Security

Signing in

• Passwords are stored as scrypt hashes, at the strength OWASP recommends. We can’t read your password.
• Wrong passwords are limited, for each account and each connection, so a password can’t be guessed at speed.
• Changing your password, or choosing “Sign out everywhere”, ends every other session straight away.
• Reset links are signed, work once, and run out after an hour.

Your data

• Your pages and account are kept encrypted (AES 256 GCM) in our storage.
• Only you can change your pages, plus anyone you give client access through Studio, who sees only the pages shared with them. Our admins can open an account to help with support, and each time they do it’s logged.
• Card details go straight to Stripe. They never reach Zest.
• Download everything we hold about you, or delete your account, from Your account. Deleting stops any paid plan first, then removes your pages, pictures, list and insights.

Your visitors

• No cookies are set on your visitors when they look at your page.
• We don’t keep their IP addresses. Visits are counted, then the details used to count them are rolled up and deleted at the end of each day.
• Every email from your page has a one click way off, and those links are signed so nobody can take someone else off your list.

What Zest fetches

Feeds, shops, calendars and link previews are fetched only from public addresses. Requests that would reach a private network are refused, and every redirect is checked again.

What we don’t have yet

• Two step sign in. It’s on the roadmap.
• An outside security audit.

Found a problem

Email zest@studionine.agency with “Security” in the subject. Tell us what you found and how to see it. We’ll reply within two working days and keep you posted until it’s fixed. Please don’t test against other people’s pages or accounts.