Security
Stronger security for brighter futures.
Your record holds evidence about you, so it is protected by design: least privilege on every access, encryption in transit and at rest, and a written route for anyone who finds a weakness. This page describes the design — not a certificate.
Your Data.ProtectedBy Design.
Security is not a feature. It is a responsibility that every layer carries.
- Least privilegeThe right access, for the right person, for the purpose
- Encrypted by designIn transit and at rest, on every store and every link
- Tenant-separatedOne deployment's data never reaches another's
- Logged and answerableAccess is recorded, so it can be accounted for
- A route to reportThrough the contact form, read by a person
Our security pillars
A layered approach to security.
Six areas the design is held to, across people, process and technology. Each is a commitment about how the platform is built.
- Infrastructure securityIsolated, hardened, and separated from what is public.
- Data securityEncrypted in transit and at rest, keys held apart, minimised first.
- Identity and accessLeast privilege on every access: declared, checked and recorded.
- Application securityThreats considered before a feature is built; every route tested against misuse.
- Monitoring and responseAccess and change logged; a named route for who acts and who is told.
- AssuranceReviews and tests that leave a record. No certification held or claimed.
Our commitment
Your trust is our foundation.
Pathways follows a defence-in-depth design: no single control is trusted to hold on its own, every access is scoped to a purpose, and what happens to a record is logged so it can be answered for. The aim is not to claim nothing can go wrong. It is to be able to say what happened, quickly and honestly, if it does.
- Protect the person's record first
- Prevent access outside a stated purpose
- Separate every deployment's data
- Log what is accessed and changed
- Report and repair, with the people affected told
Security is not a feature. It is a responsibility.
Plainly stated
Certification and what is claimed
The difference between how something is designed and what a third party has verified matters. This page keeps to the first.
No ISO information-security certification, no SOC report and no other third-party security certification is held or claimed today. None is implied by anything on this page or elsewhere on this site.
This page describes how the platform is designed. It does not describe what an independent party has verified, because no independent verification has been completed. That difference is stated rather than blurred.
No uptime figure, incident count or response time is published, for the same reason: none is measured over a period a reader could check. When a figure is measured and verified, it will appear with its method and its dates.
How to report a concern
If you find a weakness in this site or in a Zynaut deployment, tell us through the contact form. Say what you found and how to reproduce it. Do not access, change or keep data that is not yours while doing so.
Reports made in good faith are welcome. A person reads every report, acknowledges it, and tells you what was done about it.
- Least privilegeAccess scoped to a purpose and a person
- Encrypted by designIn transit and at rest
- Tenant-separatedNo route between deployments
- Logged and answerableWhat was accessed, by whom, for what
- Minimised firstWhat is not held needs no defending
- Reported to a personThrough the contact form
Questions people ask
Security, in plain answers
Is my data encrypted?
The platform is designed to encrypt data in transit and at rest, with keys held apart from the data they protect. That is a statement about the design. No third party has yet verified it, and this page does not say otherwise.
Who inside Zynaut can access my record?
Access is scoped by least privilege: a person or a service sees only what a declared purpose requires, and every access is logged. Operational access to a record is not routine, and where it happens it is recorded so it can be answered for.
Does Zynaut hold a security certification?
No, and none is claimed. A certification needs a certificate, a scope statement, an issuing body and validity dates, and none of those exists today. When they do, they will be published together, not as a badge.
Where is my data held?
Not stated yet. Where data is held, and under which country's law, is a fact each deployment will state with its own terms. This site does not claim a location or a jurisdiction for the platform as a whole.
What happens if there is a breach?
The design names a response route: who acts, what is contained first, and how the people affected are told. Being designed for India's Digital Personal Data Protection Act means telling the people affected is part of that route, not an afterthought. No incident count is published, because none is measured.
How do I report a vulnerability?
Through the contact form. Describe what you found and how to reproduce it, and do not access, change or keep data that is not yours in the process. A person reads every report, acknowledges it, and tells you what was done.
