Security at Zetdo

1. Security model

Security is part of Zetdo product design, infrastructure, deployment, and operations. We use layered controls across authentication, authorization, data storage, secrets, monitoring, backups, and incident response.

Zetdo is still an early-stage product. We do not claim SOC 2, ISO 27001, HIPAA, PCI DSS, or other formal certification unless separately published, but we design our controls to make those audits achievable as the platform matures.

2. Hosting and infrastructure

• Cloud hosting: Zetdo runs primarily on Microsoft Azure, using separate environments for development, staging, and production.
• Infrastructure as code: Azure resources are provisioned with Terraform to reduce manual drift and improve reviewability.
• Deployment controls: production deployments use GitHub Actions and Azure OIDC, avoiding long-lived deployment credentials.
• Network and service boundaries: backend APIs, Azure Functions, queues, databases, storage, and secrets are separated by environment and purpose.

3. Authentication and access control

• User authentication is handled through Firebase Authentication.
• API requests require authenticated tokens and company context checks before company-scoped data is accessed.
• Role and membership checks restrict administrative and company-level actions.
• Production access is limited to personnel with an operational need and reviewed as the team and platform grow.

4. Data protection

• Encryption in transit: Zetdo uses HTTPS/TLS for browser, mobile, API, webhook, and provider communications.
• Encryption at rest: Azure data services provide encryption at rest for databases, storage, backups, and platform-managed disks where applicable.
• Secrets management: service secrets and connection strings are stored in Azure Key Vault and accessed through managed identities where supported.
• Tenant separation: customer business data is scoped by company identifiers and authorization checks.
• Audit history: company-scoped create, update, delete, and restore events are recorded for supported aggregates.

5. Backups and recovery

• Cosmos DB uses continuous backup with point-in-time recovery where configured.
• Azure Blob Storage and related storage services are configured for encrypted storage and operational recovery according to environment needs.
• Backups are intended for disaster recovery, accidental deletion recovery, and operational resilience. They are not a replacement for your own business recordkeeping.

6. Monitoring and incident response

Zetdo records operational logs, correlation identifiers, provider events, and security-relevant events to detect failures, abuse, unauthorized access attempts, delivery issues, and infrastructure problems.

When we identify a security incident, we investigate scope, contain the issue, preserve relevant evidence, remediate the cause, and notify affected customers or regulators when legally required.

7. Secure messaging

• Outbound email, SMS, and WhatsApp delivery is separated from reminder orchestration so delivery providers do not control scheduling logic.
• Provider webhooks are verified where supported before delivery events are accepted.
• Opt-out and recipient preferences are respected in the messaging workflow.
• Message delivery can be throttled, retried, blocked, or suspended when provider, abuse, or compliance risk requires it.

8. Shared responsibility

• You are responsible for choosing strong passwords, protecting devices, limiting team access, assigning roles carefully, keeping customer contact details accurate, and requesting and keeping any records you need for your own compliance.
• You are responsible for having permission to contact customers by email, SMS, or WhatsApp and for honoring opt-outs and local marketing rules.
• Zetdo is responsible for operating the platform controls described here and responding to vulnerabilities and incidents within our service boundary.

9. Vulnerability disclosure

If you believe you found a vulnerability, report it to [email protected] with enough detail for us to reproduce the issue. We aim to acknowledge reports within two business days.

Do not access, modify, delete, exfiltrate, or disclose data that is not yours. Do not run destructive tests, denial-of-service tests, social engineering, spam, or physical attacks. Give us a reasonable opportunity to investigate and remediate before public disclosure.

10. Contact

Security reports: [email protected]. Privacy questions: [email protected]. General support: [email protected].