Security Overview

• All traffic to the website and API is served over HTTPS/TLS.
• Data at rest is stored on managed, encrypted database and storage infrastructure.
• AI provider credentials you connect are encrypted before storage and are decrypted only to make a call to that provider on your behalf. They are never returned to the browser after saving and never appear in logs or analytics.

• Every customer table is protected by database-level row security tied to your organisation, so a query cannot return another organisation's rows even if an application bug tried to.
• Your organisation is the security boundary; projects exist for cost allocation inside it. Requests carrying a key from another organisation are rejected.
• Role-based access separates administrators from ordinary team members for sensitive actions.
• Privileged operations are recorded in an audit log visible to your administrators.

• Sign-in uses email one-time codes or Google sign-in — we never store a customer password.
• API access uses ZeroCredit API keys scoped to your organisation, which you create, list and revoke yourself. Keys are shown once at creation and stored only in hashed form afterwards.
• OAuth 2.0 authorization for agent and third-party access supports PKCE and named scopes.
• Incoming payment webhooks are rejected unless their signature verifies against a shared secret.

• Per-key rate limiting, published in the API documentation and advertised in response headers.
• Budget and quota enforcement that can stop spend before it happens.
• Anomaly detection on usage and cost patterns, surfaced to you rather than acted on silently.
• Standard browser security response headers on the website.
• Server-side validation of request payloads, with clear errors instead of silent fallbacks.

• Application and security logs are collected for reliability and abuse investigation.
• The managed database is backed up daily with approximately two weeks of retention. Point-in-time recovery is not enabled, so our recovery point objective is up to 24 hours.
• A documented recovery runbook exists internally. It has not yet been rehearsed end to end, and we say so rather than implying a tested guarantee.

• Changes are covered by an automated test suite that must pass before release.
• Automated dependency and configuration security scanning runs against the codebase and database.
• Secrets are held in managed secret storage and are never committed to source control.

If we become aware of a security incident affecting your data, we will investigate, contain it, and notify affected customers and, where applicable, the competent authorities, in accordance with the law that applies to us. We will share what we know, what we have done, and what you may need to do. Report a suspected vulnerability or incident to support@zerocreditai.com — please do not test against production without our written consent.

• Keeping your ZeroCredit API keys and provider keys confidential, and rotating them when staff change.
• Managing who you invite to your organisation and with what role.
• Deciding what data your applications send in prompts, and whether that data should be sent at all.
• Reviewing model outputs before relying on them.

See our Privacy Notice, Data Processing Addendum and Subprocessors page. Enterprise customers can request further detail under a mutual non-disclosure agreement.