Encryption
All data transmitted between your browser and Zackgo is protected using TLS (HTTPS). Data at rest in our database and encrypted file storage is protected using AES-256. Encryption keys are managed under industry-standard practices by our vetted infrastructure partners.
Authentication
Zackgo uses enterprise-grade identity management. Sessions are issued as secure, expiring tokens. We never store plaintext passwords — credentials are hashed and verified through industry-standard authentication controls. Role-based access separates executive, clerk, and internal admin capabilities.
- Executives: reports, billing, team management, Pro features
- Clerks: file uploads only — no access to billing or other companies
- Internal admin: platform operations (Zackgo staff only)
Row-Level Security (RLS)
PostgreSQL Row-Level Security policies enforce that every database query is scoped to the authenticated user's company workspace. This is enforced at the database layer — not only in application code. A user from Company A cannot query Company B's reports, uploads, or profiles even if application logic were bypassed.
Workspace isolation
Each customer company operates in an isolated workspace. File storage paths, report records, and billing data are partitioned by company identifier. Cross-workspace access requires internal Zackgo administrative privileges and is logged.
Secure payments
Payment processing is handled by Razorpay, a PCI-DSS compliant payment provider. Zackgo does not store full card numbers, CVV, or UPI PINs on our servers. Payment sessions are created server-side; checkout flows through the provider's secure interface.
Report privacy
Generated reports are accessible only to authenticated users within your company workspace. Report PDFs and dashboard views respect the same RLS policies as underlying data. We do not publish or share your reports with third parties except as required to deliver configured channels (e.g., email delivery to your recipients).
Password handling
Where password-based authentication is used, credentials are hashed using industry-standard one-way algorithms. We recommend strong, unique passwords and prompt revocation of compromised credentials via support.
API security
All API routes validate authentication tokens before processing requests. Server-side validation enforces company ownership, plan eligibility, and role permissions. API keys and service credentials are stored as environment variables — never in client-side code or version control.
Webhook verification
Payment webhooks from Razorpay are verified using provider signature validation before updating subscription or billing state. Unverified webhook payloads are rejected.
Responsible disclosure
If you discover a security vulnerability:
- Email contact@zackgo.com with a clear description and reproduction steps.
- Allow reasonable time for us to investigate and remediate before public disclosure.
- Do not access, modify, or delete data belonging to other customers.
- Do not perform denial-of-service attacks or social engineering against Zackgo staff.
We aim to acknowledge reports within 24 hours for critical issues and will keep you informed of remediation progress.