Trust & Safety
Security at ZeaProcess
Your process data is sensitive. We treat it that way — with enterprise-grade controls at every layer of our stack.
Data Encryption
- All data encrypted in transit via TLS 1.2+ (TLS 1.3 preferred)
- All data encrypted at rest using AES-256
- Database backups encrypted with separate key management
- Encryption keys managed through a dedicated KMS with rotation
Infrastructure
- Hosted on SOC 2 Type II certified cloud infrastructure
- Services deployed across multiple availability zones
- Network segmentation with private VPCs and strict firewall rules
- Automated vulnerability patching and dependency scanning
- DDoS protection at the network and application layer
Access Controls
- Role-based access control (RBAC) within every workspace
- Multi-factor authentication (MFA) available for all accounts
- SSO via SAML 2.0 and OIDC on Enterprise plans
- Principle of least privilege enforced across internal systems
- Privileged access requires approval and is fully audited
Application Security
- OWASP Top 10 mitigations built into our SDLC
- Static and dynamic application security testing (SAST/DAST) in CI/CD
- Regular penetration tests by independent third-party firms
- Content Security Policy (CSP), HSTS, and X-Frame-Options headers
- Input validation and parameterized queries throughout
Audit & Logging
- Comprehensive audit logs for all user and admin actions
- Logs retained for 12 months and tamper-evident
- Real-time alerts for anomalous activity via SIEM
- Logs exportable by Enterprise customers on request
Incident Response
- Documented incident response plan with defined SLAs
- 24/7 on-call security rotation for critical incidents
- Customers notified within 72 hours of confirmed breach (GDPR-aligned)
- Post-incident reviews shared with affected Enterprise customers
Responsible Disclosure
We appreciate the work of security researchers. If you discover a potential vulnerability in ZeaProcess, please report it to us privately so we can address it before public disclosure.
- Email: security@zeaapps.com
- PGP: Available on request — email us for the public key.
- Response SLA: We acknowledge reports within 2 business days and aim to resolve critical issues within 14 days.
- Safe harbor: We will not pursue legal action against researchers who act in good faith and follow responsible disclosure guidelines.
Compliance & Standards
ZeaApps operates under and is working toward the following frameworks.
SOC 2 Type II (in progress)GDPRCCPAISO 27001 (roadmap)OWASP ASVS
Security questions or concerns? security@zeaapps.com
