Security you can check for yourself.
We're a young company, so we'll be upfront. We don't have formal security certificates yet. What we do have is a system that is already running. Its safety comes from how it's built, so you don't have to just take our word for it.
npx @zindexzero/sdk proofRun it with two keys. You'll see one customer try to read the other's data and get blocked. It tests the wall described below. SDK docs →Safety rules built into the system
Each customer is walled off
We keep customers apart with AWS keys and logins (AWS is Amazon's cloud). We don't rely on a search filter that we must write correctly every time. Each request gets a short-lived pass that opens only one customer's data. If our code has a bug, the request gets “access denied” and never sees someone else's data.
Only the access each part needs
Every part of our system gets only the access it needs to do its job. Your browser never holds long-lasting cloud keys. It gets short-lived keys for one session, and they expire on their own.
Locked when stored and when sent
We encrypt your data when we store it. That means we scramble it so only the right key can read it. Data moving over the internet is locked with TLS, a standard web lock. File links do one job and expire within minutes, so an old shared link can't be used again.
We guard API keys like passwords
An API key is the password your app uses to reach us. We only store a scrambled copy that can't be turned back into the key. We can't get your key back, and neither can anyone who reads our database. New keys work right away, with a limit of 1,000 requests a month. You can turn a key off or cancel it at any time, and each key has its own monthly limit.
We never train AI on your data
Our AI runs inside our own AWS account, in the US. What you send and what comes back are never used to train AI models. They are never shared with the companies that make the models, either. AWS builds this into how it runs the models, so it goes beyond a promise in a policy.
Your documents stay yours
Files you upload go into a search index that only your own keys can open. When the AI looks things up, it has no way to reach another customer's files. It's the same key-level wall from above, used for your documents.
Walls that work in a real app
Our first app, PipFlow, puts this to the test. It gives each lawyer a private knowledge base, which is a personal library the AI can search. Each lawyer's files are kept apart from every other lawyer's, even inside the same law firm.
The app never holds a secret key. Each user proves who they are with a sign-in token, a kind of digital ID card. We check its digital signature on our side, so the app can't just claim to be someone. That ID opens the user's own knowledge base and nothing else. It's the same wall described above, working with real users.
- Each user gets a private library, even within one firm
- We check every user's ID signature on our side
- The app never carries a secret key
- A request sent to the wrong place gets blocked
We'll show each audit once we pass it.
We don't hold SOC 2, ISO 27001, FedRAMP, or other certificates like them today. We won't show badges we haven't earned. We're building toward the standards that regulated and defense customers rely on. We'll post each one when it's real.
See the standards we're working towardReport a security bug
Found a security problem? Please tell us before you tell anyone else. We'll answer quickly and work with you fairly.
Report an issueAsk us anything about how it works.
We're happy to walk you through the design. Email us with questions about how we keep customers apart, how we handle data, or where your data lives.