Security

Last reviewed: April 29, 2026

The short version.

Zeus protects your data with TLS 1.3 in transit, AES-256 at rest, bcrypt password hashing, and SOC 2 Type II in progress. We never store unencrypted location, audio, or personal data. This page describes our security architecture in detail.

Encryption

In transit

All connections to Zeus servers use TLS 1.3 with strong cipher suites. We support only modern TLS versions; we do not allow TLS 1.0 or 1.1 connections. HSTS is enforced on all domains.

At rest

All data stored on Zeus infrastructure is encrypted using AES-256-GCM. Database encryption keys are managed using AWS KMS with annual key rotation. Audio evidence uses additional client-side encryption with keys derived from your account password — not even Zeus engineers can read your audio without your authentication.

Authentication

  • Passwords are stored as bcrypt hashes with a cost factor of 12. We cannot read them, even if compelled.
  • Multi-factor authentication is supported for all accounts. Required for B2B admin accounts.
  • Sessions expire after 30 days of inactivity. New device login triggers an email notification.
  • Account recovery requires email verification plus, where set up, an answer to a security question or phone verification.

Infrastructure

  • Hosted on AWS in US-East-1 and US-West-2 regions, with automatic failover
  • VPC isolation; no databases are publicly accessible
  • Web Application Firewall (AWS WAF) protects against OWASP Top 10 vulnerabilities
  • DDoS protection via AWS Shield
  • Quarterly external penetration tests by independent security firms
  • Annual SOC 2 Type II audits

Access controls

  • Zeus engineers do not have direct database access; all queries go through audited service interfaces
  • Production access requires two-person approval and is logged immutably
  • All Zeus employees undergo background checks before being granted any access
  • Multi-factor authentication is required for all employee accounts
  • Off-boarded employees lose all access within 1 hour of departure

Data retention and deletion

  • Account data: retained while account is active; deleted within 30 days of account closure
  • Location data tied to a safety event: 90 days, then deleted
  • Audio evidence: retained per your subscription tier (Pro: 90 days; Plus: indefinite or as you specify)
  • Server logs: 30 days, then aggregated and de-identified
  • Backup retention: encrypted backups are retained for 90 days

Compliance

  • SOC 2 Type II — audit in progress; Type I report available under NDA
  • HIPAA — not applicable; Zeus does not store medical records by default. BAAs available for healthcare-tier deployments.
  • FERPA — Zeus's university tier is FERPA-aware by design. DPAs are signed with all university partners.
  • GDPR — supported for EU users. We are the data controller; our DPO is available at privacy@zeusalert.com.
  • CCPA / VCDPA / CPA — full state-privacy compliance; data subject access requests honored.
  • CJIS — alignment in progress for law enforcement deployments.

Vulnerability disclosure

Zeus operates a responsible-disclosure program. If you believe you've found a security vulnerability, please email security@zeusalert.com with:

  • A description of the vulnerability
  • Steps to reproduce it
  • Your assessment of impact

We commit to acknowledging receipt within 48 hours, providing an initial assessment within 5 business days, and (where appropriate) recognizing your discovery in our security acknowledgements page.

We do not yet operate a paid bug bounty program but will consider monetary recognition for high-severity findings.

Incident response

If a security incident affects user data, we will notify affected users within 72 hours of confirming the incident, in accordance with applicable breach-notification laws. Notification will include the nature of the incident, the data affected, the steps taken to mitigate, and recommendations for users.

Our incident response team is on call 24/7 for high-severity events.

Contact