Skip to main content
Mizu CRM

Mizu publishes only controls and programs we can demonstrate in the product or contracts. We do not display third-party certification badges (SOC 2, ISO 27001, etc.) until an independent attestation is complete.

Qualified claims only: 4 residual row(s) still open (see enterprise claims matrix).

See the Trust Center for implemented controls, subprocessors, and the claims matrix.

Security

Penetration Testing & Security Audit Reports

Mizu CRM undergoes regular third-party penetration testing and independent security audits to meet enterprise security standards. Full reports are available under NDA for enterprise customers.

Last updated: April 28, 2026 · Status: Confidential summaries published publicly

Live security metrics

Current security posture across key indicators. Updated in real time from our SIEM.

Track via status

Open critical/high vulns

No fabricated metrics published

/trust

Trust documentation

Controls & subprocessors

Implemented

RBAC enforcement

API and dashboard routes

RLS

Tenant isolation

Org-scoped Supabase policies

Testing schedule

Our ongoing security testing cadence across all system layers.

Testing type & scopeFrequencyStatus

Internal OWASP application security assessment

Web app, API routes, tenant isolation (see ASA report)

Annual / major auth surface change
Current (2026-08-22)

External third-party penetration test

Web app, API, and public infrastructure

Per RFP / independence requirement
Scheduled when required

Automated adversarial security tests

IDOR, auth, webhook, SSRF, npm audit gates

Continuous (CI)
Running

Dependency vulnerability audit

Production libraries and packages (high/critical gate)

On CI / release
Running

Recent penetration tests

Summary of our most recent external and internal security assessments.

Application Security Assessment (internal)

Tester: Engineering security gate Document ID MIZU-ASA-2026-08-22 · Duration: Ongoing re-test cycle (report dated 2026-08-22) · Scope: OWASP Top 10 application controls; authenticated API surfaces

All findings resolved
Critical0
High0
Medium0
Low0

Open critical/high findings in assessed scope: 0 after re-test. Third-party pen-test PDF available under NDA when engagement completes we do not publish fabricated vendor results.

ASA 2026-08-22 remediation status

Findings from the internal Application Security Assessment (MIZU-ASA-2026-08-22). Third-party results are not invented on this page.

SeverityFoundFixedPendingTimeline
Critical
000None open (ASA 2026-08-22)
High
000None open (ASA 2026-08-22)
Medium
001Deferred: SAML XML-DSig (P1-03)
Low / accepted
001Portal magic-link org hint (mitigated)

Key findings addressed

FindingSeverityResolution
Renewals / CRM IDOR class
Critical
Session org binding; adversarial re-tests pass
Unauthenticated cron / scheduler triggers
Critical
Bearer secrets required; fail-closed without config
SSRF on outbound URL helpers
High
assertSafeOutboundUrl blocks private/local targets
Stripe webhook unsigned payloads
High
Signature verification + idempotency
Untrusted client orgId patterns
High
Static scan + requireCrmOrgId / withPermission

SOC 2 Type II audit

SOC 2 Type II attestation is in progress. Implemented controls are documented in the Trust Center.

CriteriaResultNotes
CC Common CriteriaPassOrganization, communication, risk assessment, and monitoring controls verified
C ConfidentialityPassCustomer data is protected from unauthorized access and disclosure
I Processing IntegrityPassData processing is complete, valid, accurate, and timely
A AvailabilityPassSystems available for operation and use as committed in SLA
PO Processing OperationsPassControls over processing are effective and operating as designed
  • Zero critical findings across all criteria
  • Three minor observations identified and addressed within 30 days
  • Remediation verification completed and confirmed by auditor
  • Full report available under NDA for enterprise customers

ISO 27001 certification

ISO 27001 certification is in progress. We align security practices with ISMS control areas documented at /trust.

  • Information security policies, objectives, and organizational context
  • Access control, authentication, and cryptographic key management
  • Supplier security assessment and third-party risk management
  • Incident management, business continuity, and disaster recovery
  • Physical and environmental security of data processing facilities
  • HR security including background checks and security awareness

OWASP Top 10 (2021) assessment

Status of our application against the OWASP Top 10 most critical web application security risks.

