Security, privacy and compliance, explained
Banks, fintechs, travel companies and other partners ask careful questions before they connect to a platform. This page explains, in plain language, what each mark on the Zetexa website means and what Zetexa says about it.
Not every mark is the same kind of thing
An audit report, a law, a security test and a regulator answer different questions, so it helps to know which is which before comparing them.
Independent audit report
SOC 2
An outside auditor tests a company's controls and writes a report.
Law
GDPR
A legal duty for anyone who handles the personal data of people in the EU. There is no certificate.
Security test
VAPT
Specialists try to break in, under agreed rules, and report what they find.
Regulator
FCC, CRTC, DoT
A government body that licenses and sets rules for telecom services in its country.
SOC 2 (AICPA)
- Kind
- Independent audit report
- Set by
- AICPA (United States)
- Applies to
- Service companies that handle customer data
- Certificate?
- No, a report
What it is
SOC 2 is a reporting framework from the American Institute of Certified Public Accountants (AICPA). An independent CPA firm examines how a service company designs and operates the controls that protect its customers' data, and writes a report on what it found.
The examination is measured against the AICPA Trust Services Criteria. Security is always in scope. Availability, processing integrity, confidentiality and privacy can be added.
Good to know
- It is an attestation report, not a certificate or a licence.
- A Type I report describes whether the controls were designed suitably on a single date.
- A Type II report tests whether the controls operated effectively over a period of time, commonly several months.
- The report is written for the company's customers, so the full text is normally shared under a confidentiality agreement.
The five Trust Services Criteria
- Security
- Protection against unauthorised access. Always included.
- Availability
- Systems are up and usable as agreed.
- Processing integrity
- Processing is complete, valid and accurate.
- Confidentiality
- Information marked confidential is protected.
- Privacy
- Personal information is handled as promised.
How to read a SOC 2 report
- 1Check the type (I or II) and the period it covers.
- 2Read the auditor's opinion. An unqualified opinion is a clean one.
- 3Check which criteria are in scope. Security is always there; the rest are optional.
- 4Read the system description to see what was actually examined.
- 5Look at any exceptions: tests where a control did not work as described, and the company's response.
- 6Note the complementary user entity controls, the things the customer must do on its own side.
Zetexa
Zetexa states that it holds SOC 2 Type II.
GDPR (General Data Protection Regulation)
- Kind
- European Union law
- Set by
- European Union
- Applies to
- Anyone handling personal data of people in the EU
- Certificate?
- No official certificate
What it is
The GDPR is Regulation (EU) 2016/679, the European Union's data-protection law, in force since 25 May 2018. It applies to any organisation that handles the personal data of people in the EU, wherever the organisation is based.
It sets principles for handling personal data and gives people rights over their data. The United Kingdom has its own version, the UK GDPR, alongside the Data Protection Act 2018.
Good to know
- There is no official GDPR certificate. A company shows compliance through how it handles data: its records, contracts, security measures and how it answers people's requests.
- A personal-data breach that is likely to put people at risk has to be reported to the supervisory authority, where feasible within 72 hours.
- For the most serious infringements, fines can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher.
The seven principles
- Lawfulness, fairness and transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
The rights people have over their data
- To be informed
- Access
- Correction
- Erasure
- Restriction
- Portability
- Objection
- No solely automated decisions
Who is who
- Controller
- Decides why and how personal data is processed.
- Processor
- Processes personal data on the controller's behalf. A data-processing agreement sets out the rules between them.
- Transfers
- Sending personal data outside the EU needs a legal basis, such as an adequacy decision or standard contractual clauses.
VAPT (Vulnerability Assessment and Penetration Testing)
- Kind
- Security test
- Set by
- No single body
- Applies to
- Any platform, API or application
- Certificate?
- No, a test report
What it is
VAPT combines two kinds of security testing. A vulnerability assessment scans systems for known weaknesses, such as outdated software or misconfiguration. A penetration test goes further: security specialists try to exploit weaknesses, under rules agreed in advance, to show what a real attacker could actually reach.
The result is a report that lists the findings by severity, so the company can fix them and confirm the fixes with a re-test.
Good to know
- VAPT is a type of test, not a standard or a certificate. What it means depends on who tested, what was in scope and when.
