Trust Center
Trust is an artifact, not a promise.
This page states what we hold, what we are working toward, and how to reach us when something is wrong.
At a glance
- Data plane
- kaveo and Aegis run in your environment. Vectasec uses a hosted control plane.
- Scanning
- Read-only
- Disclosure
- 48h acknowledgement · 7-day assessment
- SOC 2 Type II
- In progress
Security posture
How the products handle your data.
Architecture
kaveo and Aegis deploy inside your environment and send no scanned data or audit records to ZHASK. Vectasec runs on a hosted control plane today. By default its workers connect to your systems directly, using credentials held in the control plane's vault. For systems inside your network, an optional Collector runs the same checks there, keeps credentials and the raw configuration local, and sends findings with their observations and resource metadata. Self-hosting is in preview.
Data handling
kaveo writes findings and evidence to its own Postgres in your environment. Aegis writes its audit log to the ClickHouse you run. Vectasec stores findings, the observations behind them (which quote the settings each rule read), resource names and labels, and cloud-mode connection secrets in its hosted control plane. With a Collector, credentials and the raw configuration stay in your network.
Read-only guarantee
Scanning is read-only everywhere — kaveo and Vectasec collect through read-only roles whose policies are published and diffable. Two capabilities go further, and both are opt-in. kaveo can draft and apply remediations, which requires a separate write role and stays a dry run until you explicitly enable an executor. Aegis is an inline gateway: it authorizes, holds or blocks the tool calls your agents send, and forwards only the calls your policy admits.
Compliance
Status, stated honestly.
| Framework | Status | Notes |
|---|---|---|
| SOC 2 Type II | In progress | In progress. The report will be available to customers under NDA once issued. |
| ISO 27001 | Not yet pursued | Planned after SOC 2 Type II. We will not imply it before we hold it. |
| GDPR | Depends on product | kaveo and Aegis process data in your environment. Vectasec's hosted control plane stores findings and resource metadata. |
Responsible disclosure
Found something? Tell us. We answer.
Report suspected vulnerabilities in any ZHASK product or in zhask.io through the contact form, marked as a security report. Include reproduction steps and impact as you understand it.
We acknowledge within 48 hours, give a substantive assessment within 7 days, and credit reporters who want credit once a fix ships. We do not pursue researchers who act in good faith: no testing against customers, no data exfiltration beyond proof, no service disruption.
Machine-readable details live at /.well-known/security.txt.
- Acknowledgement
- 48 hours
- Substantive assessment
- 7 days
Subprocessors
Who touches ZHASK company data.
kaveo and Aegis deployments involve no subprocessors. Vectasec’s control plane is hosted on Supabase, outside your network. The list below covers ZHASK’s own business operations.
| Vendor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Internal systems | US |
| Google Workspace | Email and internal documents | US/EU |
| GitHub | Source control, hosting for zhask.io, and hosting for the public Vectasec source | US |
Vectasec source is shared on request. It has no tagged releases yet, and its container images are not signed.
kaveo is provided under a written agreement, as a source tree or as an air-gapped bundle with SHA-256 checksums you verify before loading.
Aegis source is shared during an evaluation.
Running a security review?
Tell us what your review needs and we will answer it directly.