Security at Zamilo
You trust us with your customers, your orders and your mail. Here is what we do to protect them, in plain words, including what we have not done yet.
Each company kept apart
All companies share one PostgreSQL database, and every row belongs to exactly one company. Row-level security in the database refuses any row that is not the signed-in company's, even if a query in the application forgot to ask; the application checks the company on every query as well, and stamps it on everything it saves. An automated test visits every page as one company with another company's record numbers and must be refused.
Encryption
Everything travels over HTTPS, and browsers are told never to use plain HTTP. Tokens for QuickBooks, Microsoft 365 and Shopify, mailbox app passwords and two-step secrets are encrypted with a key derived for your company alone, from a secret kept outside the database. Passwords are never stored, only salted Argon2id hashes of them, and the links you send customers and dealers are kept as fingerprints, so a copy of the database cannot open them.
Signing in
Two-step sign-in with any authenticator app, with one-time recovery codes; administrators must use it, and your company can require it for everyone. Five wrong passwords lock an account for 15 minutes, sign-in and reset pages are limited per network address, reset links last 15 minutes and work once, and invitations expire. Every signed-in browser is listed on your profile, where you can sign any of them out; signing out ends that browser's session on our side too.
Who can see what
Roles decide which areas and actions each person has. Changes to records are written to an audit trail with who and when, kept as a hash chain so a changed or removed entry shows.
Backups
Every night we back up the whole database to separate object storage and keep about 15 days of copies. Every night we also take a snapshot of each company, kept 14 days, which the company's administrators can download. Restoring follows a written procedure, which we test.
The network
The server accepts no connections from the internet: traffic reaches it only through an encrypted Cloudflare tunnel, behind Cloudflare's firewall. Server logs never record the keys and tokens that can appear in web addresses.
Our own access
The console we use to run Zamilo needs two-step sign-in and shows companies, their status and connection health, not their records. We look at a company's records only when that company asks us to help.
Connections you control
Microsoft 365, QuickBooks and Shopify connect by signing in to them, so we never see those passwords. Pushing anything to another system (a price, an invoice, a purchase order) happens only when you switch it on or press the button. Disconnect any of them at any time.
What we don't claim
Zamilo is a young product. We do not hold SOC 2 or ISO 27001 certification and have not yet commissioned an independent penetration test. We will say so here when that changes. If your company needs a security questionnaire answered, ask us and we will answer it honestly.
Details of how we handle personal information are in the Privacy Policy and the Data Processing Addendum; the companies that help us run Zamilo are on the Subprocessors page.
Found a vulnerability? Tell us.
Email [email protected] with what you found and how to reproduce it. We will confirm we received it, keep you informed while we fix it, and credit you if you would like.
- Test only against your own workspace or one you have written permission to test.
- Do not access, change or delete other companies' data; stop and tell us if you reach any.
- No denial-of-service, spam, social engineering of our staff or customers, or physical attacks.
- Give us reasonable time to fix the problem before sharing it publicly.
We will not pursue legal action against anyone who reports a vulnerability in good faith and follows these rules. Our security.txt has the same contact.
Ready when you are
Zamilo is free while it is in beta. We invite companies in small groups and help each one move in.