterprise team.