The posture behind the platform.

Zero2Do holds your evidence, your policies and the credentials that reach your systems. Here is how each one is protected, who else touches it, and where to check our own posture.

See our trust centerStart at zero

What we hold, and how it is protected.

  1. 01

    Encryption at rest

    Integration credentials are encrypted with AES-256-GCM before they reach the database. Every stored credential carries its own random initialization vector and an authentication tag, so any tampering is detected when it is decrypted. The encryption key is supplied by the deployment environment and is never stored in the database.

    • In production every response carries a strict transport security header, so a browser will only ever reach Zero2Do over HTTPS.
    • Evidence files live in a private bucket partitioned by workspace, and the storage layer refuses an upload that does not name one.
  2. 02

    Tenancy isolation

    Every workspace belongs to one organization, and so does its data: controls, evidence, policies and agent runs. The server resolves which organization a session may read before it runs a query. A partner sees one client at a time, by switching workspaces.

    • On every request, the workspace a partner session points at is re-checked against the memberships behind that session, rather than trusted from the browser.
    • Partner, platform-admin, auditor and employee portals each resolve their own session type, with their own scope.
    • Auditor access is granted per engagement: one workspace, a named framework list, a date range and an access level. Requests outside that range are refused.
  3. 03

    Multi-factor authentication

    An account can require a second factor at sign-in: a TOTP authenticator app, or a one-time code emailed to the account address. Ten single-use backup codes are issued at enrollment and stored as bcrypt hashes.

    • Authenticator codes are accepted only within one 30-second step either side of the current time.
    • Emailed codes expire in ten minutes, are void once used, and are discarded after five wrong guesses.
    • A backup code is deleted from the account the moment it is accepted.
  4. 04

    An audit trail over privileged access

    When a Zero2Do platform administrator creates, changes or removes a workspace, a partner account, a user account, a license or a membership, an entry is written to an audit log: who acted, on which record and when. Sign-ins, sign-outs and failed sign-ins are recorded as well, together with the address they came from.

    • Nothing in the application updates or deletes an entry once it is written; the log is only ever appended to and read back.
    • Repeated failed administrator sign-ins, from one address or against one account, raise a security alert and notify the administrators who opted in.
    • Agent runs are recorded against the workspace they ran in, with their type, status, timing and result.

Who else touches your data.

Zero2Do runs on a short list of subprocessors. Each one has a job, and each one sees only what that job needs.

Vercel
Application hosting
Request metadata and application logs.
Neon
Managed PostgreSQL
All workspace data, with integration credentials stored encrypted.
Cloudflare R2
Object storage
Evidence documents, in a private bucket partitioned per workspace.
Anthropic
Model provider
The workspace context passed to a single agent run.
Resend
Transactional email
Recipient address and message contents.
CloudConvert
Document conversion
The document submitted for conversion.

Check our own posture.

The trust center is the same page we ship to customers: control status, framework coverage and current policy versions, built from live evidence rather than a document somebody remembered to update. Reports and certificates are available there on request.

Open the trust center

Reviewing us as a vendor?

Send your security questionnaire and we will answer it out of the platform, the same way your own program would.

  1. 01

    Send us the questionnaire

    Your standard security review, in whatever format your team already uses.

  2. 02

    We answer from the platform

    Control status and evidence come out of the same workspace your own program would run in.

  3. 03

    You keep the answers

    Everything we send is documentation you can attach to your own vendor file.

Talk to us