We never see your clients' keys

The scanner

• Reads only the AI apps' settings files listed in the docs. It doesn't read documents, email or browser data.
• Makes no network calls unless it is told to upload, and then only to your console over https.
• Changes nothing unless a technician runs fix-secrets --apply or rotate. Fixes back up each file first.
• Refuses to follow redirects when uploading, so the upload token can't be sent somewhere else.
• Builds are published with SHA-256 checksums, and the install scripts check them before running anything.

What is sent

For each connector: the app, the config file path, the command, the names of its settings, and the findings.

Setting values are never sent. Arguments that look like tokens and the user and query parts of addresses are replaced with [REDACTED] on the laptop before the report is built.

The console

• Every table that holds MSP data is protected by row-level security in PostgreSQL. The app connects as a role that can only see the signed-in MSP's rows.
• Upload tokens and session tokens are stored only as SHA-256 hashes. Upload tokens are shown once.
• Uploads are limited to 2 MB and checked before they are stored.

Accounts

• Passwords are hashed with scrypt. Sign-in attempts are rate limited.
• Two-factor sign-in with an authenticator app is available for every user.
• Sessions expire after 12 hours and can be ended by signing out.

Reporting a problem

Email security@zinloop.com. We reply within two business days.