Security

Where your data lives

By default, project data stays in the EU. We are glad to work fully inside your own cloud account or on your own servers, so the data never leaves your control. Where we host something for you, we tell you the provider and region in writing.

How we protect it

• Encryption in transit (TLS) and at rest for all project storage
• Access limited to the engineers on your project, with multi factor authentication
• Secrets kept in managed secret stores, never in code
• Automated dependency, container and code security scanning in our build pipelines
• Separate data for each client, and strict tenant separation in multi client systems
• Data deleted or returned at the end of a project, confirmed in writing on request

Contracts

We sign NDAs before you share sensitive details, and a data processing agreement under Article 28 GDPR before we handle personal data. We can list every subprocessor used on your project.

Reporting a vulnerability

If you think you have found a security problem in this website or in one of our products, please email security@zeynoc.com with the details. We will confirm receipt within two working days and keep you updated. Please give us reasonable time to fix the issue before telling anyone else, and do not access or change data that is not yours.