Written Information Security Program (WISP)

Last Updated: June 28, 2026

1. Objective

The objective of this Written Information Security Program (WISP) is to establish comprehensive administrative, technical, and physical safeguards for the protection of Non-Public Personal Information (NPI) collected, stored, or processed by Zone OS CRM, LLC in accordance with the FTC Safeguards Rule, NJDPA, CCPA, and applicable privacy regulations.

2. Designation of Information Security Coordinator

Zone OS has designated a Chief Information Security Officer (CISO) who is responsible for implementing, maintaining, and overseeing this WISP. The coordinator shall review the program annually and update it as necessary in response to material changes to our business operations.

3. Risk Assessment

Zone OS regularly conducts risk assessments to identify internal and external risks to the security, confidentiality, and integrity of NPI. This includes evaluating risks in employee training, information systems (network, software design, information processing), and detecting/preventing system failures.

4. Safeguards Implementation

  • Access Controls: Strong authentication (MFA) and least-privilege access are enforced for all employees.
  • Data Encryption: All NPI is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption.
  • Multi-Tenancy Isolation: Stringent tenant-isolation boundaries are maintained within Firestore via deterministic security rules.
  • Audit Logging: A SHA-256 cryptographic WORM (Write Once, Read Many) log captures all compliance-critical operations, including DSARs.

5. Service Provider Oversight

Zone OS ensures all third-party service providers capable of accessing NPI maintain safeguards in compliance with the FTC Safeguards Rule. Our primary sub-processors (Google Cloud, Stripe) undergo annual SOC 2 Type II audits.

6. Incident Response Plan

Zone OS maintains a formal Incident Response Plan to respond to unauthorized access or disclosure of NPI. In the event of a breach, Zone OS will notify affected Data Controllers (tenants) without unreasonable delay and in compliance with all applicable notification statutes.

7. Ongoing Training

All personnel with access to NPI undergo mandatory security awareness and privacy compliance training upon hire and annually thereafter.

8. Contact Information

For questions or concerns regarding this WISP, please contact our security team at security@zone-os.co.