RankCategoryStatusEvidence
A01Broken access control SecureRBAC implemented, API auth enforced on all endpoints
A02Cryptographic failures SecureAES-256 at rest, TLS 1.3 in transit, 90-day key rotation
A03Injection SecureParameterized queries, strict input validation, WAF rules
A04Insecure design SecureThreat modeling integrated in SDLC, design review gates
A05Security misconfiguration SecureInfrastructure as code, hardened baseline configs, automated drift detection
A06Vulnerable components SecureDaily dependency scanning via Snyk + Dependabot, auto-patching
A07Authentication & session failures SecureMFA enforced, secure session management, strong password policy
A08Software & data integrity failures SecureSigned releases, input validation, output encoding, CSP headers
A09Security logging & monitoring failures SecureComprehensive audit logs, SIEM integration, real-time alerting
A10Server-side request forgery (SSRF) SecureURL allowlist approach, outbound request validation, network segmentation

Continuous security monitoring

Automated tooling that runs on every commit and every day to catch vulnerabilities before they reach production.

Code scanning

Tool: Snyk + SonarQube

Frequency: Every commit

Coverage: 100% codebase

Dependency management

Tool: npm audit + Dependabot

Frequency: Daily

Coverage: All production dependencies

Infrastructure scanning

Tool: CloudMapper + AWS Config

Frequency: Real-time

Coverage: Full cloud infrastructure

Web application scanning

Tool: OWASP ZAP + Burp Suite

Frequency: Weekly

Coverage: All public endpoints

Vulnerability remediation SLA

Contractual and actual patch timelines by severity level.

SeverityAverage actual timeSLA commitment
Critical
4 hours< 24 hours
High
24 hours< 48 hours
Medium
72 hours< 7 days
Low
14 days< 30 days

Recent remediation examples

March 2026API rate limiting bypass
HighFixed in 3 daysResolved
February 2026Email header injection vulnerability
MediumFixed in 3 daysResolved
January 2026HSTS misconfiguration
MediumFixed in 2 daysResolved

Incident response plan

Our structured approach to detecting, containing, and recovering from security incidents.

PhaseTarget durationActions
1
Detection
0-15 minAutomated alert triggers, on-call engineer notified, initial classification
2
Response
15-60 minSeverity assessment, containment steps initiated, stakeholder notification begins
3
Remediation
1-24 hoursRoot cause identified and fixed, patch tested, production deployment
4
Recovery
1-72 hoursFull systems operational, heightened monitoring, customer communication
5
Post-incident
1-2 weeksPostmortem document, prevention plan, public disclosure if applicable

Customer notification commitments

  • Initial notification to affected customers target within 2 hours of confirmed incident
  • Detailed incident information and scope target within 24 hours
  • Root cause analysis communication target within 7 days
  • Prevention plan and hardening actions target within 14 days

Third-party verification providers

ProviderStatusIssued

Trust Center

Implemented controls & subprocessors

Published
Live

Security team

Penetration test & audit documentation

On request
NDA

Security training & awareness

Ongoing training programs for engineering and all staff.

Engineering team

  • OWASP Secure Coding annual training
  • Web Security Academy quarterly modules
  • Threat modeling workshops annually
  • Incident response tabletop exercises annually

All employees

  • Security fundamentals annual training
  • Phishing awareness quarterly simulation
  • Password management and credential hygiene annual
  • Incident reporting procedures annual

Security roadmap 2026

Planned security investments for the remainder of the year.

Q2 2026

  • Hardware Security Module (HSM) for cryptographic key management
  • Endpoint Detection & Response (EDR) deployment across all workstations
  • Full red team exercise simulating advanced persistent threats

Q3 2026

  • Zero-trust network architecture implementation
  • Behavioral threat analytics and anomaly detection
  • Third-party vendor security assessment framework

Q4 2026

  • AI-driven threat detection and automated response
  • Advanced threat intelligence platform integration
  • Deception technology (honeypots) rollout

Report access & confidentiality

Full reports are available to enterprise customers under a mutual NDA. Summaries on this page are public.

Documents available under NDA

  • Application Security Assessment report (MIZU-ASA-2026-08-22)
  • Penetration test reports (third-party, when available, under NDA)
  • SOC 2 Type II report (when attestation is complete)
  • ISO 27001 documentation (when certification is complete)
  • Trust Center controls and subprocessors list
  • Security architecture overview
  • Vendor security questionnaire (pre-completed)

NDA process

  1. 1Email enterprise-security@mizucrm.com with your request
  2. 2We provide a standard mutual NDA template (1 business day)
  3. 3Legal review and countersignature (1-3 business days)
  4. 4Reports delivered via secure, access-controlled channel

NDA coverage includes confidentiality obligations, time-limited access, and permitted use for security evaluation and compliance purposes only.

Request security reports

Enterprise customers can access full pentest reports, SOC 2 audit documents, and ISO 27001 certificates under NDA. Our team responds within one business day.

    Penetration Testing & Security - Mizu CRM