Security practices
The same controls apply across both product families.
Strong sign-in
Single sign-on over OpenID Connect and SAML, multi-factor authentication and passkeys. Customers can require their own identity provider.
Least privilege
Role-based access with scopes (for example a team, location or work centre) in Thoshika; just-in-time, approved and time-bound access in Ciyora Fabric.
Tenant isolation
Each customer’s data is separated at the database layer with PostgreSQL row-level security in Thoshika, and per-tenant isolation in Ciyora Fabric.
Encryption
Traffic to our services is encrypted in transit with TLS. Secrets are kept out of source code and supplied to each environment separately.
Audit trails
Sensitive actions, approvals and data changes are logged. Ciyora Fabric chains audit records with hashes so tampering is detectable.
Hosting
Hosted on OVHcloud infrastructure; India hosting is being set up. Data processing follows DPDP Act 2023 obligations.
The Digital Personal Data Protection Act, 2023
When customers use our products to process personal data about their employees, customers or users, the customer is the Data Fiduciary and ZPOA acts as its Data Processor.
What we do as a Data Processor
- Process personal data only on the customer’s documented instructions and for the purposes of the service.
- Apply reasonable security safeguards to prevent personal data breaches.
- Tell the customer without delay about a personal data breach affecting their data, so they can notify the Data Protection Board and affected people.
- Help customers respond to data principals who ask to access, correct or erase their data.
- Delete or return customer data when the contract ends, subject to legal retention duties.
In the products
- Consent capture and records where the product collects personal data on the customer’s behalf, for example marketing consent in Thoshika Marketing.
- Role-based access so personal data is visible only to the people whose job needs it.
- Ciyora Monitor is built for transparent monitoring: employee notices, acknowledgements and audit trails are built in; organisations configure monitoring under their own legal obligations.
For our own website and account data, ZPOA is the Data Fiduciary. See our privacy policy.
Report a security issue
If you believe you have found a vulnerability in a ZPOA product or website, please email us with the details and the steps to reproduce it. We will acknowledge your report, keep you informed and credit you if you wish. Please do not access other people’s data, degrade our services or disclose the issue publicly before we have fixed it.
Certifications and reports
We do not claim certifications we do not hold. When independent audits or certifications are completed, their reports will be listed here and shared with customers under a non-disclosure agreement.
Customers evaluating our products can request our security questionnaire responses and a data processing agreement.