We do not access your content
Zeroth Cloud does not log or access your internal content, user data or private communications. Our monitoring operates on metadata and system state (what software is running, what is reachable, what changed and when) rather than on what your organisation is saying or storing.
This is enforced technically, not just by policy. The agents that run inside your environment have no read path to application data, and the pipeline that receives telemetry rejects payloads carrying content fields.
Where data lives
Telemetry is processed and stored in the region you select at onboarding and does not leave it in the ordinary course of operation. Backups stay in the same region.
If your threat model requires a specific jurisdiction, or requires avoiding one, tell us during onboarding. It is a configuration question, not an exception.
Encryption
- In transit: TLS 1.3 between your systems and ours, with certificate pinning on the agent.
- At rest: AES-256 on every store that holds customer telemetry, including backups.
- Secrets: held in a dedicated secrets manager, never in configuration files or source control.
- Passwords: hashed with Argon2id. We cannot recover them, only reset them.
Who can touch it, internally
Access to customer telemetry is role-based, granted for a named reason, time-limited and logged. Engineers do not have standing production access; they request it, it expires, and the request is visible to the rest of the team.
Every member of staff with any access to production is subject to phishing-resistant multi-factor authentication on hardware keys. There are no exceptions for seniority.
Subprocessors
We keep the list short deliberately, and we publish it. Before we add a subprocessor that will handle customer telemetry, we give account contacts 30 days’ notice, and you may object.
Current subprocessors cover hosting, transactional email and payment processing only. None of them receive the contents of anything you protect.
If something goes wrong
We will tell you. Our commitment is notification to affected customers within 72 hours of confirming an incident that involves their data, with what we know, what we do not yet know, and what we are doing about it.
- You get a named contact for the duration, not a ticket number.
- You get updates on a fixed cadence even when there is nothing new to report.
- You get a written post-incident review, whether or not you ask for one.
Getting your data out
Export your telemetry and incident history at any time in a documented, non-proprietary format. There is no fee for leaving and no retention period during which we hold your history hostage.
Questions about these commitments go to hello@zerothcloud.com. We answer within one business day, and we will tell you plainly if the answer is that we do not know yet.