Security
ZippyPro is built to keep your business data safe by default. We combine strong encryption, hardened infrastructure, and thoughtful product design so you don't have to be a security expert to use it confidently.
All customer data is encrypted in transit and at rest using modern, industry-standard encryption.
Per-person permissions, password re-checks before sensitive actions, and secure session tokens help keep accounts protected. Two-step sign-in codes at login are coming soon.
Continuous monitoring, detailed audit logs, and protections against abusive traffic help us quickly spot issues and keep the platform stable and secure.
Encryption & Access Controls
Encryption
All customer data is encrypted in transit using modern TLS and at rest using strong industry-standard encryption. Database connections are encrypted end-to-end to prevent eavesdropping.
Multi-Factor Authentication
Each team member can set up an authenticator app for their own login today. Asking for that code at every sign-in is coming soon; until then, sign-in uses your password.
Role-Based Access Control
Owners and admins choose what each team member can see and change, enforced on the server, so people only see and change what they need for their role, reducing the impact of mistakes or compromised accounts.
Audit Logging
Sensitive actions such as data deletion, settings changes, and exports are recorded with timestamps, user identity, and source information so you can see who did what and when.
Rate Limiting
Built-in rate limits on API and authentication endpoints help prevent abuse, slow down bots, and protect against brute-force login attempts.
Session Management
We use secure sign-in tokens that rotate automatically.
Infrastructure
Database & Authentication
We use a managed PostgreSQL database with built-in row-level isolation so each customer's data stays logically separated. Our database platform is independently audited under SOC 2 Type II to meet modern security and reliability standards.
Hosting & CDN
ZippyPro runs on a global edge hosting platform with automatic protection against large-scale attacks such as DDoS. The underlying infrastructure is SOC 2 Type II audited, giving you the same class of safeguards used by mature SaaS companies.
Payments
Payments are processed by a PCI DSS Level 1 certified provider. ZippyPro never stores or directly handles raw payment card numbers, reducing your exposure to card-related risk.
Communications
Messaging is handled by an established communications provider that maintains SOC 2 Type II compliance. Inbound webhooks are cryptographically signed and verified to ensure they actually come from our provider and haven't been tampered with.
Transactional email is delivered over encrypted channels (TLS) whenever supported by recipients' mail servers, avoiding plain-text transmission of sensitive content in transit.
AI Processing
AI features use API-only integrations with AI providers (currently OpenAI, Perplexity and Tavily). Data sent to these APIs is used to power your features.
Data Protection
Multi-tenant Isolation
Each customer's data is logically isolated. Every database query is scoped to the authenticated account so one business cannot view or modify another's information.
Input Validation & Application Safety
All user input is strictly validated on the server to prevent injection attacks and accidental data corruption, keeping your workspace data clean and consistent.
Browser-Side Protections
We enforce a strict Content Security Policy and tight CORS rules so scripts only run from trusted sources and APIs only accept requests from approved domains, helping mitigate common web attacks like XSS.
Secure Authentication for Crew
Crew members sign in to the Crew Portal with a personal PIN from their invite link. ZippyPro does not collect biometric data.
PIN Security
Crew PINs are stored in a one-way, cryptographically protected form. Plain-text PINs are never stored or logged.
Error Monitoring
Production systems are continuously monitored for errors. We capture and alert on issues while scrubbing sensitive data from error reports to protect user privacy.
Data Backup & Recovery
Automated Backups
Your data is backed up automatically every night, and a copy is kept with a separate storage provider from the primary database to reduce the impact of an outage at either one.
Recovery Capabilities
In the event of accidental deletion or data corruption, we can restore your workspace from a recent nightly backup, helping you get back on track quickly.
Self-Serve Data Export
Workspace owners can export their data on demand from the in-app Data Export settings, so you always retain control and can keep your own copies when needed.
For security questions or to report a vulnerability, contact security@zippypro.app