Security Overview
End-to-End Encryption
AES-256 encryption for data at rest, TLS 1.3 for data in transit
Row-Level Security
PostgreSQL RLS policies isolate tenant data automatically
OAuth 2.0 & JWT
Industry-standard authentication with secure token management
Audit Logging
Complete audit trail of all data access and modifications
Real-time Monitoring
24/7 security monitoring and anomaly detection
API Key Management
Granular access control with project-level API keys
Infrastructure Security
Cloud Infrastructure
- Hosted on enterprise-grade cloud infrastructure with 99.9% uptime SLA
- Multi-region deployment with automatic failover and disaster recovery
- Isolated network architecture with private subnets and VPC peering
- DDoS protection and Web Application Firewall (WAF)
Database Security
- Row-Level Security (RLS): PostgreSQL native RLS enforces data isolation per project
- Encrypted Backups: Automated daily backups with point-in-time recovery
- Connection Pooling: Secure connection management with credential rotation
- Query Monitoring: Real-time detection of suspicious query patterns
Data Protection & Encryption
Military-Grade Encryption
All data is encrypted using industry-standard encryption protocols both in transit and at rest.
- Data in Transit: TLS 1.3 with perfect forward secrecy
- Data at Rest: AES-256 encryption for all databases and file storage
- Key Management: Hardware Security Modules (HSM) for key storage
- Credential Encryption: Fernet encryption for sensitive credentials
Data Isolation
Every project runs in an isolated environment:
- •Dedicated database schemas per project
- •Project-specific database roles with minimal privileges
- •RLS policies prevent cross-project data access
Backup & Recovery
Automated backup strategy:
- •Continuous WAL archiving for point-in-time recovery
- •Daily full backups retained for 30 days
- •Encrypted backups stored in geographically distributed locations
Access Control & Authentication
Multi-Factor Authentication (MFA)
Protect your account with time-based one-time passwords (TOTP) or hardware security keys.
OAuth 2.0 & Social Login
Secure authentication using industry-standard OAuth 2.0 protocol with support for popular providers:
Role-Based Access Control (RBAC)
Granular permissions system for team collaboration:
API Key Management
- Service keys for server-side operations with elevated privileges
- Anonymous keys for client-side access with RLS enforcement
- Key rotation and revocation capabilities
- Rate limiting per API key to prevent abuse
Compliance & Certifications
GDPR Compliant
Full compliance with EU General Data Protection Regulation. User data rights, consent management, and data portability built-in.
CCPA Compliant
California Consumer Privacy Act compliance with user data access, deletion rights, and opt-out mechanisms.
SOC 2 Type II
Certification in progress. Annual audits ensure security, availability, processing integrity, confidentiality, and privacy.
ISO 27001
Information security management system certification. Comprehensive security controls and risk management framework.
Data Processing Agreement (DPA)
Enterprise customers can request a Data Processing Agreement that covers GDPR Article 28 requirements, including data processing obligations, security measures, and sub-processor management.
Request DPASecurity Monitoring & Incident Response
24/7 Security Operations
Proactive Monitoring
- •Real-time intrusion detection and prevention systems (IDS/IPS)
- •Anomaly detection using machine learning algorithms
- •Automated threat intelligence feeds integration
- •Log aggregation and correlation analysis
Incident Response
- •Dedicated security team available 24/7/365
- •Documented incident response procedures
- •Automated alerting and escalation workflows
- •Post-incident analysis and remediation
Audit Logging
Comprehensive audit logs for all system activities:
Vulnerability Management
Security Testing
- Penetration Testing: Annual third-party penetration tests by certified security firms
- Automated Scanning: Continuous vulnerability scanning of infrastructure and applications
- Code Reviews: Security-focused code reviews for all changes
- Dependency Scanning: Automated checks for vulnerable dependencies with immediate patching
Patch Management
Proactive approach to security updates:
- Critical security patches applied within 24 hours
- Regular updates to system components and dependencies
- Automated security update notifications
- Zero-downtime deployment for most security updates
Responsible Disclosure Policy
Report Security Vulnerabilities
We appreciate the security research community's efforts to help keep ZendBX secure. If you discover a security vulnerability, please report it to us responsibly.
Security Team:
security@zendbx.inWhat to Include:
- •Detailed description of the vulnerability
- •Steps to reproduce the issue
- •Potential impact assessment
- •Any proof-of-concept code (if applicable)
Our Commitment
- Acknowledge receipt within 24 hours
- Provide regular updates on remediation progress
- Credit researchers in our security acknowledgments (if desired)
- Not pursue legal action against good-faith security research
Security Best Practices for Users
Use Strong Passwords
- Minimum 12 characters
- Mix of letters, numbers, symbols
- Unique for each account
- Consider a password manager
Enable MFA
- Use authenticator apps
- Enable on all accounts
- Keep backup codes safe
- Consider hardware keys
Rotate API Keys
- Rotate keys every 90 days
- Revoke unused keys
- Never commit keys to git
- Use environment variables
Monitor Activity
- Review audit logs regularly
- Set up alerts
- Check login history
- Report suspicious activity
Implement RLS Policies
- Define clear access rules
- Test policies thoroughly
- Use least privilege principle
- Document your policies
Backup Your Data
- Regular backup schedules
- Test restore procedures
- Store backups securely
- Keep multiple versions
Have Security Questions?
Our security team is here to help. Whether you have questions about our security practices, need to report a vulnerability, or want to discuss enterprise security requirements, we're here for you.