Security
How we protect your accounts and data
How sign-in works, how we handle your data and what your security team can ask us for.
- Sign-in
- SSO
- Through Zym Labs Cloud, on [PLAN]
- Where data is stored
- [REGION]
- Security reviews
- On request
- Questionnaires and policies, under NDA
By area
Security, area by area
The overview is public. The detail behind each area is in the documents we share for a security review.
Accounts and sign-in
Every Zym Labs product signs in through Zym Labs Cloud. Set up SSO once and it covers each product your organization uses. SSO is available on [PLAN].
How to set up SSOData protection
[How customer data is encrypted in transit and at rest, in 1 or 2 sentences.]
Hosting and data regions
Customer data is stored in [REGION]. [Where Zym Labs products run, and who hosts them.]
See our subprocessorsAccess inside Zym Labs
[Who at Zym Labs can reach customer data, how that access is granted and how it’s logged.]
Availability and incidents
[How and when we tell customers about a security incident.]
Audits and certifications
[AUDIT STATUS: until there’s an audit report, say which reviews we support today, such as answering your questionnaire. Name an audit and its date only once it’s booked.]
Documents for your security review
The overview on this page is public. We share the detail a review needs under NDA, and send it to your work email within [N] business days.
Public
Under NDA, on request
- Answers to your security questionnaire
- [POLICY DOCUMENTS]
- [AUDIT OR TEST REPORTS, once there are any]
Report a vulnerability
Email us what you found, where, and the steps to reproduce it. Please give us time to fix the issue before you share it anywhere else.
For sensitive details, encrypt your message with our [PGP KEY].
What to include
- What you found, and where: the address or product, and your workspace ID
- The steps to reproduce it
- What someone could do with it
- How you’d like to be credited, if at all
What happens next
1. We confirm we have it, within [N] business days.
2. We tell you how serious we think it is within [N] days, and keep you posted.
3. We tell you when the fix is live.
4. [Whether we credit researchers or pay rewards, and how.]
[SAFE HARBOR: LEGAL TEXT on what we commit to when you test in good faith.]
Try it with your team
Create a workspace and invite your team. Set up SSO when you’re ready.