Security
What we do to protect your account
No badges or generic promises: this is the list of measures running in Zafnat Analytics today, from how you sign in to how we store backups.
Access and accounts
- Mandatory two-step verification on every account, with recovery codes.
- Passwords hashed with scrypt and checked against known breaches.
- Progressive lockout after failed attempts and email notices of unusual sign-ins.
- Sessions that expire after inactivity, and control over your open sessions.
Platform protection
- Connections encrypted with TLS 1.2 or higher and HSTS.
- Strict security headers (CSP, HSTS, COOP) and CSRF protection.
- Request inspection and automatic blocking of attacks (injection, brute force, scanning).
- Audit log of account activity and of every privileged action.
Infrastructure and data
- Services in unprivileged, read-only containers.
- Database on an internal network, with no access from the Internet.
- Keys and secrets encrypted; daily backups encrypted with AES-256.
- Regular defensive audits and an incident response plan.
Privacy and GDPR
- We only process the data strictly needed to provide the service.
- Download all your data, correct it or delete your account from your profile.
- Retention periods and automatic anonymisation.
- Marketing communications only if you opt in.
Need more detail for your procurement team?
We have security documentation for supplier assessments: policies, a controls matrix, an incident response plan and a record of processing. Just ask.
Try it with the series you check most.
Create your account in a minute. No lock-in: cancel whenever you want.