If you are preparing for ISO/IEC 27001, SOC 2 or a customer security review, this page
tells you which controls the platform helps with and which it leaves to you.
zone9 is not certified against any of these frameworks, and this page is not an
attestation. It maps product capabilities to control families so you can see what you
inherit and what remains yours. Certification covers an organisation and its processes,
not a piece of software.
Legend: provided the platform implements it ·
partial something is there, with a stated limit ·
yours the platform does not address it
Control Status What exists Unique user identification provided OIDC identities; every audit entry names the actor Role-based authorisation provided Four roles; write endpoints refuse read-only tokens Least-privilege service credentials provided Scoped API tokens; the platform’s own Proxmox token deliberately excludes system modification Credential storage partial Tokens hashed; several operational secrets are not yet encrypted at rest — see Known gaps Multi-factor authentication yours A property of your identity provider Access review yours Membership is visible; there is no periodic review workflow
Control Status What exists Network segmentation provided Private networks are isolated layer-3 domains; two networks cannot route to each other Egress control provided No egress without a gateway; data tier subnets can never have one, enforced by the API Host firewalling provided Rules enforced at the hypervisor, outside the guest No inbound management path provided The region connects outbound; no inbound rule is required Encryption in transit, north-south provided HTTPS everywhere; TLS terminated at the load balancer with managed certificates Encryption in transit, east-west yours Traffic inside a private network is not encrypted by the platform DDoS protection yours Edge device or an upstream provider
Control Status What exists Tenant data separation provided API scoping, network isolation, hypervisor tagging — see Tenant isolation Encryption at rest, customer disks partial Provided by the storage backend if the operator configured it; not managed by the platform Encryption at rest, control plane secrets yours Not implemented at the application layer today Deletion with recovery window provided Two-phase delete with a cancellable buffer Backup yours No backup product; use Proxmox Backup Server at the infrastructure layer Data residency provided Resources never leave their region; there is no cross-region movement of any kind
Control Status What exists Change audit trail provided Actor, action, resource, before/after, written in the same transaction as the change Privileged access logging provided Console sessions, credential display, membership changes Distinguishing automated actors provided Assistants and tokens are separate actor types from users Tamper-evident logging yours Entries are ordinary rows; no hash chain or write-once store Log retention policy yours No configurable retention or archival; your database backup policy governs SIEM integration yours Export over the API; there is no push integration
Control Status What exists Infrastructure as code partial Everything is API-driven and scriptable; there is no first-party Terraform provider Reproducible operations provided Every operation is an idempotent, resumable job Rollback of destructive change partial Deletion has a cancellable buffer; other changes do not have undo Separation of duties partial Roles separate read from write; there is no approval workflow Vulnerability management yours Guest patching is yours; hypervisor and appliance base images are the operator’s
Control Status What exists Control plane failure tolerance provided Provisioned resources are unaffected by a control-plane outage — see Architecture overview No lock-in provided Resources are ordinary Proxmox objects, inspectable and repairable with standard tools High availability of platform components partial Control plane can be replicated; load balancers are single-instance today Disaster recovery yours Storage replication and backup are operator concerns
Inherited if you run on an existing installation: segmentation and egress control,
hypervisor-enforced firewalling, credential handling, the audit trail, the recovery
buffer on deletion, and data residency.
Yours regardless: guest hardening and patching, application security, identity
provider policy including MFA, backup and recovery, log retention and forwarding, and
your own access review process.
Yours if you self-host: everything an operator owns — hypervisor patching, storage
encryption, edge policy, physical security, and the control plane’s own availability.
