Understand theassurance evidencebehind the controls.
Clear scope, currency and access rules. See which reports are available, request access to restricted documents, and understand what each assessment covers.
View available reports
Request accessAssurance artifact distinctions
Audit Reports
Independent assessments of controls, processes, and systems during a specific period. Historical and scoped.
Certifications
Current, ongoing validations against standards. Real-time or periodic re-assessment with continuous controls.
Compliance Reviews
Assessment against specific regulations (GDPR, HIPAA, SOX). May be customer-conducted or third-party verified.
Security Assessments
Penetration testing, vulnerability scanning, or red team exercises. Time-bound findings and remediation tracking.
Available audit reports
SOC 2 Type II Report
January 1, 2024 – December 31, 2024
PUBLICLY LISTED
Download PDF
View summaryISO 27001 Certification Report
Certified January 15, 2024PUBLICLY LISTED
Certification detailsGDPR Data Processing Assessment
April 2024
REQUEST ACCESSAnnual Penetration Test Report
Q4 2024
SUPERSEDEDUnderstanding report scope & currency
Report Period
What it means:
The audit covers specific dates. Evidence is from those dates only.
Example:
SOC 2 Type II: “Jan 1 – Dec 31, 2024” means testing occurred during that year.
⚠️ Important:
Does NOT guarantee current state. Policies or systems may have changed.
Report Scope
What it covers:
Only the systems and controls explicitly listed in the report.
Example:
SOC 2 may cover “cloud infrastructure” but exclude “mobile app” or “partner integrations.”
⚠️ Important:
Out-of-scope areas are not assessed. Review the full report for coverage limits.
How audit reports are managed
1. Plan
Annual audit scheduled. Scope and objectives defined.
2. Assess
Auditor examines controls and processes. Interviews and testing conducted.
3. Report
Formal findings and opinions issued. Remediation noted.
4. Registry
Report listed with metadata. Access controlled per policy.
5. Share
Authorized users can access. Requests logged and reviewed.
Request restricted report access
How it works: Submit your request below. Our trust team will review your organization and purpose, then approve or deny access. You'll receive a secure download link or document portal access.
What happens next? You'll receive a confirmation email within 24 hours. Approval typically takes 2–3 business days. Access is managed securely with audit logging.
What audit reports do & don't tell you
What they DO show
Control existence & design
Whether controls are documented and implemented
Compliance status
Adherence to stated standards and frameworks
Identified weaknesses
Gaps and areas requiring remediation
Historical evidence
Proof of controls during the audit period
What they DON'T show
Current state guarantee
Systems may have changed since the audit date
Fiscal accuracy or legal responsibility
Audits do not verify financial claims or legal liability
Complete jurisdiction coverage
May only cover specific regions or data centers
Evidentiary admissibility
Legal weight depends on your jurisdiction and case
Frequently asked questions
Find answers to common questions about Zoiko iD
Ready to review assurance evidence?
Browse publicly available reports above, request access to restricted documents, or contact our trust team with questions.
Contact trust team
Request report access