Trust & security

LiveEvery table that holds workspace data carries the workspace id, and PostgreSQL row-level security is forced on each: a query with the wrong workspace set returns nothing, including for the application's own database role. Cross-workspace reads are tested in CI against a non-superuser role.

Workspace roles (Admin, Project admin, Member, Client, Viewer) with per-project roles on top, custom roles bounded by a permission ceiling, and a client view that hides internal fields, comments, attachments and activity on everything a client contact can reach. Issue security levels keep individual issues to named roles, teams and people; everyone else never sees them in lists, search, exports or notifications, and reports count them without naming them.

LiveEvery administrative and configuration change is written to an append-only audit log with the actor, the before/after state, the address and the time. Retention is set per workspace (30 days to 20 years, or forever).

LiveWorkspace administrators can restrict use to named IP ranges in Admin, Security. Public pages such as this one, status shares and surveys stay reachable.

Argon2id-hashed. Ten failed attempts lock the account for fifteen minutes; sign-in surfaces are additionally throttled per address.

TOTP authenticator apps with single-use recovery codes. A workspace can require it for everyone, with an optional grace period for enrolment.

OpenID Connect with any compliant identity provider, with optional just-in-time provisioning and allowed email domains. Zenyto Flow still issues the session, so revocation and roles are unchanged.

SCIM 2.0 for Microsoft Entra ID, Okta and other SCIM clients: the directory creates, updates and deactivates staff accounts and team memberships. Deprovisioning deactivates and never deletes. The SCIM token works only on the SCIM endpoints, one per workspace, and while it is connected SSO no longer creates accounts. Administrators' sign-in addresses cannot be changed by the directory.

LiveAccess tokens last 15 minutes. Refresh tokens are opaque, hashed at rest and rotated on every use, with reuse detection; a workspace sets their lifetime from 1 to 30 days (default 14) and an optional idle timeout. Administrators can sign anyone out of every device.

API keys act as the person who made them, within chosen permissions, and are stored as hashes. Outbound webhooks are signed with HMAC-SHA256 over a timestamp and the body, so a receiver can verify the sender.

—

—

—

—

—

— recovery point · — recovery time

Scanned for malware on upload, served with a restrictive Content-Security-Policy, limited to 100 MB per file.

Optional and switched on per workspace. Every AI feature has a non-AI path, and only field names and enum values leave the system for natural-language search; issue content is never sent to a model unless a workspace connects its own provider key.

The status page shows 90 days of minute-by-minute uptime for the API, the database and background jobs, the month against the availability target, and every declared incident. A minute with no probe counts as downtime.

Every release passes an automated review and test gate before deploying and is listed on the release notes page. Database changes are additive only, so a release can be rolled back without touching data.

Email security@zenyto.com with your questionnaire or your questions; we answer within five business days.

Same address. Please include steps to reproduce. We acknowledge within two business days and do not pursue researchers who act in good faith.

—