Security and responsible disclosure

Current controls

• Shared authenticated session with organisation-scoped server records.
• Owner, administrator, member and viewer roles.
• Exact-origin CORS, credentialed requests, CSRF verification and payload limits.
• Checksummed records and audit events for material platform actions.
• Encrypted application backups outside public web storage, with CLI-only restore.
• Human approval and evidence gates for governed actions and agent jobs.
• Rate controls and private handling of invitation codes and secret references.

Customer security responsibilities

Use unique credentials, restrict administrator accounts, assign the minimum required role, remove confidential fields not needed for analysis, validate authorised recipients before sharing codes, and retain independent source-system backups. Never enter an integration secret into a public label field; store secrets only in the hosting configuration referenced by name.

Responsible disclosure

Send a concise report to support@zenosust.com with the affected URL, reproducible steps, impact and contact information. Do not access another organisation’s data, degrade availability, use social engineering, upload malware, exfiltrate data or publish an unresolved vulnerability. ZenoSust may preserve logs and coordinate remediation.

Assurance boundary

This page describes implemented safeguards; it is not a penetration-test certificate, SOC report, ISO certification or contractual service-level commitment. Formal independent testing, enterprise SSO and negotiated recovery objectives require a separate deployment and agreement.