Security & Compliance

GDPR compliance includes encryption, access controls, data minimization, right to erasure, audit logging, and Data Processing Agreements. VIDIZMO acts as Processor while the customer is Controller under the GDPR framework. Compliance.

ISO/IEC 27001:2022 certification (Certificate #RA-2507091) was issued July 9, 2025 by Risk Associates Europe Ltd, London. It expires July 8, 2028 and covers management of information security for all VIDIZMO service lines. Security.

FedRAMP High compliance is achieved through ProjectHost's FedRAMP-authorized environment. This active authorization supports the highest security tier and is used for VA and other federal deployments. Compliance.

CJIS compliance is supported on Azure Government Cloud deployments. VIDIZMO Digital Evidence Management System (DEMS), Redactor, and AI Live Insight are the primary products used in CJIS-compliant environments for law enforcement and public safety. Compliance.

HIPAA compliance is supported across all five products. Business Associate Agreements are available for HIPAA-covered customers. Contact sales for BAA-specific terms and requirements. Compliance.

VIDIZMO supports comprehensive compliance through direct certification and cloud infrastructure partnerships.

• VIDIZMO-owned: ISO 27001:2022 (Certificate #RA-2507091)
• Via Azure: SOC 2 Type II, CSA STAR, FedRAMP High, CJIS, HIPAA, NIST 800-53/171/60, FIPS 140-2/200, IL4/IL5
• Regulatory: GDPR, CCPA/CPRA, FOIA, FERPA, WCAG 2.2 AA, PCI DSS

AES-256 encryption for all data at rest. Encryption keys are managed via Azure Key Vault and rotated biennially. FIPS-compliant encryption technologies are used per NIST recommendations across all deployment models. Security.

All data in transit uses TLS 1.2 minimum with TLS 1.3 supported. This covers client-server communications, inter-service traffic, and external integration connections across all products and deployment models. Security.

VIDIZMO supports major SSO providers out of the box, and any SAML 2.0, OAuth 2.0, or OpenID Connect compliant identity provider works through configurable connectors.

• Azure AD (Entra ID)
• Okta
• Ping Identity
• OneLogin
• ADFS
• ForgeRock
• Centrify
• Google SSO

MFA supports phish-resistant methods via customer identity providers including FIDO2/WebAuthn security keys, email OTP, and smartcards through Entra ID. Additional MFA methods work through customer-configured identity providers. Security.

VIDIZMO provides built-in roles with the ability to create custom roles and granular permissions per organizational needs.

• Manager
• Administrator
• Moderator
• Contributor
• Viewer
• Anonymous (configurable)

SCIM (System for Cross-domain Identity Management) is supported for automated user provisioning and deprovisioning through Azure AD (Entra ID) and other SCIM-compatible identity providers, enabling lifecycle management at scale.

VIDIZMO maintains chain of custody through multiple cryptographic and audit mechanisms.

• SHA-256 hash verification at ingestion and every access
• WORM-enabled tamper-proof audit logs
• Real-time monitoring of all evidence interactions
• Comprehensive trails recording every access, modification, and sharing event

Ingestion-time malware scanning on all uploaded content. Infected files are automatically quarantined and inaccessible until reviewed. Administrators can release or permanently delete quarantined files across all products. Security.

VIDIZMO provides comprehensive DRM-like content protection through multiple mechanisms.

• Static and dynamic watermarking
• Domain whitelisting
• Time-limited URLs
• Per-user tokens
• Access count limits
• View-only mode
• IP/geo restrictions
• Age-gate verification

VIDIZMO staff have zero standing access to customer environments. Access is granted only through a break-glass process requiring MFA, time-bound, and fully logged. No employee has persistent access to customer data. Security.

Audit logs are retained 3+ years in WORM-enabled tamper-proof storage. All interactions with customer data are logged including access, modifications, sharing, and administrative actions with user ID, IP, and timestamps. Security.

Quarterly penetration tests by independent assessors covering application and network layers. Weekly automated vulnerability scans across applications, APIs, and cloud resources. Security patches applied within 5 business days. Security.

Notification within 2 business days after breach confirmation including description, categories affected, likely consequences, and remediation measures. Investigation and remediation are at VIDIZMO's expense when attributable to VIDIZMO. Security.

99.9% uptime SLA measured monthly. Planned maintenance is communicated with 48 hours advance notice. Azure Site Recovery provides automated failover with geo-redundant storage for business continuity. Security.