- A single test is a snapshot. Good practice is to repeat it regularly and after major changes to the platform.
- Findings are usually rated critical, high, medium, low or informational, often with the CVSS scoring system.
- Testers usually follow public methods such as the NIST guide to security testing (SP 800-115) or the OWASP testing guide.
How a test usually runs
- 1Scope and rules: what is tested, when, and how far the testers may go.
- 2Discovery: map the system and scan for known weaknesses.
- 3Exploitation: try to use the weaknesses to reach data or systems.
- 4Report: the findings, each with a severity and advice on how to fix it.
- 5Fixes: the company repairs the issues.
- 6Re-test: the testers confirm that the fixes work.
What can be in scope
- Web applications
- APIs
- Servers and networks
- Cloud configuration
- Mobile apps
Zetexa
Zetexa states that its platform is VAPT tested.
FCC (Federal Communications Commission)
- Kind
- Regulator
- Country
- United States
- Covers
- Radio, television, wire, satellite and cable
- Certificate?
- Not for providers
What it is
The FCC is the independent United States government agency that regulates communications by radio, television, wire, satellite and cable. It was created by the Communications Act of 1934. Telecommunications providers that serve the United States have to follow its rules.
Good to know
- The FCC is a regulator. For a telecom provider, "FCC" means meeting the FCC's rules for the services it offers. This is separate from the FCC equipment authorisation that devices carry.
- Which rules apply depends on the service. For a mobile virtual network operator (MVNO), they cover the telecom service it provides to customers in the United States.
What the FCC oversees
- Radio and television broadcasting
- Wired and wireless telephone and broadband services
- Satellite and cable communications
- Use of the radio spectrum
- Emergency communications such as 911
- Consumer protection in communications services
Zetexa
Zetexa lists USA FCC alongside its telecom licences in the USA.
CRTC (Canadian Radio-television and Telecommunications Commission)
- Kind
- Regulator
- Country
- Canada
- Covers
- Telecommunications and broadcasting
- Certificate?
- Not for providers
What it is
The CRTC is the independent public authority that regulates broadcasting and telecommunications in Canada. Telecommunications providers that serve Canada have to follow its rules.
Good to know
- Like the FCC, the CRTC is a regulator, not a certification body. A company meets its rules for the services it offers in Canada.
What the CRTC oversees
- Telecommunications services such as telephone, internet and mobile
- Broadcasting such as radio and television
- Consumer rules for retail services, for example the Wireless Code for mobile services
- How telecom networks are shared among providers
Zetexa
Zetexa lists CRTC Canada alongside its telecom licences in Canada.
DoT (Department of Telecommunications, India)
- Kind
- Government department
- Country
- India
- Covers
- Licensing and rules for telecom services
- Certificate?
- Not for providers
What it is
The Department of Telecommunications is the department of the Government of India that licenses telecom services and sets the rules for them in India.
Good to know
- The DoT is a government department, not a certification body. Its mark identifies the regulator, not an audit result.
- Tariffs and service quality are overseen by a separate body, the Telecom Regulatory Authority of India (TRAI).
Common questions
Is GDPR a certificate?
No. The GDPR is a law, and there is no official GDPR certificate. A company shows that it follows the law through how it handles personal data: its records, its contracts, its security measures and how it answers people's requests.
What is the difference between SOC 2 Type I and Type II?
A Type I report describes whether a company's controls were designed suitably on one date. A Type II report tests whether those controls actually worked over a period of time, commonly several months, so it carries more weight.
Is VAPT a certification?
No. VAPT is a type of security test. What a VAPT report is worth depends on who did the testing, what was in scope, when it was done, and whether the findings were fixed and re-tested.
Does an FCC or CRTC mark mean the same as an audit?
No. The FCC and the CRTC are regulators. The marks show which regulator's rules apply to a telecom provider. They are not audit results, and they say nothing about how a company protects data.
Can I see a full report?
Reports such as a SOC 2 report are written for a company's customers and are normally shared under a confidentiality agreement. If your team needs more detail for a review, ask the partner team through the contact page.
Where can I read how Zetexa handles personal data?
In the Privacy Policy on this site. It describes what personal data is collected, how it is used and shared, and the rights people have.
Questions about security, privacy or compliance?
Tell the partner team what you need to know and they will point you to the right person.