Security at Zyntra Hub

We build software that businesses use to talk to their own customers, so we treat security as a core feature, not an add-on. This page describes the protections in Zyntra Connect today. The same foundations will be used by every Zyntra product.

Account security

• Passwords are stored with Argon2id, a modern memory-hard hashing algorithm. In production, new passwords are checked against known data breaches without sending the password anywhere.
• Two-factor authentication with an authenticator app, protected against code replay, plus single-use recovery codes.
• Short-lived signed access tokens and rotating refresh tokens. Reusing an old refresh token signs the session out, which stops stolen tokens.
• You can see every device signed in to your account and sign any of them out instantly.
• Security alert emails when your password, email address or two-factor settings change.
• Sign-in attempts are rate limited per account and per network to stop password guessing.

Data isolation between organizations

Each organization's records are separated using PostgreSQL row-level security. The database itself refuses to return or change another organization's rows, even if a bug in the application asks for them. The application adds its own checks on top, and automated tests prove the isolation on every change.

Access control and auditing

• Roles inside each organization (owner, admin, manager, agent), with sensitive actions limited to owners.
• An audit log records security-relevant events such as sign-ins, role changes and data exports, with time and IP address.
• Our own staff access is limited by role, requires two-factor authentication, and is recorded in the audit log.

Infrastructure and application security

• HTTPS everywhere, with HTTP Strict Transport Security.
• A strict Content Security Policy and other browser security headers on every page.
• Authentication tokens are kept in secure, httpOnly cookies that page scripts cannot read.
• Secrets such as two-factor keys are encrypted at rest.
• Dependencies are audited for known vulnerabilities on every change.

Your data rights

You can download a copy of your personal data and delete your account yourself, in line with India's Digital Personal Data Protection Act, 2023. Read our privacy policy and data deletion instructions.

Reporting a security issue

If you believe you have found a security vulnerability in any Zyntra product or in this website, please email contact@zyntrahub.in with the subject "Security report". Include enough detail for us to reproduce the issue. We will acknowledge your report within two working days and keep you informed while we fix it.

Please do not access or change other people's data, disrupt our services or publish the issue before it is fixed. We will not take legal action against researchers who follow these guidelines in good faith. Our security.txt file lists the same contact.