Security & Responsible Disclosure

How we protect you

• Encrypted connections: every page and the client portal use HTTPS, and browsers are told to always connect securely.
• Passwords: we never store passwords in readable form. They are protected with a strong one-way hash.
• Team access: our team signs in through a private address with two-step verification, and each person only sees the parts of the system their role needs.
• Payments: card and PayPal payments are processed by PayPal. We never see or store your full card number.
• Monitoring: we watch for errors and attacks around the clock, block abusive traffic automatically and keep an activity log of important account actions.
• Your files: files you share with us are kept private and are only available to you and our team after signing in.

Report a vulnerability

If you believe you have found a security vulnerability in zeyweb.com or our client portal, please email security@zeyweb.com. We will confirm that we received your report within 3 business days and keep you updated until it is resolved.

Our contact details for security researchers are also published at /.well-known/security.txt.

What to include

• The page or feature affected and the type of problem.
• Clear steps to reproduce it, with screenshots or a short video if possible.
• The impact you think it has.
• How we can reach you for questions.

Safe harbor

We will not take legal action against you for research done in good faith under this policy. Please:

• Only use accounts you own or test accounts, and never access, change or delete other people's data.
• Stop and report as soon as you find a problem, without exploiting it further.
• Avoid anything that could disrupt our service, such as heavy automated scanning.
• Give us reasonable time to fix the problem before you share details publicly.

We do not run a paid bug bounty program, but we are happy to thank you publicly once a valid issue is fixed, if you would like.

Out of scope

• Denial-of-service attacks, spam and social engineering of our team or clients.
• Physical attacks and anything involving our office or data centers.
• Websites and services run by other companies, such as PayPal, Google or Mailgun. Please report those to them directly.
• Automated scanner output without a demonstrated security impact.