Security claims stay within the tested boundary.
We describe the safeguards we operate and the mechanisms behind them, without claiming certifications we have not earned.
Last updated August 19, 2026.
Security scope
Zennvue includes a public marketing and discovery website plus a separate authenticated application. Public descriptions of safeguards do not represent an independent audit, certification, penetration-test result, or guarantee that incidents cannot occur.
Website safeguards
The website deployment enforces HTTPS, HSTS, content-type protection, clickjacking protection (X-Frame-Options DENY and frame-ancestors none), a restrictive permissions policy, referrer controls, and a content security policy that runs without inline script execution. Optional analytics and advertising are consent-gated, and CSP violation reports are collected for monitoring.
Application safeguards, stated with their mechanisms
The application encrypts data in transit with TLS 1.2 or higher and at rest with AES-256 through the managed database and storage layers it runs on. Vendor workspaces are isolated per tenant through a tenant-scoped data model, and access inside a workspace is controlled by role-based access control (workspace roles with least-privilege defaults). Payment-card handling is provided through Stripe, so card data never touches Zennvue systems. These descriptions state the mechanisms we operate; they are not a third-party attestation.
Shared responsibility
This website runs on Render (application hosting and build infrastructure) behind Cloudflare (edge delivery, TLS termination, and network protection); Stripe processes payments. Physical, environmental, and infrastructure-layer controls for this website are operated by those providers under their own compliance programs; Zennvue operates the application layer, code, configuration, consent behavior, and data handling described here. The full provider list is published at /subprocessors/.
Independent assurance
Zennvue does not claim certifications it does not hold. SOC 2 Type I is on our security roadmap; enterprise customers can request our current security overview and shared-responsibility documentation by email while that work is underway.
Vulnerability reporting
Follow /.well-known/security.txt. Test only with authorization, avoid privacy impact and service disruption, stop if personal data is exposed, and allow reasonable time for investigation and remediation before disclosure.