Security Policy

This page describes the technical and organisational security measures ZenzoLabs uses to protect its Service and customer data. It is the public summary of our internal Information Security Management System ("ISMS"). The marketing-facing overview lives at /zenzo-security.

1. Architecture

• Container-isolated workloads (Docker) on a hardened Ubuntu Linux VPS hosted with Contabo in the United Kingdom.
• TLS terminated at the edge by Caddy (TLS 1.2 and 1.3 only, modern cipher suites, certificates auto-issued and auto-renewed via Let’s Encrypt). Internal HTTP routing inside the Docker network is handled by nginx.
• Application services split into web, worker, and embedder containers with least-privilege users.
• Configuration as code; environment secrets injected only at runtime and never committed.
• Privacy firewall: raw business data is never sent to third-party large language model providers. Only schema metadata and aggregated/derived results leave the platform when an LLM is invoked.

2. Encryption

• In transit: HTTPS (TLS 1.2+) on every external endpoint; HSTS enabled.
• At rest: full-disk encryption at the hosting layer; database files reside on encrypted volumes.
• Credentials: passwords hashed with a modern KDF (Argon2 / bcrypt). API keys and OAuth tokens are encrypted at rest with an application-layer key.

3. Access control

• Role-based access control inside the application (admin, analyst, viewer).
• Multi-factor authentication for ZenzoLabs administrators on infrastructure consoles.
• Principle of least privilege: production access limited to a named set of engineers; reviewed quarterly.
• SSH key authentication only; no password logins on production hosts.

4. Logging & monitoring

• Application audit logs capture admin actions, authentication events, and customer-initiated data access.
• Web/proxy logs retained for 90 days (rolling).
• Container health probes and uptime monitoring with alerting to the on-call engineer.

5. Vulnerability management

• Dependency scanning on every commit (Dependabot / equivalent).
• Container image scanning before publish to the registry.
• OS and dependency patches applied on a rolling basis; critical CVEs within 7 days, high within 30 days.
• Annual third-party penetration test planned for 2026 (CREST-accredited tester) — summary letter available under NDA once complete.

6. Software development lifecycle

• All changes go through pull request and at least one reviewer.
• Pre-commit linting and an automated test suite gate merges.
• Secret-scanning runs on every commit; pre-receive hooks block known secret patterns.
• Deployments use immutable container images tagged with the commit SHA.

7. Backups & disaster recovery

• Daily backups of customer databases retained for 30 days; backups encrypted at rest.
• Backups stored in a separate availability zone from production.
• Restore procedure documented and tested at least every 6 months.
• Target RPO 24 h, target RTO 8 h for the multi-tenant Service. Customers on single-tenant or self-hosted deployments may have different targets agreed in their Order.

8. Incident response & breach notification

• Documented incident-response runbook with severity levels and on-call rotation.
• For Personal Data Breaches affecting customer data, affected customers are notified within 48 hours of confirmation.
• UK ICO notification (where required) within 72 hours per UK GDPR Art. 33.
• Post-incident review with root-cause analysis and corrective actions.

9. Personnel

• All ZenzoLabs personnel sign confidentiality agreements.
• Security awareness training on onboarding and annually thereafter.
• Access revoked within 24 hours of role change or departure.

10. Sub-processors

See /subprocessors.html. Each is contractually bound to data-protection obligations equivalent to those we owe our customers.

11. Responsible disclosure

If you believe you have found a security vulnerability in the Service, please email security@zenzolabs.com. We commit to:

• Acknowledge your report within 3 business days.
• Investigate and respond within 30 days.
• Not pursue legal action against good-faith researchers who follow this policy and do not exfiltrate or destroy data.

Please give us reasonable time to fix issues before public disclosure.

12. Security questionnaires

Enterprise customers may request our completed CAIQ / SIG Lite, our latest pen-test summary, and our recovery test report under NDA at security@zenzolabs.com.