◆ Security

Agency Client Data, Isolated and Encrypted.

The boring version of security: client work belongs to the agency that built it. We encrypt it, log access to it, and commit to never training on it. Here’s exactly how that’s wired up today — and what’s shipping next.

Request the trust packet Read the questionnaire

◆ Row-level tenant isolation◆ US-hosted◆ No training on your data

security/posture.md

$ cat security/posture.md

# zyan.ai security posture last_updated: 2026-09-23

● tenant_isolation      : row-level security · every table
● permission_grid       : 38 keys · per member
● realtime_channels     : private · tenant-scoped only
● secrets               : managed vault · never plaintext
● encryption_at_rest    : AES-256
● encryption_in_transit : TLS 1.2+
● custom_domains        : DNS-verified · fail-closed
● hosting               : US · managed cloud
● activity_ledger       : 30d · 1y · custom
● gdpr_ccpa             : supported
◐ soc_2_type_ii         : roadmap · audit not yet started
○ vuln_disclosure       : team@zyan.ai

$

◆ Policies

Six Commitments. Plainly Stated.

Boring, auditable, boring. That’s the job. Each of these is practiced, not aspirational — a link to our trust packet below spells out the details your compliance team will want.

Data Protection

Your client work is encrypted at rest and in transit, and isolated per tenant with row-level security on every table. Backups are encrypted and retained for 30 days.

AES-256 at rest
TLS in transit
Daily backups, 30d retention

Access & Identity

Sign-in runs through a hardened auth layer with magic links and seat invites. Every member’s access is governed by a granular permission grid, and client seats only ever see their own portal.

38-key permission grid per member
Seat invites + magic links
Client seats scoped to their portal

Infrastructure

Every workspace is isolated at the database layer with row-level security, realtime channels are private to your tenant, and integration secrets live in a managed vault — never in plaintext.

Row-level security, every table
Private tenant realtime channels
Secrets in a managed vault

Vendors & Subprocessors

The operational subprocessor summary below identifies providers and their purposes. Contact us for the current contractual and processing details.

Documented provider purposes
Workspace-controlled integrations
Contract details on request

Incident Response

Our on-call rotation is always paged on P0 / P1 events. Customers are notified within 72 hours of any incident affecting their data, as the GDPR asks.

24/7 on-call rotation
72-hour breach notification
Post-incident review published

Privacy

We only process the data you put in your workspace. No training, no selling, no advertising. Delete your workspace and your data is purged within 30 days.

No model training on your code
30-day deletion on request
DPA on file for every customer

security/data-access.mdWhat can Zyan staff actually see?Your workspace in three data classes, with the honest answer for each: what we cannot read, what is vaulted, and what is policy-bound.

◆ Roadmap

Compliance on a Calendar, Not a Wish List.

Here’s what’s shipping, when. If a milestone slips, this page updates — nowhere else.

Shipped
Tenant isolation & permission grid
Row-level security on every table, a 38-key member permission grid, and private tenant-scoped realtime channels.
Shipped
Fail-closed domains & vaulted secrets
Client-portal custom domains attach only after DNS verification; integration credentials live in a managed vault, never plaintext.
Now
Trust packet & subprocessor transparency
Operational subprocessors documented on this page; the detailed trust packet is available on request below.
Next
SOC 2 readiness, then audit
Controls are being mapped to SOC 2; a formal Type I / Type II audit engagement is on the roadmap — this page updates when it starts.

◆ Activity ledger

Every Action, on the Record.

Commits, prompts, seat changes, and credential rotations land in one tenant-scoped ledger your admins can read in the workspace — retained for 30 days by default, a year or longer on contract.

Agent prompts are logged with the file they touched, not just a timestamp
Client seats appear in the ledger but never read it
Export on request for your own SIEM or audit file

Activity ledger

30d retention · tenant-scoped · 1,284 events

Export CSV

AllCommitsPromptsAdminVault

When	Actor	Action	What changed	Scope
2m ago	Maya Rivers	admin	granted billing.view → Sam Lee	workspace
9m ago	Zyan agent	prompt	“tighten the hero CTA spacing” → hero.tsx	avid-auto
14m ago	Jordan Diaz	commit	feat/booking-page · 3 files	avid-auto
31m ago	Ava Kim	admin	invited client seat lena@avidauto.com	avid-auto
1h ago	System	vault	rotated Google Ads credential	avid-auto

row-level security scopes the ledger to this tenant · nothing here is visible to another workspace

◆ Subprocessors

Who We Pay to Help Run Zyan.

This summary lists the services used for the purposes below. Contact us for the current subprocessor record, contractual details, and processing locations.

Subprocessor	Purpose	Region
Supabase	Database, auth, storage, functions	US
Vercel	Web hosting & delivery	US
Stripe	Billing & payments	US
Anthropic	AI model provider (Claude)	US
OpenAI	Selected AI model features, where enabled	Provider-managed
Moonshot AI	AI model provider (Kimi · opt-in)	US endpoint
Google	Gmail, Calendar/Meet, Drive/Sheets, analytics and Ads (authorized connections)	US
DataForSEO	Search & keyword data for SEO tools	US

◆ Trust packet

Want the Long Form?

The trust packet covers the security architecture, DPA templates, incident-response playbooks, and the full subprocessor table. Share it with your security team and they’ll be quicker to green-light the pilot.

Security architecture overview (isolation, permissions, secrets)
DPA ready for signature
Incident-response runbook
Security questionnaires answered on request