Security
Your code is your most valuable asset. We treat it that way.
Security and privacy are designed into Zyverna from the data model up — not bolted on.
Encryption everywhere
TLS 1.2+ in transit, AES-256 at rest. Secrets live in a managed KMS and are never written to logs.
No training on your data
Your prompts, code and outputs are never used to train models — ours or our providers'. Enforced contractually.
Zero data retention
Privacy Mode (Business & Scale) instructs model providers to retain nothing after the response is returned.
Sandboxed execution
Agent code runs in isolated, ephemeral sandboxes with no network access and strict CPU, memory and time limits.
Least-privilege access
Staff access to customer content requires a ticket and your permission, is time-boxed and audit-logged.
Secure development
Mandatory code review, dependency scanning, static analysis and annual third-party penetration testing.
Compliance roadmap
- GDPR, UK GDPR, CCPA/CPRA and PIPEDA-aligned privacy programLive
- Data Processing Addendum with SCCs available to all business customersLive
- Published subprocessor list with 30-day change noticeLive
- SOC 2 Type I (in progress) → Type IIIn progress
- ISO 27001 certificationPlanned
- EU data residency optionPlanned
Business and Scale customers can request our security questionnaire responses, penetration test summary and policies under NDA.
Responsible disclosure
We welcome reports from security researchers. If you believe you've found a vulnerability, email [email protected] with steps to reproduce. We commit to:
- • Acknowledge your report within 2 business days
- • Provide a remediation timeline within 10 business days
- • Not pursue legal action for good-faith research within scope
- • Credit you (with permission) once the issue is fixed
Out of scope: denial of service, social engineering, physical attacks, and findings on third-party services. Please do not access other users' data; use test accounts.
Questions about security or privacy?
We're happy to walk your team through our architecture and controls.