Security you can trust

Zenkona is built with sensible defaults for a small SaaS product — secure by design, transparent about subprocessors, and aligned with POPIA requirements in South Africa.

Secure authentication

User identity is managed by Kinde with industry-standard OAuth flows. We never store passwords directly.

Encrypted storage

Application data lives in a managed PostgreSQL database. Uploaded documents are stored in S3-compatible object storage with access restricted to your workspace.

Workspace isolation

Every obligation, document, and team member belongs to a workspace. Cross-workspace data access is blocked at the application layer.

Signed action links

Email snooze links use HMAC-signed tokens with expiry, so reminder actions cannot be forged or replayed indefinitely.

Infrastructure

The application runs on Railway with automated deployments. Database backups and uptime monitoring are handled by the hosting provider.

Transactional email only

We send renewal reminders, digests, and account notifications. No marketing spam, and no selling your contact data.

Data protection compliance

We process personal information in accordance with the Protection of Personal Information Act (POPIA). EU and UK users receive GDPR-aligned rights where applicable. Read our Privacy Policy for full details on data collection, retention, and your rights.

Subprocessors

We use trusted third-party providers to operate Zenkona. A full list with purposes and locations is available on our Data Processing Summary.

Report a vulnerability

If you discover a security issue, please report it responsibly to [email protected]. We aim to acknowledge reports within 48 hours.