What we do
to keep your data safe.
Substantive list of the controls actually in place — the kind of thing procurement asks for. If you need our SAQ-A attestation, internal RLS audit report, or a customized response to a security questionnaire, email abdallah@zayrev.com.
Application security
Postgres Row-Level Security on every multi-tenant table
100% RLS coverage across 95 tenant tables (audit dated May 10, 2026). Every read query from the operator-facing application enforces RLS via the user's JWT. Service-role bypass is reserved for webhooks, jobs, and the /backoffice cross-tenant surface — and even there we explicitly scope every query by organization_id.
Stripe Connect handles all card data
We never see, transmit, or store a full PAN. PCI scope reduced to the SAQ-A category (zero card data touched by our servers).
MFA available for every operator account
TOTP-based MFA via authenticator apps. Required for owner role on accounts with 2+ locations. Backup codes generated at enrollment and stored as bcrypt hashes.
HMAC-SHA256-signed webhooks with replay defense
Every webhook out of Zayos signed with t={timestamp},v1={hmac}. Verification rejects deliveries older than 5 minutes. Webhook secrets rotatable from /app/integrations.
Audit logs on every operator-initiated mutation
Order status changes, refunds, menu edits, member adds/removes, integration changes — all logged with actor user_id, role, and IP. Retained 13 months (SOC-2 alignment).
Rate limits on every cost amplifier
Auth, OTP, password-reset, magic-link, promo validation, order placement, and customer-help submission — all rate-limited per-IP × per-brand. 429 returns Retry-After header.
Transport + storage
TLS 1.2+ everywhere
HTTP traffic 308-redirected to HTTPS. HSTS preload on apex domain. Certificate auto-renewal via Let's Encrypt.
AES-256 at rest
Postgres + R2 file storage encrypted at rest by the provider. Backup snapshots are encrypted and retained 30 days.
Incident response
72-hour breach notification
If we become aware of a personal-data breach affecting your tenant, we email + call within 72 hours with: scope of data affected, timeline, remediation steps, regulatory-notification recommendations.
Public status page
Operational status at /status. We don't hide outages — incidents post automatically when health metrics degrade, before tickets land.
Compliance posture
SOC-2 Type 1: targeted Q3 2026
Internal RLS + access-control + audit-log audit completed May 10, 2026 (clean). External Type-1 attestation in progress.
GDPR + CCPA / CPRA
Data subject access, correction, deletion supported per /zayos/legal/privacy §7. SCC + UK Addendum available for EU/UK transfers.
PCI scope: SAQ-A
Stripe Connect handles all card data. Annual SAQ-A self-attestation on file.
v1.0 · Last updated May 10, 2026. We update this page when controls change.