Zero Door SaaS is operated by Zerone on OVHcloud infrastructure inside the European Union; the target region is Paris. The exact data centre is stated in your order form.
Trust centre
What we promise, in writing.
Hosting, availability, disclosure and the frameworks we map to. If it is not on this page, ask and we will put it here.
SaaS
Your fleetOVHcloud · Paris, EU
Self-hosted
Your data centredata stays where it runs
Air-gapped
Air-gapped sitenothing leaves
Rules
Four rules, and how to check each one.
Nothing is trusted for having been there yesterday.
The first scan weighs every binary, library and package already on the host against the original. A baseline records what is there; it does not bless it.
How to check itIn a pilot, read the first scan rather than waiting for the first alert: a file that was altered before the install surfaces on day one.
See the proof: Nothing is trusted for having been there yesterday.Evidence checks out without us.
Evidence leaves as a signed bundle with its own verifier. It checks offline, with no account and no call to our servers.
How to check itExport an audit bundle and run its verifier on a machine with no network. It checks the manifest, the Ed25519 signature and every evidence file, and ends in PASS or FAIL.
See the proof: Evidence checks out without us.Change is a question, not an alert.
Every change is weighed first: is it the original, which package shipped it, which process wrote it, was it inside a change window. A Windows update folds into one alert per server.
How to check itWatch one patch day in a pilot. The update shows up once per server, with its file count and its evidence, and a file that fails the check still stands on its own.
See the proof: Change is a question, not an alert.Every detection runs behind your air gap.
The self-hosted build is the same product: an offline signed licence, signed updates you carry in, a local copy of the legitimacy database. What needs a route out is named and off: reputation lookups and trusted timestamping.
How to check itSwitch an install to offline and compare. Every detection keeps running; reputation lookups and trusted timestamping go quiet, and vulnerability data waits for the next update you carry in.
See the proof: Every detection runs behind your air gap.
Hosting, residency and retention
Self-hosted and air-gapped editions keep all data where you run them.
Retention periods are set per tenant, under a ceiling that rises with the edition. A legal hold overrides deletion, and what was purged is written to an enforcement log.
Availability and incident notice
99.5%
monthly availability
Monthly availability 99.5%, the same on every tier.
48 h
customer breach notice
Customer breach notice within 48 hours, on every tier.
- Liability cap: fees paid in the last 12 months; twice that for data protection.
Service status
There is no public status page yet. Incidents and maintenance windows are announced by e-mail to the technical contact on the order form.
Sub-processors
The sub-processor list is published after the standard contractual clauses are registered with the supervisory authority. Until then it is provided on request to customers under NDA.
Frameworks we map to
- ISO/IEC 27001:2022
- NIST SP 800-53 Rev 5
- NIST CSF 2.0
- PCI DSS v4.0
- SOC 2
- HIPAA Security Rule
- GDPR
- CIS Controls v8
- NATO catalogue (illustrative)
- Turkish Cyber Security Law 7545
- KVKK Personal Data Security Guide
- BDDK banking IT regulation
- Information and Communication Security Guide
Thirteen frameworks ship built in. Mapping means the audit trail and reports are organised by these controls. It does not mean Zerone holds a certificate for each framework; certifications are listed here when obtained.
Vulnerability disclosure
Report vulnerabilities to security@zeronesecurity.com. We acknowledge within two working days and do not pursue good-faith researchers. The full policy and safe-harbour terms are in the legal texts.
Acknowledgements
No vulnerability report has been credited yet. The authors of reports we validate are listed here under the name they choose, or anonymously.
# Zerone Security vulnerability reporting (RFC 9116)# Please do not report security issues in public channels.Contact: mailto:security@zeronesecurity.comEncryption: https://zeronesecurity.com/.well-known/pgp-key.txtAcknowledgments: https://zeronesecurity.com/trust#acknowledgementsPolicy: https://zeronesecurity.com/trust#disclosureExpires: 2027-09-01T00:00:00.000ZPreferred-Languages: en, trCanonical: https://zeronesecurity.com/.well-known/security.txtAccessibility
We build to WCAG 2.2 level AA and check it on every change, not once a year. Every page is scanned automatically, and several criteria a scanner cannot judge (reflow, obscured focus, pause controls) are covered by scripted browser tests.
- Automated checks on every page, in both languages, on every change.
- Reflow at 320 CSS pixels and focus that the sticky header never hides.
- Motion respects the operating-system reduced-motion setting, and every continuous animation has a pause control.
This page, verified.
Every inline script on this page matches a digest in its security header
The browser runs no inline script whose digest is missing from that list, including one injected after the page was served. The digests below were read from this page and are in the page source.