Every layer of Zorabasket is designed with security and privacy as first-class concerns.
AES-256 encryption at rest. TLS 1.3 for all data in transit. Keys rotated quarterly.
Independently audited annually for security, availability, and confidentiality controls.
Payment card data is processed in a PCI-compliant environment. We never store raw card numbers.
Data residency controls, right-to-erasure API, and DPA available for EU deployments.
Third-party pen tests conducted every six months by certified security researchers.
Immutable audit trail for all admin actions, API calls, and access events. 90-day retention.
We run a responsible disclosure programme. Report security issues to our team and we'll respond within 24 hours.
security@zorabasket.com