Security

Our Approach to Security

Security is foundational to Zelares. As a platform for markdown editing and real-time collaboration, we are committed to protecting your documents, account data, and workspace information. This page outlines the measures we have in place and the practices we follow to keep your data safe.

We believe in transparency. If you have questions about any aspect of our security posture, please reach out, we are happy to discuss it.

Encryption

All data transmitted between your browser and Zelares is encrypted using TLS (Transport Layer Security). This ensures that your documents, credentials, and collaboration traffic cannot be intercepted or tampered with in transit.

Data at rest, including your markdown files, account information, and workspace metadata, is stored with encryption on our database and storage infrastructure. We use provider-managed encryption keys with regular rotation where supported.

Infrastructure & Hosting

Zelares is hosted on modern cloud infrastructure with industry-standard physical and network security controls. Our hosting provider maintains certifications and attestations including SOC 2, ISO 27001, and PCI DSS for the underlying data center and network layers.

We apply security patches and updates to our infrastructure components on a regular cadence. Network access is restricted through firewall rules, and only essential services are exposed to the public internet.

Authentication & Access Control

Zelares supports secure authentication through trusted third-party providers (Google and GitHub), which means we never store or handle your passwords directly. Each sign-in uses industry-standard OAuth 2.0 protocols with token-based session management.

Access to production systems and user data is strictly limited to authorized personnel who require it for their role. We enforce the principle of least privilege, and all access is logged and reviewed periodically.

Application Security

We follow secure development practices throughout our build and deployment pipeline:

• Dependencies are regularly scanned for known vulnerabilities and kept up to date.
• Input validation and output encoding are applied to prevent injection attacks (XSS, SQL injection, etc.).
• API endpoints enforce authentication and authorization checks on every request.
• Session tokens are short-lived, scoped, and transmitted over secure, HTTP-only cookies.
• Rate limiting is applied to authentication and sensitive endpoints to mitigate brute-force and abuse attempts.

Data Isolation & Multi-Tenancy

Zelares is a multi-tenant platform. Each workspace and its documents are logically isolated so that users can only access data belonging to their own account or workspaces they have been invited to. Authorization checks are enforced at the application layer on every data access.

Backup & Availability

We perform regular automated backups of our database and document storage. Backups are encrypted and retained to allow point-in-time recovery in the event of data loss or corruption.

Our infrastructure is designed for high availability, with redundancy across availability zones where supported by our hosting provider. We monitor uptime and system health continuously.

Incident Response

We maintain an incident response process to detect, contain, and remediate security events. In the unlikely event of a data breach involving your personal information, we will notify affected users and relevant authorities in accordance with applicable data protection laws.

Post-incident reviews are conducted to identify root causes and implement preventative measures.

Vulnerability Disclosure

We welcome responsible disclosure of security vulnerabilities. If you discover a potential issue in Zelares, please report it to us privately at support@reymond.online. We ask that you give us a reasonable amount of time to investigate and address the issue before any public disclosure.

We do not currently operate a formal bug bounty program, but we value and appreciate the security research community.

Compliance & Future Commitments

As a freshly launched platform, Zelares is actively building its security and compliance program. While we are not yet certified against formal frameworks, our practices are aligned with industry standards and we are committed to pursuing relevant certifications as we grow.

We regularly review and update our security practices to address evolving threats and to meet the expectations of our users.

Contact Security

If you have security-related questions, concerns, or wish to report a vulnerability, please contact us at support@reymond.online. We treat all security communications with priority.