FOR SECURITY & COMPLIANCE TEAMS
YOUR CODE STAYS IN EUROPE
Written for the security review. What the agent sends out, where it is processed, what we keep, and which law can reach it, in terms you can check against our DPA.
SECURITY AT A GLANCE
The twelve answers a
security review starts with.
If a developer sent you this page, start here. Every answer below is one we confirm in writing, in our DPA, sub-processor list or your security questionnaire.
| Your data | Control and accountability |
|---|---|
DATA SENT OUTYour prompts, the files the agent reads for a task, and the session history of that task. | VENDORZooid, based in Gent, Belgium. European-owned, with no US parent and no US subsidiary. |
PROCESSED BYOpen-weight models on inference providers located in the EU, through Melious. No fallback outside the EU. | GDPR ROLEZooid acts as your processor under Article 28. You stay the controller. We sign a DPA. |
INFERENCE RETENTIONZero. Prompts and code are processed in memory and not logged. Our inference partner is bound to this by contract. | SUB-PROCESSORSEU-based only. You get the full list with locations, advance notice of any change, and the right to object. |
STORED BY ZOOIDAccount details, session history and logs, in EU data centres, encrypted in transit (TLS) and at rest. Kept until you delete them, per session or all at once. Session history can contain code excerpts and diffs. | AGENT PERMISSIONSRuns on the developer's machine with that developer's access. Every file read, edit and command is shown, and gated actions wait for approval. |
MODEL TRAININGNever. Not by us and not by our inference partner. The companies that make the models never receive your data. | CERTIFICATIONSNo ISO 27001 or SOC 2 report yet. Our controls follow ISO 27001 Annex A, and certification is on our roadmap. |
INCIDENTSIf a breach affects your data, we notify you within 48 hours of becoming aware, so you have time for GDPR's 72-hour deadline. | SECURITY CONTACTLuigi, co-founder and security officer. security@zooid.app reaches Luigi directly, not a ticket queue. |
STRAIGHT ANSWERS
The questions
you were going
to ask anyway.
The awkward ones, answered before you have to send them.
Your security review lands with me, not with sales. I answer every questionnaire myself.
security@zooid.appThe demo shows DeepSeek. Does our code go to China?
No. Open-weight means we run the model itself, on EU hardware, through Melious. DeepSeek, Mistral, Alibaba and the other model makers never receive a request, a prompt or a line of your code. They published the model; they are not in the loop.
No ISO 27001 yet. Why should we trust you?
Fair question. Our controls follow ISO 27001 Annex A, and certification is on our roadmap. Until then, the security pack shows how each control is implemented today, and you can ask us to evidence any of them.
What happens if something goes wrong?
If a breach affects your data, you hear from us within 48 hours of us becoming aware, with what happened, what was affected and what we are doing about it. That leaves you time for your own 72-hour GDPR notification.
We found a vulnerability. Where do we report it?
Email security@zooid.app. It reaches Luigi directly. We do not threaten researchers who report in good faith, and we will tell you when it is fixed.
JURISDICTION
Stored in the EU is not
the same as safe from US law.
Under the US CLOUD Act, a US provider can be ordered to hand over data in its “possession, custody, or control”, wherever that data is stored. For your risk assessment, who owns a provider matters as much as where its servers are.
| US-based provider, even in an EU region | Zooid | |
|---|---|---|
| Can a US court order reach your data? | US-based provider, even in an EU regionYes. Since 2018 the CLOUD Act lets US authorities compel US providers to disclose data in their possession, custody, or control, even when it is stored in the EU. | ZooidNo. There is no US parent or US subsidiary to serve that order on, and our sub-processors are European companies too. |
| Does an EU data centre protect you? | US-based provider, even in an EU regionNot on its own. In June 2025, Microsoft France told the French Senate under oath that it could not guarantee EU customer data would never be handed to US authorities. | ZooidIt does when the owner is European too. EU servers, run by EU companies, under EU law only. |
| Which law decides on foreign requests? | US-based provider, even in an EU regionBoth, and they conflict. US law can compel disclosure, while GDPR Article 48 only recognises foreign orders based on an international agreement. | ZooidEU law only. A foreign authority has to go through a mutual legal assistance treaty and a European court. |
| What about US intelligence surveillance? | US-based provider, even in an EU regionUS providers fall under US intelligence laws such as FISA Section 702. Those powers are why the EU’s top court struck down Privacy Shield in Schrems II (2020). | ZooidSection 702 cannot compel EU companies to hand anything over, and only EU companies process your prompts and code. |
| Is the legal basis for transfers stable? | US-based provider, even in an EU regionTransfers rely on the EU–US Data Privacy Framework, the third attempt after Safe Harbor and Privacy Shield were struck down. Its validity is now on appeal at the EU Court of Justice. | ZooidNot needed. Nothing is transferred to the US, so there is no transfer mechanism to depend on, or to lose. |
A plain-language summary, not legal advice.
Sources: US CLOUD Act (2018), 18 U.S.C. § 2713 · GDPR Article 48 · CJEU C-311/18, Schrems II (2020) · EU General Court T-553/23, Latombe (2025), on appeal as C-703/25 P · French Senate inquiry hearing, 10 June 2025
REGULATIONS
What each law asks,
and what you can show.
Five EU laws shape how your organisation can use a coding agent. For each: what it actually requires, and the evidence Zooid gives you for your records.
GDPR
Regulation (EU) 2016/679
Source code, commits and tickets often contain personal data. Using a vendor to process it requires an Article 28 contract, and Article 48 limits foreign court orders.
You get a DPA with Zooid as processor, an EU-only sub-processor list, and no third-country transfers to assess.
EU AI Act
Regulation (EU) 2024/1689
A coding agent is not a high-risk system, so the heaviest obligations do not apply. Article 4 does ask you, as deployer, to make sure staff understand the AI they use.
You get plain-language documentation of how the agent works, what it cannot do and where a human must approve, ready for your AI literacy training.
NIS2
Directive (EU) 2022/2555
Article 21 asks entities in scope to manage supply-chain risk, including the security practices of every supplier that touches their code.
You get answers to your supplier questionnaire, our DPA, and session history as an audit trail of what the agent read, changed and ran.
EU Data Act
Regulation (EU) 2023/2854
Since September 2025, Article 32 requires data processing services to prevent unlawful third-country government access to non-personal data, such as source code.
You get a vendor chain that sits entirely under EU jurisdiction, so a foreign order has no one to land on.
DORA
Regulation (EU) 2022/2554
Since January 2025, banks, insurers and other financial entities must manage ICT third-party risk: set contract terms, a register of ICT providers, and an exit plan for each.
You get the details for your register of information, a DPA you can extend with Article 30 terms, and session data you can delete at any time for a clean exit.
Your own rulebook
Sector or national rules
Healthcare, defence and the public sector often add rules of their own, and so do internal security policies. Send us the requirement, and we will map Zooid against it in your questionnaire.
security@zooid.app
Need it in writing?
Request our security pack: the DPA, sub-processor list, ISO 27001 control mapping and standard questionnaire answers. Or send your own questionnaire, and Luigi, our security officer, fills it in personally.