Security at ZentisLabs

• The platform runs on dedicated cloud servers in Germany (Nuremberg), operated by Hive Solutions GmbH.
• Administrative access uses SSH with key authentication only; password logins are disabled.
• Automated health checks run every five minutes and alert us when the site, the API, the database or upstream capacity degrade.

• Every domain is served over TLS; plain HTTP is redirected to HTTPS.
• HTTP Strict Transport Security (one year, including subdomains, preload) keeps browsers on HTTPS.

• A Content Security Policy limits which scripts, frames and connections a page may use.
• Clickjacking protection (frame-ancestors and X-Frame-Options), MIME-sniffing protection and a strict referrer policy on every response.
• Camera, microphone and geolocation access are disabled by Permissions-Policy, and pages are isolated from cross-origin windows.

• Passwords are stored as bcrypt hashes (cost factor 12) and never in readable form.
• Email addresses are verified, and sign-in with Discord or GitHub only links to an account whose email is verified.
• Two-factor login is available for every account: a code from an authenticator app (TOTP) is then required for password, Discord and GitHub sign-in, with single-use recovery codes as a backup.
• Sign-in, sign-up, password reset and password change are rate limited.
• The dashboard settings show a 90-day log of sign-ins, failed sign-ins and security changes with the device and IP address they came from, and you can end every session at once with “Sign out everywhere”. Changing or resetting your password also ends all existing sessions.
• You can delete your account in the dashboard settings; personal data is erased 30 days later, except records we are legally required to keep, such as invoices.

• API requests are authenticated against a SHA-256 hash of your key, and the dashboard shows keys masked.
• Regenerating a key in the dashboard invalidates the old key immediately.
• You can add up to 10 named keys, one per integration: only their SHA-256 hash is stored (each key is shown once, when it is created), each shows when it was last used, and each can be revoked on its own.
• The public API is rate limited per key.

• Payments are processed by Stripe, a PCI DSS Level 1 certified provider. Card details go directly to Stripe and never reach our servers.

• The database is backed up every night, with a copy stored off-site in separate storage.

If you believe you have found a security issue, email support@zentislabs.com with the details and the steps to reproduce it. Please do not access other customers' data, run denial-of-service tests or use automated scanners against production. We review every report and reply to the address you write from. Our contact details are also published in security.txt.

• Privacy Policy
• Terms & Conditions (including the proxy uptime commitment)
• System status