Trust & Security
Data & Security
Last updated: 18 July 2026
When you work with Zenith One, you're often trusting us to build systems that handle your business's and your customers' data, messages, bookings, and CRM records. We take that responsibility seriously. This page explains how we protect and process that data. For how we handle data collected through this website specifically, see our Privacy Policy.
Our Role
For data belonging to your business and your customers, you are the data controller and Zenith One acts as a data processor, we process that data only to build, run, and support the solutions you engage us for, and on your documented instructions.
Data Ownership
Your data is yours. We do not sell it, we do not use your customers' data to train third-party models, and we do not use it for any purpose beyond delivering your project. On request, or at the end of an engagement, we will return or delete the data we hold on your behalf.
Security Practices
- Encryption in transit, data moves over encrypted (HTTPS/TLS) connections.
- Reputable infrastructure, we build on established cloud and platform providers with their own security programs.
- Least-privilege access, access to client systems and data is limited to the people who need it to deliver the work.
- Data minimisation, we collect and retain only what a solution actually needs to function.
- Secrets management, API keys and credentials are stored securely and never committed to code.
No system is perfectly secure, and we don't claim to be. We apply reasonable, industry-standard technical and organisational measures appropriate to the data involved.
Sub-processors
Depending on what we build for you, your project may rely on some of the following categories of trusted third-party providers, each with their own security and privacy commitments:
- Database & backend, e.g. Supabase.
- Messaging, e.g. the WhatsApp Business Platform (Meta).
- AI model providers, e.g. Anthropic and/or OpenAI, used to power AI agents.
- Scheduling, e.g. Cal.com.
- Analytics & hosting, e.g. Google Analytics and our website/app hosting providers.
The exact sub-processors for your engagement are documented in your project's agreement. We will tell you before adding a new sub-processor that materially handles your data.
Data Residency
Data may be stored and processed in different regions depending on the providers used. Where you have specific data-residency requirements, tell us up front and we'll configure the solution accordingly where technically possible.
Retention & Deletion
We retain data only as long as needed to deliver and support your solution, or as required by law. You can request deletion of data we process on your behalf at any time.
Data Processing Agreement (DPA)
For clients who need one, including businesses subject to the GDPR, we can provide a Data Processing Agreement on request. Email [email protected] and we'll arrange it.
Reporting a Concern
If you believe you've found a security issue or have a question about how we handle data, please contact us at [email protected]. We'll acknowledge and investigate promptly.