◆ Security

Agency Client Data, Isolated and Encrypted.

Client work belongs to the agency that built it. We encrypt it, log access to it and never train on it. Here is how that works today, what ships next, and what Zyan staff can and can’t see.

Request the trust packetRead the questionnaire
◆ Row-level tenant isolation◆ US-hosted◆ No training on your data
security/posture.md
$ cat security/posture.md

# zyan.ai security posture last_updated: 2026-11-07

● tenant_isolation      : row-level security · every table
● permission_grid       : 48 keys · per member
● realtime_channels     : private · tenant-scoped only
● secrets               : managed vault · never plaintext
● encryption_at_rest    : AES-256
● encryption_in_transit : TLS 1.2+
● custom_domains        : DNS-verified · fail-closed
● hosting               : US · managed cloud
● activity_ledger       : 30d · 1y · custom
● gdpr_ccpa             : supported
◐ soc_2_type_ii         : roadmap · audit not yet started
○ vuln_disclosure       : team@zyan.ai

$
◆ Policies

Security Controls for Agency Client Data.

Each of these is in practice today. The trust packet below has the detail your compliance team will want.

  • Data protection

    Client work is encrypted at rest and in transit and isolated per tenant with row-level security on every table. Backups are encrypted and kept for 30 days.

    AES-256 at rest · TLS in transit · Daily backups, 30d retention

    What Zyan staff can see, by data class

  • Access and identity

    Sign-in runs through a hardened auth layer with magic links and seat invites. A permission grid governs each member, and client seats only see their own portal.

    48-key permission grid per member · Seat invites + magic links · Client seats scoped to their portal

  • Infrastructure

    Every workspace is isolated at the database layer, realtime channels are private to your tenant, and integration secrets live in a managed vault, never in plaintext.

    Row-level security, every table · Private tenant realtime channels · Secrets in a managed vault

  • Vendors and subprocessors

    The subprocessor summary below names each provider and its purpose. Ask us for the current contractual and processing details.

    Documented provider purposes · Workspace-controlled integrations · Contract details on request

  • Incident response

    On-call is paged on every P0 and P1 event, and customers are notified within 72 hours of any incident affecting their data, as the GDPR asks.

    24/7 on-call rotation · 72-hour breach notification · Post-incident review published

  • Privacy

    We only process the data you put in your workspace: no training, no selling, no advertising. Delete the workspace and its data is purged within 30 days.

    No model training on your code · 30-day deletion on request · DPA on file for every customer

◆ Roadmap

Current controls. What comes next.

See which controls are available and which work remains on the roadmap. Use the questionnaire below for the details behind a requirement.

  1. Shipped
    Tenant isolation & permission grid
    Row-level security on every table, a 48-key member permission grid, and private tenant-scoped realtime channels.
  2. Shipped
    Fail-closed domains & vaulted secrets
    Client-portal custom domains attach only after DNS verification; integration credentials live in a managed vault, never plaintext.
  3. Now
    Trust packet & subprocessor transparency
    Operational subprocessors documented on this page; the detailed trust packet is available on request below.
  4. Next
    SOC 2 readiness, then audit
    Controls are being mapped to SOC 2; a formal Type I / Type II audit engagement is on the roadmap — this page updates when it starts.
◆ Activity ledger

Every Action, on the Record.

Commits, prompts, seat changes, and credential rotations land in one tenant-scoped ledger your admins can read in the workspace — retained for 30 days by default, a year or longer on contract.

  • Agent prompts are logged with the file they touched, not just a timestamp
  • Client seats appear in the ledger but never read it
  • Export on request for your own SIEM or audit file
  • Next: Zyan staff access, logged here too
◆ Subprocessors

Who We Pay to Help Run Zyan.

This summary lists the services used for the purposes below. Contact us for the current subprocessor record, contractual details, and processing locations.

SubprocessorPurposeRegion
SupabaseDatabase, auth, storage, functionsUS
VercelWeb hosting & deliveryUS
StripeBilling & paymentsUS
AnthropicAI model provider (Claude)US
OpenAISelected AI model features, where enabledProvider-managed
Moonshot AIAI model provider (Kimi · opt-in)US endpoint
GoogleGmail, Calendar/Meet, Drive/Sheets, analytics and Ads (authorized connections)US
DataForSEOSearch & keyword data for SEO toolsUS
◆ Questions

Security review questions

Identity, data handling and operational controls, with roadmap items marked in the answers so your team can assess Zyan against its requirements.

Access
IAM-08Multi-factor authentication for admins?
Sign-in runs through a hardened auth layer (passwords + magic links). Workspace-enforced MFA is on the roadmap.
IAM-12SAML SSO supported?
Not yet — workspace sign-in uses the built-in auth layer. SAML SSO is on the enterprise roadmap; tell us your IdP.
IAM-14SCIM provisioning supported?
Not yet — seats are invited and deprovisioned by workspace admins today. SCIM is on the roadmap.
Data
EKM-01Customer data encrypted at rest?
AES-256 at rest on managed cloud infrastructure, with tenant isolation enforced by row-level security on every table.
EKM-04Encrypted in transit?
TLS 1.2+ for all external traffic.
DSI-07Data deletion on contract termination?
30-day soft delete, then permanent purge. Confirmation on completion.

Who at Zyan can read each class of data

Compliance
AAC-02SOC 2 status?
Not yet audited. Controls are being mapped to SOC 2; a formal audit engagement is on the roadmap and this answer updates when it starts.
GRM-09GDPR compliance?
DPA available for signature. Data is hosted in the US; tell us if residency is a blocker and we will say so honestly.
Operations
BCR-01Backup frequency and retention?
Daily encrypted backups with 30-day retention on managed infrastructure.
SEF-04Incident response?
Paged on P0/P1 events. Customers notified within 72 hours of any incident affecting their data.
App security
AIS-01Secure SDLC and code review?
Peer review plus automated lint, type, and contract checks on every change.
TVM-04Vulnerability disclosure program?
team@zyan.ai — reports acknowledged within two business days.
Vendor
STA-04Subprocessors documented and DPA-bound?
Yes — public list at /security#subprocessors with purposes, reviewed annually.

Need your organization’s own questionnaire completed? Request the supporting materials →

◆ Trust packet

Get the materials your reviewers need.

Request the security architecture, DPA templates, incident-response information and subprocessor details for your review. Tell us which requirements or questionnaires your team is working through.

  • Security architecture overview (isolation, permissions, secrets)
  • DPA ready for signature
  • The data access statement: what Zyan staff can and can’t see
  • Incident-response runbook
  • Security questionnaires answered on request
We’ll reply from team@zyan.ai.