Security & Data Protection

Our security practices are designed around data minimization, restricted access, secure credential management, encryption, vulnerability management, and timely deletion of information that is no longer required.

Updated August 2026. This page summarizes organizational practices. Individual products publish their own privacy disclosures.

Access control

Access to production systems and sensitive information is limited to authorized personnel with a legitimate operational need.

Where supported by the underlying service, Zencode uses:

• unique individual accounts rather than shared credentials
• multi-factor authentication for critical systems
• least-privilege access
• restricted administrative and production access
• managed secrets and credential storage
• access logging and audit information
• separation of development and production credentials

Access is removed when it is no longer required.

Authentication

Multi-factor authentication is used for critical systems that store, process, or provide access to sensitive information.

This includes, as applicable, infrastructure providers, source-control systems, financial-data providers, domain and DNS administration, business email, password and secret management systems, and other privileged administrative services.

Applications operated by Zencode may also require additional authentication or device-level biometric authentication where appropriate to the sensitivity of the information being accessed.

Encryption

Network communication containing sensitive information is protected using HTTPS and modern TLS.

Production services are configured to use TLS 1.2 or later for client/server communication.

Sensitive information stored by Zencode is protected using encryption at rest where appropriate. Particularly sensitive credentials and access tokens are additionally protected through managed secret storage or application-level encryption.

Secrets and authentication credentials are not intentionally stored in source code or application logs.

Data minimization

Zencode attempts to collect and retain only information required to provide the relevant product or service.

Where an application needs information from an external provider, the application should request the narrowest practical set of permissions.

Sensitive provider responses are not retained unnecessarily, and systems are designed to avoid logging financial information, authentication tokens, passwords, or other sensitive data.

Financial data

Some Zencode-operated applications may allow users to connect financial institutions or other financial-data sources through third-party providers.

Where these integrations are used:

• access is user-authorized
• credentials for the underlying financial institution are not intentionally collected by Zencode
• connections are used only for the disclosed application functionality
• financial access is read-only unless a product explicitly states otherwise
• sensitive access tokens are protected at rest
• financial information is not sold to advertisers
• access can be revoked when a connection or account is removed

Individual applications publish their own privacy disclosures describing the data they collect and how it is used.

Vulnerability and dependency management

Zencode uses a combination of automated tooling and operational review to identify security problems in software and infrastructure.

Practices may include:

• automated dependency vulnerability detection
• source-code and static-analysis checks
• automated security checks in CI/CD
• operating-system and software security updates
• review of critical dependency advisories
• production configuration review
• endpoint security and vulnerability scanning where appropriate

Critical vulnerabilities are prioritized according to severity, exploitability, exposure, and the sensitivity of affected systems.

Software development

Security is considered throughout development and deployment.

Relevant practices include:

• code review
• automated testing
• dependency management
• separation of secrets from source code
• restricted production credentials
• secure deployment practices
• validation of external input
• limiting externally exposed services
• logging designed to avoid unnecessary sensitive information

Production changes are tested according to the needs and risk profile of the affected service.

Data retention and deletion

Zencode does not intend to retain sensitive information indefinitely.

Each service should retain information only for as long as necessary for its operational, security, legal, or contractual purpose.

Where applicable:

• active connection credentials are retained only while required to provide the connection
• deleted connections have associated access revoked where the provider supports revocation
• account deletion removes associated production data according to the application's retention policy
• sensitive information is excluded from logs wherever practical
• operational and security logs have defined retention periods
• deleted information may remain temporarily in encrypted backups until normal backup expiration
• public or shared records associated with a deleted account are invalidated where appropriate

Retention practices are reviewed periodically and when services materially change.

The organizational schedule, including deletion timing, log retention, backups, and disposal procedures, is published in the Data Retention & Disposal Policy. A PDF copy is available for vendor reviews.

Consumer consent and privacy

Applications that collect personal or financial information provide users with appropriate notice and obtain consent before collecting or processing that information.

Application-specific privacy policies describe:

• information collected
• purpose of collection
• third parties involved in processing
• retention practices
• deletion options
• contact information for privacy questions

Users should be able to discontinue optional external-data connections and request deletion of their account information.

Third-party services

Zencode uses reputable infrastructure and software providers for services such as cloud hosting, authentication, financial-data connectivity, source control, communications, and payment processing.

Third-party access is limited to what is necessary for the service being provided.

Security and privacy considerations are evaluated when introducing providers that will handle sensitive information.

Security incidents

Zencode maintains procedures for responding to suspected security incidents.

Response may include:

1. containing affected systems or credentials
2. investigating the scope and cause of the incident
3. rotating or revoking affected credentials
4. correcting the underlying vulnerability
5. restoring normal operations
6. preserving relevant security information
7. notifying affected parties or service providers when required
8. documenting corrective actions

Security practices and incident-response procedures are reviewed as systems and risks evolve.

Responsible disclosure

Security issues involving a Zencode-operated system should be reported privately rather than disclosed through a public issue tracker.

Security contact:
security@zencode.ca

Please include enough information to reproduce or investigate the issue, while avoiding unnecessary access to or disclosure of other people's data.

We will review legitimate reports and respond as appropriate to their severity.