Security

Tenancy isolation#

Every record — knowledge sources, chunks, tables, rows, actions, conversations, messages, traces — carries an indexed workspace id, and every query filters on it. There is no endpoint that returns data across workspaces.

Access is enforced twice. A session cookie establishes who you are; it is not sufficient to read anything. You exchange it for a workspace-scoped token, and that exchange checks you hold a seat in the workspace. The token then carries its workspace id, which every endpoint compares against the workspace in the request path — a token minted for one workspace is rejected against another with a 403.

Credentials at rest#

Password and signature comparisons are constant-time, so a response cannot be used to narrow in on a correct value one byte at a time.

Sessions#

• Session cookies are HttpOnly, so page JavaScript cannot read them, and Secure in production.
• SameSite=Lax, which permits the OAuth callback to complete while blocking cross-site form posts.
• The OAuth round-trip carries a state parameter mirrored in a short-lived cookie. A callback whose state does not match the cookie is refused — this is what stops an attacker handing someone a link that signs them into the attacker’s account.
• Sessions expire after 7 days. Signing out clears the cookie and the workspace token together.
• The account is re-read from the database on every authenticated request, so a deleted account stops working immediately rather than when its token happens to expire.

Agent safety#

The guards that matter are in the execution path, not in a prompt. A prompt injection that persuades the model still meets the same code:

• Write actions never auto-execute. They are proposed, confirmed by the customer, and executed on a later turn. The generation loop cannot complete a write on its own.
• Untested actions are not offered. An action that has never passed a test call is invisible to the model. Change its URL or method and it reverts to untested.
• Identity gates are checked before the model sees the option. An action marked as requiring identity is not offered at all to an unverified visitor.
• Identity is proven, not claimed. An email is only trusted when accompanied by a valid HMAC computed with your widget secret. See Identity & signing.
• Answers are validated. A separate check confirms the reply is grounded in retrieved context. Failure produces an abstention, never an unvalidated answer.

Transport and platform#

• TLS everywhere. Production cookies carry the Secure flag.
• Standard hardening headers, including HSTS, a content security policy, frame and MIME-sniffing protections.
• Dashboard endpoints are restricted to configured origins; the widget endpoints are deliberately public, because they run on your customers’ sites.
• Widget origins are allow-listed per workspace, and the check is server-side, so removing a domain takes effect at once.

Data handling#

• Customer conversations are not used to train models, ours or our providers’.
• Deleting a knowledge source removes its chunks in the same operation — there is no window where a deleted document is still quotable.
• Secrets are redacted from logs. Error responses carry a human-readable message and never internal detail.
• Backups are encrypted and rotate within 35 days.

Operational practice#

• Access to production is limited to staff who need it, and requires multi-factor authentication.
• Dependencies are monitored for known vulnerabilities and patched on a defined schedule by severity.
• Application errors are captured with a monitoring service so failures are seen rather than inferred from a support ticket.

What we do not claim

We are not currently SOC 2 or ISO 27001 certified, and this page does not pretend otherwise. If your procurement process requires a certification or a completed security questionnaire, contact us and we will tell you honestly where we are.

Reporting a vulnerability#

Write to security@zealoop.com. Please include enough detail to reproduce the issue. We will acknowledge within two business days, keep you updated, and we will not pursue legal action for good-faith research that avoids privacy violations, data destruction and service degradation.

Please do not test against another customer’s workspace. Create your own — the free plan exists and is sufficient for almost every test worth running.