Security
The measures that keep your account and your visibility data safe - and an honest account of where we are as a young product.
Zene stores the brands you track, the questions you run and the results we generate for you. Keeping that data private and intact is foundational - here's how it's protected, and what we're still building.
EU hosting
Zene is hosted in the EU. The app, database, authentication, file storage and edge functions run on a server we operate ourselves in a Contabo GmbH data centre in the EU, built on the open-source Supabase stack, with Cloudflare in front for DNS, CDN and traffic protection. Requests to the AI engines go through Cloudflare AI Gateway. The vendors that do receive data - AI engines, payments, email - are listed in our Privacy Policy. Live service health is on our status page.
Data isolation
Every workspace's data is separated at the database layer using row-level security (RLS). Queries run scoped to the signed-in user, so one account cannot read another's brands, scans or scores. Privileged administrative access is limited to a small set of audited paths.
Authentication
Sessions are cookie-based and managed by our own authentication service (open-source Supabase Auth, self-hosted alongside the database). Passwords are never stored in plain text - only as salted hashes. You can also sign in with Google. We recommend a strong, unique password.
Encryption
Traffic to and from Zene is encrypted in transit with TLS. Tokens for connected Google accounts are encrypted before they're stored, and AI-provider keys stay on the server - never in your browser.
Payments
We don't process or store card numbers. Payments run through Polar as merchant of record; card data is handled by Polar and its PCI-compliant processors, never by Zene.
Surface area
Only our marketing pages are public. The entire authenticated app - dashboards, settings, billing - is gated and explicitly disallowed to crawlers in our robots policy, so your workspace is never indexed.
Your controls
- Manage your account, change your password and sign out from Settings.
- Delete your account and its data whenever you choose.
- Export the data tied to your account on request.
Where we are, honestly
Zene is a young product. We follow the practices above today; formal certifications such as SOC 2 are on the roadmap rather than in hand, and we'd rather say so than imply otherwise. If your procurement process needs specific documentation, get in touch and we'll tell you exactly what we can provide right now.
Reporting a vulnerability
Found a security issue? We want to hear from you. Email security@tryzene.com with the details and steps to reproduce, and please give us a reasonable window to fix it before disclosing publicly. We won't pursue good-faith researchers who follow responsible disclosure.
See also our Privacy Policy and Terms of Service.