Security & System Governance
Effective Date: October 23, 2026 • Last Updated: October 23, 2026
At ZeroComplex AI (“ZeroComplex”), security is an integral requirement of building software businesses can rely on. Our work involves business processes, customer communications, operational records, and sensitive workflow data. We aim to protect that information through careful engineering, controlled access, appropriate data handling, and continuous review.
Core Security Principles
Our engineering posture and security governance are anchored in six foundational principles:
Least Privilege
Access is strictly limited to authorized people, systems, and services that require it for specific operational roles.
Defence in Depth
Multiple layered safeguards are deployed across network, application, and database tiers so no single safeguard is relied upon alone.
Data Minimisation
Systems are architected to collect, expose, and retain only information reasonably needed for the intended enterprise purpose.
Secure by Design
Security and privacy implications are evaluated during initial architecture, development cycles, deployment, and ongoing change control.
Accountability
Clear operational ownership is defined for system access, production changes, incident mitigation, and audit remediation.
Continuous Improvement
System risks, logging telemetry, and threat landscape controls are reviewed and upgraded as workloads and requirements evolve.
2. Access control and account security
Depending on the product and deployment, controls may include role- or permission-based access; individual accounts where supported; authentication requirements and secure credential handling; restricted administrative access; access reviews when roles change or access is no longer needed; and logging of relevant access or administrative events.
Customers are responsible for managing their own users, assigning appropriate permissions, protecting credentials, and removing access for people who no longer need it. Notify us promptly if you suspect an account or credential connected to a ZeroComplex service has been compromised.
3. Data protection and encryption
We design systems to protect data in transit and at rest using safeguards appropriate to the service and risk. Where implemented and appropriate, safeguards may include encrypted network connections (TLS 1.3), encryption at rest provided by the application or infrastructure provider (AES-256), controlled secrets management, and restricted access to stored files and backups.
Encryption is one part of a broader security programme. It does not by itself prevent compromised accounts, misuse by authorised users, insecure application logic, or exposure through misconfiguration.
4. Infrastructure and environments
Our services rely on modern cloud hosting, databases, storage systems, APIs, and vetted third-party infrastructure providers. We configure these environments to reduce unnecessary exposure and limit access to sensitive systems.
- Logical separation of development, test, and production environments where practical;
- Restricted access to infrastructure and administrative interfaces with MFA enforcement;
- Protection and rotation of API credentials, tokens, and cryptographic secrets;
- Continuous application of security patches and package updates; and
- Automated backups and disaster recovery procedures appropriate to service requirements.
Cloud providers operate underlying physical and hardware infrastructure controls. ZeroComplex remains responsible for configuration and application-level controls within its scope, as set out in the relevant agreement.
5. Secure development and change management
We incorporate security into our software development lifecycle. Practices include reviewing requirements for security and privacy implications; reviewing code and pull requests according to project risk; automated linting and dependency scanning; testing changes before production release; limiting direct production access; and cataloguing and addressing known vulnerabilities according to severity.
6. Monitoring and vulnerability management
Where supported, system logs, monitoring, and diagnostic telemetry help us identify operational anomalies, suspicious activity, runtime errors, and potential security incidents.
We evaluate reported vulnerabilities and security findings based on exploitability, impact, exposure, and the sensitivity of affected data. Remediation may include an immediate software patch, configuration hardening, mitigative network controls, or additional telemetry.
7. Backups, availability, and recovery
For services where we manage data storage or application infrastructure, backup and recovery arrangements depend on the service architecture and enterprise contract. Backups are intended to support recovery from accidental loss, corruption, or hardware disruption.
Customers should review service-specific backup, recovery point objectives (RPO), recovery time objectives (RTO), and data-export commitments rather than assuming a uniform recovery level across all tools.
8. AI systems and external providers
Some products use AI foundation models, inference APIs, messaging platforms, payment processors, or external software tools. We evaluate relevant providers and limit information sent to what is strictly necessary to deliver the feature.
AI outputs can be probabilistic, inaccurate, or incomplete. Customers must maintain appropriate human review and operational controls where automated actions could affect financial, legal, clinical, safety, or contractual commitments. AI features should never be treated as an unmonitored substitute for required professional oversight.
9. Incident response
We maintain formal processes for assessing, containing, and responding to suspected security incidents:
- Triage, scope validation, and risk severity assessment;
- Isolation and containment of affected systems or access tokens;
- Forensic investigation of system telemetry and execution traces;
- Remediation, security hardening, and safe system recovery; and
- Prompt notification of affected customers, regulators, or partners as required by contract and applicable law.
10. Customer responsibilities
Security is a shared responsibility. Customers are responsible for:
- Submitting data only when legally authorized to do so;
- Selecting appropriate user permissions and configuring role-based access;
- Protecting passwords, API keys, tokens, and multi-factor authentication devices;
- Configuring third-party integrations and webhook endpoints securely;
- Reviewing automated agent outputs and establishing appropriate review gates; and
- Promptly reporting any suspected compromise or unauthorized account access.
Reporting a Security Vulnerability
If you believe you have found a security vulnerability in a ZeroComplex service or website, contact security@zerocomplex.ai with the subject “Security Report”.
Please include a concise description, affected endpoint or component, reproducible steps in an authorized testing environment, and potential impact. Do not access or modify another person’s data, perform destructive testing, or disclose the vulnerability publicly prior to coordinated remediation.
12. Independent assurance and certifications
We identify independently verified certifications, audit reports, penetration tests, or compliance attestations only where they are current, applicable to the relevant service, and authorized for disclosure.
Enterprise customers may contact us to discuss security questionnaires, architecture diagrams, data handling controls, and enterprise compliance requirements under NDA.
13. Changes
We may update this overview as our infrastructure and operational controls evolve. The “Last updated” date at the top of this document will reflect material modifications.