Security atZenchronity

Where the Service runs, and how it is protected:

• Hosted in the EU: Servers and databases in ISO/IEC 27001 certified data centres in Finland
• Encrypted Storage: Stored data is encrypted at rest
• Backups: Regular backups protect your data against loss
• DDoS Protection: Traffic passes through a global network that absorbs attacks
• Firewall and Rate Limiting: A network firewall filters incoming connections, and request volumes are limited

How people sign in, and what each of them can see:

• Single Sign-On: Microsoft Entra ID and Google
• Two-Factor Authentication: With an authenticator app, optional or mandatory for the whole organisation
• Strong Passwords: Long passwords with mixed characters, checked against common words
• Sign-in Protection: Repeated failed attempts are blocked, and sessions expire automatically
• Role-Based Access: Employees, managers and administrators see only what their role and reporting line allow
• API Keys: Read-only or read-write, with an expiry date, and revocable at any time

Protections built into the Service:

• Web Attack Protection: Against common attacks such as SQL injection, cross-site scripting and clickjacking
• Input Validation: Data sent to the Service is checked before it is accepted
• Secure Sessions: Session cookies that scripts cannot read and that travel only over encrypted connections
• No Readable Secrets: Passwords and API keys are never stored in a readable form
• AI Pseudonymisation: Names and email addresses are replaced with aliases before a message reaches the AI model
• No Ad Trackers: No advertising or cross-site tracking; analytics only on our website, only with consent, and without cookies

How your organisation's data is kept apart and looked after:

• Data Separation: Each organisation's data is kept apart from every other's
• Separate Encryption Keys: Names, email addresses and booking details are encrypted with a key for each customer
• Data Minimisation: We don't ask for salaries, dates of birth, ID numbers or home addresses
• Audit Log: Sign-ins and changes are recorded, and administrators can review and export them
• Automatic Deletion: Old audit records and past appointments are deleted automatically
• End of Contract: Your data is deleted within 30 days after your contract ends
• Your Control: Administrators can export data and permanently delete users at any time

What we commit to, and what we share with customers:

• GDPR: A Data Processing Agreement on the European Commission's standard clauses
• Sub-processors: Listed in the agreement, with 30 days' notice before any change
• Security Questionnaires: We answer our customers' questionnaires
• Documentation: Security information for your DPO or procurement team on request
• Status Page: Current system status and incident history at zenchronity.statuspage.io

If something goes wrong:

• Breach Notification: Your administrators hear from us within 72 hours
• Investigation: We contain the issue and find out what happened and whose data was affected
• Help with Reporting: We give you what you need to inform your supervisory authority and the people affected
• Follow-up: We tell you what we changed to prevent it happening again