Zenkoders protects client code, data and systems with signed NDAs, least-privilege access, secure development practices and clear ownership terms. This page explains how we handle security on every project, so your team has answers before a vendor review or procurement sign-off.
1. Confidentiality and NDAs
- We sign a mutual NDA before you share project details, product plans or data.
- Every Zenkoders team member signs a confidentiality agreement as part of their employment.
- We never share client names, code or results publicly without written permission.
2. Code and IP ownership
- You own the source code, designs and intellectual property we create for your project, as set out in your contract.
- Code lives in your own Git repository (GitHub, GitLab or Bitbucket) wherever possible, so you have full history and control from day one.
- At handover you receive the code, documentation, credentials and deployment notes.
3. Access control
- Least privilege: each team member gets access only to the systems their role needs.
- Named individual accounts, never shared logins; passwords are kept in a password manager.
- Multi-factor authentication on code repositories, email and cloud consoles.
- Access is removed when a project ends or a team member leaves.
4. Secure development practices
- Peer code review on every change before it is merged.
- Secrets and API keys are stored in environment variables or a secrets manager, never in code.
- Dependency checks and updates to remove known vulnerabilities.
- Development is built with the OWASP Top 10 risks in mind: input validation, authentication, authorization and secure session handling.
- Separate development, staging and production environments, with QA testing before every release.
5. Data protection
- Data is encrypted in transit (HTTPS/TLS) and at rest using the encryption services of AWS, Microsoft Azure or Google Cloud.
- We work with test or anonymised data wherever possible, and access production data only when a task needs it.
- Your data is never used to train AI models. For AI projects we use enterprise API terms from model providers, which exclude API data from model training.
- When a project ends, we return or delete your data on request.
6. Hosting and infrastructure
- We deploy to your own cloud account by default, so you keep ownership of infrastructure and billing.
- Automated backups, uptime monitoring and logging are set up as part of launch.
- We can work inside your VPN, SSO or virtual desktop environment if your policies require it.
7. Compliance
- HIPAA: we build healthcare software with HIPAA safeguards (access controls, audit logs, encryption) and host it on HIPAA-eligible cloud services.
- GDPR and CCPA: we follow data-minimisation and privacy-by-design principles for EU and California users.
- SOC 2: Zenkoders is not SOC 2 certified. We complete client security questionnaires, align our practices with SOC 2 controls, and build on SOC 2–certified cloud providers.
8. Incident response
- If we suspect a security incident affecting your project, we contain it, investigate it and notify you promptly with what happened, what was affected and what we are doing about it.
- After every incident we document the root cause and the steps taken to prevent it from happening again.
9. Reporting a vulnerability
If you believe you have found a security issue in a Zenkoders website or product, email contact@zenkoders.com with the details. Please do not disclose it publicly until we have had a chance to fix it. Our contact details are also published at /.well-known/security.txt.
Need a security questionnaire completed?
We regularly complete vendor security reviews for US companies. Contact us or email contact@zenkoders.com and we will send answers to your questionnaire.
