Z2 ZI2 Verify
Start free

Security

Cryptography-first by design.

Every result signed, every credit change chained, every tenant isolated at the database. Here is exactly how ZI² Verify protects your data.

ZI2

Signed · chained · isolated

Data in transit

  • TLS 1.2+ enforced end-to-end (HSTS, HTTPS-only cookies).
  • API served through Cloudflare with DDoS protection + edge rate-limits.
  • OAuth callbacks + wise links carry state parameters signed with our JWT key.

Data at rest

  • Passwords: argon2id (OWASP 2024 parameters — 19 MiB memory, t=2, p=1).
  • API keys: raw key shown once at creation, only sha256 stored on disk.
  • Wise-link + email-verification tokens: only sha256(token) stored, TTL 15 min, single-use.
  • Every credit change is HMAC-SHA256 chained (per-account, GENESIS-rooted). Tampering with any historical row invalidates every subsequent hmac — detectable via verifyLedgerChain().
  • Postgres row-level security (FORCE) on every tenant-scoped table. Belt-and-suspenders behind app-layer scoping.

ZI² Certified receipts

Every verification result is signed with Ed25519. The public JWKS is at /.well-known/zi2cert.jwks. Rotation: bump kid, keep the old public in JWKS so historical receipts stay verifiable. Never remove a key while receipts signed with it may still be in circulation.

Isolation

  • Per-tenant scoped DB user (no CONNECT on other databases).
  • Object storage: scoped IAM policy — user can only touch its own buckets.
  • API bound to 127.0.0.1 — public traffic ONLY through nginx (which enforces CORS, rate limits, /metrics deny).

Compliance roadmap

  • SOC 2 Type I — under Vanta preparation. Report expected within 90 days of GA.
  • SOC 2 Type II — 12 months of continuous evidence. Q3 2027 target.
  • GDPR — Data Processing Agreement available on request via /dpa.
  • ISO 27001 — 2028 target once revenue supports the audit cost.

Responsible disclosure

Report vulnerabilities to [email protected]. We acknowledge within one business day, fix critical issues within 7 days, and credit reporters on this page unless anonymity is requested. No bounty program yet — that will follow SOC 2.