GPTZero’s Privacy, Security, Compliance and Certifications
At GPTZero, we prioritize protecting the privacy of all of our users and the integrity of their data being at the core of everything we do. Everything from how we design our systems to how we handle customer information, we adhere to strict data protection policies that were designed to align with global privacy regulations. Our systems are set up to ensure that sensitive information is appropriately labeled, encrypted and only retained for as long as needed.
Security is not an afterthought at GPTZero, it is embedded into our culture and development lifecycle. We have created our secure Software Development Life Cycle to guarantee security is rooted from the start. We perform regular vulnerability scans, penetration testing, and enforce strong access controls with MFA across all systems. Our incident response plan ensures we are prepared to detect, respond to, and recover from any security event swiftly and transparently.
Compliance is a continual process, and we've built our security program to meet the standards of SOC 2 and other industry frameworks. All employees undergo annual security training, our vendors are held to strict data protection standards, and our infrastructure is continuously monitored and audited using tools like Drata. Every policy from encryption to vendor management is designed with audibility and accountability in mind.
We are committed to transparency and welcome responsible security research from the community. Our Responsible Disclosure Policy provides a safe and structured way for researchers to report potential vulnerabilities, and we act quickly to validate and remediate legitimate issues. Together, privacy, security, and compliance are not just checkboxes they are commitments we uphold to earn and maintain your trust.
GPTZero's Trust Center is continuously monitoring its overall security posture.
GPTZero's Security Monitoring
SOC 2
We are very proud to share that we are SOC 2 Type II compliant. Having gone through multiple audits to verify our commitment to strong security, availability and confidentiality controls. We have ensured continuous monitoring and have utilized automated compliance tools like Drata to better allow us to ensure data is protected at every layer of our service.
CCPA
The California Consumer Privacy Act (CCPA) is meant to ensure that customers have clear rights over their data. By being fully compliant with these standards we have further been able to allow full for users to access and delete their information at will. Our privacy practices are by design are built to meet CCPA requirements.
GDPR
We have designed our systems to be in compliance with the General Data Protection Regulation (GDPR). At GPTZero we prioritize users privacy by making sure we implement strong data protection measures, supporting data access deletion requests, and limiting data processing to only what is necessary. Our policies and infrastructure were created to enable and uphold the rights of all individuals across all of our services.
FERPA
GPTZero is committed to supporting the education sector and complies with applicable U.S. Department of Education requirements for data privacy and security. We understand the critical importance of protecting student information and maintaining secure systems in academic environments. Our policies and controls are designed to align with federal education standards, ensuring that institutions can confidently use GPTZero in compliance with FERPA and other relevant guidelines.
HECVAT
We have completed multiple Higher Education Community Vendor Assessment Toolkit (HECVAT), ensuring our platform meets the rigorous security and privacy standards required by colleges and universities. By aligning with HECVAT, we make it easier for higher education institutions to evaluate our risk posture and trust that their data and the data of their students and faculty is protected. Supporting the academic community with secure, transparent practices is a top priority for us.
VPAT
At GPTZero we strongly believe that accessibility should be a fundamental part of all development. We believe everyone should have equal access to utilize our technology regardless of their disability. We have created an inclusive experience not to solely follow legal requirements but because it is the right thing to do. This is why we have completed our VPAT to validate our platform is built with accessibility in mind. From design we have followed standards like WCAG and Section 508 to ensure proper usability and accessibility for all.