Security Dashboard

Quick answers

Program evidence: Vanta Trust Center | Audit engagement letter

Access controls

• Workspace access is enforced at the application layer by membership checks on workspace-scoped routes.
• Role-based access control governs privileged actions (Owner, Admin, Viewer).
• Least-privilege access for production credentials and admin tooling.
• Access logs are retained for at least 90 days.

Processing scope

• Hosting, storage, and collaborative editing of Workspace Data.
• AI-assisted content generation and workflow assistance.
• Product analytics limited to usage and event telemetry; for authenticated users this may include account identifiers.
• Support, maintenance, security monitoring, and service improvement as permitted by the Terms and any executed DPA.

Data protection and recovery

• Nightly encrypted snapshots retained for 5 days and purged by rotation.
• Target restore time objective (RTO): 2 business days for incidents caused by Zentrik.
• Target recovery point objective (RPO): time of last successful snapshot.

Security monitoring

• Integrated monitoring of application dependencies for known vulnerabilities, with defined triage and ownership.
• Automated checks in our build pipeline—including scheduled verification—that block critical-severity dependency or container-definition issues when those surfaces change.
• Remediation targets: critical within 7 days; high within 30 days where feasible.

For security questionnaires or implementation detail (tooling, cadence, evidence), contact security@zentrik.ai.

AI usage and training policy

• Customer data is not used to train public AI models.
• AI providers are accessed via API (OpenAI, Anthropic, and Google services if enabled).
• Processing locations may depend on provider capabilities and Customer configuration.
• Private-model options may be available by request and configuration.

Processing locations and infrastructure (current)