What we do
to keep your data safe.
Substantive list of the controls actually in place, the kind of thing procurement asks for. If you need our SAQ-A attestation, internal RLS audit report, or a customized response to a security questionnaire, email abdallah@zayrev.com.
Application security
Postgres Row-Level Security on every multi-tenant table
100% RLS coverage across 95 tenant tables (audit dated May 10, 2026). Every read query from the operator-facing application enforces RLS via the user's JWT. Service-role bypass is reserved for webhooks, jobs, and the /backoffice cross-tenant surface, and even there we explicitly scope every query by organization_id.
Stripe Connect handles all card data
We never see, transmit, or store a full PAN. PCI scope reduced to the SAQ-A category (zero card data touched by our servers).
MFA available for every operator account
TOTP-based MFA via authenticator apps, available to every operator account and strongly recommended for privileged roles (owner, finance, manager, support, and marketing). Backup codes generated at enrollment and stored as SHA-256 hashes.
HMAC-SHA256-signed webhooks
Every webhook Zayos sends is HMAC-SHA256-signed over the JSON body and delivered in the x-zayos-signature header, with a sent_at timestamp in the payload so receivers can reject stale deliveries and a stable x-zayos-delivery-id (identical across retries) so receivers can dedup redeliveries. Signing secrets are encrypted at rest and rotatable from /app/integrations. Inbound webhooks we receive (payments, marketplace) are signature-verified and reject deliveries older than 5 minutes.
Audit logs on every operator-initiated mutation
Order status changes, refunds, menu edits, member adds/removes, integration changes: all logged with actor user_id, role, and IP. Retained 13 months (SOC-2 alignment).
Rate limits on every cost amplifier
Auth, OTP, password-reset, magic-link, promo validation, order placement, and customer-help submission: all rate-limited per-IP × per-brand. 429 returns Retry-After header.
Transport + storage
TLS 1.2+ everywhere
HTTP traffic 308-redirected to HTTPS. HSTS preload on apex domain. Certificate auto-renewal via Let's Encrypt.
AES-256 at rest
Postgres + Supabase Storage file storage encrypted at rest by the provider. Backup snapshots are encrypted and retained 90 days.
Incident response
72-hour breach notification
If we become aware of a personal-data breach affecting your tenant, we email + call within 72 hours with: scope of data affected, timeline, remediation steps, regulatory-notification recommendations.
Public status page
Live subsystem health at /status, polled every 15 seconds. We don't hide outages. We do not yet run an independent status host, so /status is a live health view rather than a posted incident history; during an incident we email affected operators directly.
Compliance posture
SOC-2 Type 1: not yet attested
Internal RLS + access-control + audit-log audit completed May 10, 2026 (clean). We have not completed an external SOC-2 Type-1 attestation. If your review requires one, tell us and we will scope the engagement with you.
GDPR + CCPA / CPRA
Data subject access, correction, deletion supported per /zayos/legal/privacy §7. SCC + UK Addendum available for EU/UK transfers.
PCI scope: SAQ-A
Stripe Connect handles all card data. Annual SAQ-A self-attestation on file.
v1.0 · Last updated May 10, 2026. We update this page when controls change.