The short version
Zeroth Cloud is a security layer, not an analytics product. We collect what we need to detect threats against your systems and to run our business relationship with you. We do not read your content, we do not build profiles of your users, and we do not sell anything to anyone.
If a control in this policy ever conflicts with a commercial incentive, the control wins. That is the entire reason the product is built the way it is.
What we collect
We hold three kinds of information, and it is worth separating them because they are treated very differently.
- Account information: the name, work email and organisation of the people we deal with, so we can contact you and bill you.
- Security telemetry: metadata about the systems we monitor, meaning hostnames, IP addresses, software versions, open ports, certificate details, configuration state and the timing of events.
- Support correspondence: what you send us when you ask for help, including anything you choose to attach.
What we do not collect
This list is as much a part of the product as anything we do collect.
- The contents of your databases, documents, messages or email.
- The identities or behaviour of your website visitors, members or sources.
- Keystrokes, screen contents or session recordings.
- Location data beyond the coarse origin of a network connection.
- Anything at all for advertising purposes. We run no advertising and no ad-tech is present on our platform.
Why we hold it
- To detect and respond to threats against the systems you have asked us to protect.
- To notify you when something needs a decision only you can make.
- To maintain, secure and improve the service itself.
- To meet our own legal and accounting obligations.
We do not use your data to train models that serve other customers without a separate, explicit and revocable agreement with you.
Who else sees it
A small number of infrastructure providers process data on our behalf under contract: hosting, error monitoring and payment processing. They are bound to our instructions and cannot use your data for their own purposes.
We do not sell, rent or trade personal data. If we are ever compelled by lawful process to disclose something, we will tell you before we comply unless we are legally prohibited from doing so, and where we are prohibited, we will tell you as soon as that prohibition lifts.
How long we keep it
- Security telemetry: 90 days rolling, unless it forms part of an open incident.
- Incident records: 24 months, because patterns matter across years.
- Account and billing records: seven years, as required for accounting.
- Support correspondence: 24 months.
When you leave, we delete monitoring data within 30 days and confirm in writing that it is gone.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to a particular use. We do not charge for this and we do not require a specific form of words.
We aim to respond within 14 days. If we cannot do what you have asked, we will explain why rather than going quiet.
Changes to this policy
If we change anything material we will email account contacts before it takes effect, not after. The effective date at the top of this page always reflects the current version.
Questions about this policy go to hello@zerothcloud.com. We answer within one business day, and we will tell you plainly if the answer is that we do not know yet.