Security
What is true today, stated plainly. Where something is not in place yet, this page says so rather than implying otherwise.
Sign-in
Handled by Clerk. We never see or store a password. Every request carries a token that is verified on arrival, and the token's authorised-party claim is checked against a fixed list of our own origins — a token minted for anywhere else is refused.
One company's data is not another's
Every record belongs to a workspace, and membership of that workspace is checked on every single request rather than once at sign-in. A request for a workspace you do not belong to is answered as not found — not as forbidden, which would confirm it exists.
Roles
Owner, admin, member and viewer, plus departments. A role is enforced on the server for every write, including writes that arrive through the API or the Claude connector rather than the interface.
Every change is recorded
Who changed what, and when — and whether the who was a person, an agent or the system itself. Attachments, comments and status moves are all in the same history.
In transit
Everything is served over HTTPS, with security headers set at the edge. The public site loads nothing from any third party at all: no analytics, no advertising pixels, and typefaces served from our own servers.
Where it lives
In managed Postgres in the United States, with uploads in Cloudinary and sign-in at Clerk. The full list of processors is in the Privacy Policy, and it is the complete list rather than a sample.
What we do not do
We do not sell your data, do not share it for advertising, and do not train anything on it. We do not read what you put into Zephyro except when you ask us to help with a specific problem.
Reporting a weakness
Write to us and say so in the subject line. Please give us a reasonable chance to fix it before making it public — and we will not pursue anyone for reporting one in good faith.