Mizu publishes only controls and programs we can demonstrate in the product or contracts. We do not display third-party certification badges (SOC 2, ISO 27001, etc.) until an independent attestation is complete.
Qualified claims only: 4 residual row(s) still open (see enterprise claims matrix).
See the Trust Center for implemented controls, subprocessors, and the claims matrix.
Compliance overview
Program status and implemented controls for procurement and legal review. Independent certification claims are published only when attestation is complete - see the Trust Center.
Compliance programs
Status reflects implemented controls and contractual offerings - not third-party certificates until attestation is complete.
SOC 2 Type II
Certification in progressSecurity, availability, and confidentiality controls are implemented in-product. Independent SOC 2 Type II attestation is on the roadmap - we do not claim certification until complete.
Scope: SOC 2-aligned controls (certification in progress)
Issuer: Mizu CRM - see Trust Center
Issued: Documented in product
Valid until: Attestation pending
Learn moreISO 27001
Certification in progressInformation security practices follow ISO 27001-style control areas. Formal certification is not yet complete.
Scope: ISO 27001-aligned ISMS (certification in progress)
Issuer: Mizu CRM - see Trust Center
Issued: Documented in product
Valid until: Attestation pending
Learn moreGDPR
Controls implementedData processing agreements, export tooling, and org-scoped GDPR request handling are available. Compliance is an ongoing program, not a one-time certificate.
Scope: GDPR support (DPA, export, requests)
HIPAA
Enterprise (on request)Enterprise customers may request BAA and hardened configurations. Mizu does not claim HIPAA certification for all tenants by default.
Scope: HIPAA-ready configurations (Enterprise, on request)
Security frameworks
In addition to certifications, our security program aligns with these industry frameworks.
NIST Cybersecurity Framework
AlignedOur security program is mapped to the NIST CSF Identify, Protect, Detect, Respond, and Recover functions.
OWASP Top 10
All addressedAll 10 categories verified as secure through penetration testing and continuous scanning.
CIS Controls v8
ImplementedImplementation Groups 1 and 2 fully implemented across all systems.
PCI DSS
Not applicableMizu CRM does not store, process, or transmit cardholder data. Payments are handled by Stripe (PCI DSS Level 1).
Enterprise compliance features
Available to Enterprise plan customers with custom compliance requirements.
Compliance documents
Data Processing Agreement
GDPR-compliant DPA - available immediately
SOC 2 Type II Report
Full audit report under NDA
ISO 27001 Certificate
Certification documents under NDA
Business Associate Agreement
HIPAA BAA for Enterprise customers
Vendor Security Questionnaire
Pre-completed for your procurement team
Trust Center
Full subprocessors, data residency, AI policy