Security
Your work,
kept safe and yours.
No passwords to steal, encryption on every connection, a backup every day, and owners who decide what leaves the workspace.
Protection
Safe at every layer. Every connection is encrypted, only our own scripts run, the secrets we keep are sealed under a key that never leaves our server, and every backup is encrypted before it is copied.
HTTPS everywhere
Every connection is HTTPS, and browsers are told never to use anything else (HSTS).
Only our scripts
Each page carries a Content Security Policy with a fresh key per request, so only our own scripts run.
Sealed secrets
A mailbox’s app password or an identity provider’s client secret is encrypted with AES-256-GCM, so a copy of the database alone does not reveal it.
Encrypted daily backups
Databases and files are backed up every day and encrypted with AES-256 before the copy goes to a separate storage provider. Old backups are removed on a schedule.
Our own servers
zvena runs on our own servers in the United States. Who helps us run it
Private notifications
Notifications to your devices are encrypted for each device alone.
Published apps kept apart
Apps made with Make are served from a domain of their own, each with its own address, cookies and security policy, so an app cannot read your zvena session or another app’s data.
Identity
No passwords to steal. You sign in with a one-time link or code sent to your email, or with Google or GitHub. Organizations bring their own identity provider.
One-time links and codes
A link and its code live 15 minutes, work once and are stored only as keyed hashes; five wrong codes void the letter.
Safe from mail scanners
A sign-in link opens a page with a button rather than signing in on its own, so scanners that follow links cannot use it up.
Single sign-on
Verify your email domain and sign your people in through your own identity provider, with SAML or OpenID Connect.
SCIM
Keep the workspace’s member list in step with your directory.
Enforced, never locked out
With single sign-on enforced, addresses at your domain sign in only through it; the owners keep their other ways in, so a broken provider never locks the workspace out.
Guarded sessions
The session cookie is bound to our host, sent only over HTTPS and unreadable by scripts. Requests that change anything must come from zvena itself.
Rate limits
Signing in, sending mail and other costly actions are rate-limited.
Sign out everywhere
Sign out of every device at once from Settings.
Workspace controls
Owners decide what leaves the workspace. A workspace’s owners can turn off, for everyone in it, each way work goes out, and see who did what.
Publishing
Turn off publishing pages and forms to the web.
Sharing outside
Turn off sharing with people outside the workspace.
Export
Turn off exporting the workspace’s documents, and moving them to another workspace.
Offline copies
Turn off copies of mail kept on devices to work offline.
Connected AI sessions
Turn them off, or let them only watch.
Audit log
Who signed in, who exported, and what changed in the workspace’s settings. It keeps ids, never email addresses or content.
Privacy
Your work is not training data. zvena AI sends a model only what you asked it to work on, and workspace data is never used to train any model.
zvena AI
It sends only what you asked it to work on, only to the model you chose, through providers that do not keep it or train on it.
No training
Workspace data is never used to train any model.
No ads, no trackers
No third-party analytics, no advertising, no tracking pixels. We do not sell or share your personal information.
Yours to take
Download all your data, or delete your account, at any time in Settings.
Who receives what
Every service provider, what it receives and where. Privacy Policy
Reports
Plain about where we are. zvena has no SOC 2 or ISO 27001 report yet. We answer security questions directly, and every vulnerability report.
Questionnaires and agreements
For a security questionnaire or a data processing agreement, write to us. sales@zvena.jevflow.net
Report a vulnerability
Write to support@zvena.app (also in our security.txt). Please give us a reasonable time to fix the problem before you make it public, and do not access or change other people’s data while testing. We answer every report.
Atlassian
Sprout Social
Teams at these companies work in zvena