Trust center
Trust & governance
Zentro.run is built for teams accountable for operational changes. This page states what is current, in progress, or planned — without unverified certification claims.
Control surfaces
Audit trail
Operational events — API keys, billing webhooks, approvals, automation activity — are designed to land in one append-oriented log you can export and walk through with auditors.
Audit log →Approvals
High-impact automation waits for an explicit approval record before execution. The queue is a first-class route, not a side channel.
Approvals →Connectors
Optional HTTP backends for reasoning, robot-style automation, and health checks. Nothing runs against your stack until you configure endpoints and credentials.
Connectors →API access & keys
Scripts and integrations authenticate with scoped keys. Keys are created and rotated from Settings; usage flows through the same-origin API surface documented in the reference.
API keys →
Security principles
Server-side secrets
CurrentAPI keys, PayPal credentials, and private backend URLs are environment variables — never committed or sent to the browser.
Authentication
CurrentSupabase Auth protects console routes. API keys (zentro_sk_) and alert ingest tokens scope programmatic access.
Row-level security
CurrentWorkspace data is scoped via Supabase RLS and org membership roles.
Webhook verification
CurrentPayPal and ingest routes verify signatures or tokens where applicable.
Rate limiting
CurrentSensitive and public API routes use token-bucket limits (Upstash when configured, in-memory fallback).
Formal penetration testing
PlannedNot claimed on this site. Engagements can be discussed through enterprise and security contact.
Privacy principles
Data boundaries
CurrentWorkspace data stays in your Supabase project context. Connector URLs point to backends you configure.
Privacy policy
CurrentPublished at /privacy — describes collection, cookies, and contact rights.
Cookie consent banner
CurrentOptional analytics on zentro.run use a consent banner when NEXT_PUBLIC_ANALYTICS_REQUIRES_CONSENT is enabled. Essential forms work without analytics consent.
Data residency options
In progressDeployment profiles and retention controls exist in settings; full residency productization is planned.
Responsible AI
Human-in-the-loop
CurrentHigh-impact automation routes through approval gates — Copilot assists, it does not bypass governance.
Grounded context
CurrentCopilot uses same-origin APIs and optional reasoning backends — not uncontrolled external tool execution.
Offline fallback
CurrentWhen no model is configured, Copilot returns guided offline replies instead of failing silently.
Memory and agent lineage
PlannedAudit-friendly memory lineage is planned with Memory Pendant — not available today.
Product maturity disclosure
Every product and capability on zentro.run carries an honest label: Live, Preview, Prototype, or Coming soon. We do not present roadmap items as generally available.
View product maturity labels →What we do not claim
- SOC 2 Type II certification
- ISO 27001 certification
- HIPAA compliance or BAA
- Regulatory approval
- Guaranteed uptime SLAs on this marketing site
- Customer logos or usage statistics we have not published
Vulnerability reporting & status
Report security issues via security contact. For runtime availability see service status. Read Security for disclosure expectations.