Zesty.io accounts are intended for publicly accessible websites, both for informational purposes and for online sales (e-commerce), or headless content APIs. Data shared on the Zesty.io platform is typically public information, crawl-able by search engines.

Most data held in Zesty.io is public content accessible over the Internet. That information is stored in an isolated database created specifically for that website account. Additionally, user information for the individuals that use and access Zesty.io is stored in a separate database not associated with any website account. Passwords are hashed and salted before being stored. All data is encrypted before being stored.

Users are authenticated against their password, which is hashed and salted on submission and checked against a user database. Each form in Zesty has methods in place to defend against CSRF (cross-site request forgery) and XSS (cross-site scripting) attacks.

Zesty.io is accessible from all devices with a modern web browser. That includes, but is not limited to, modern cellphones, tablets, desktop computers, and laptop computers. Restricting access to devices is not available. Restricting permissions to specific ares of the website account is available to the agency managing the website account.

Access to Zesty.io website accounts are on a per user basis. The managing agency has complete control over which users have access, and can deny or grant immediate access.

If the website database account data was compromised, passwords would be reset, access would be restricted, and the most recent backup of the website would be instated. All users with permission to that website account would be required to create new passwords with two-factor authentication.

Zesty.io will always have a way to export a static version of a website. If the website uses the Zesty.io commerce solution, that service would be put to a halt and need to be reinstated on another system, but all of the CSS, HTML, and data will be available for download. Additionally the managing agency has access to make backups of the website at their discretion.

Yes. Zesty.io is hosted with Google Cloud Platform and Fastly, both of which are SAS 70 Type II certified.

Yes. Our public security policy may be viewed here.

Upon deployment of code, we employ third-party consultants to check internally and externally for flaws in the system. A request can be made. We will take steps to authorize the request prior to any engagement.

Yes. Only users associated with your website account can access your company data. If the user logs on with an additional user account they create they will not be able to access or grant access to the company account associated with their other user.

We would notify all companies involved in any security incident. If a website database account was compromised, passwords would be reset, access would be restricted, and the most recent backup of the website would be instated. Users with permission to that website account would all be required to create new passwords and use two-factor authentication when logging in.

We would notify all companies involved in any security incident within 24 hours of discovery. If a website database account was compromised, passwords would be reset, access would be restricted, and the most recent backup of the website would be instated. Users with permission to that website account would all be required to create new passwords and use two-factor authentication when logging in.

Zesty.io's data centers are managed by Google Cloud Platform, which is ISO 27001 certified. Zesty accepts payments with only PCI DSS certified vendors.

Zesty.io uses Google Cloud Platform and Fastly solutions for infrastructure, both of which follow security best practices. Learn more about GCP security and Fastly Security.

Regular database backups and code repositories are stored to multiple secure locations in the United States. If our main server farm is inaccessible for more than 168 hours we will deploy our repositories and reinstate the database in a new location. In this event domain DNS records may need to be changed to the new locations IP (internet protocol) address. Network access outside of our control (e.g. an internet line from Arizona to Southern California is severed preventing access to servers in Texas), is considered municipal, and it is at the discretion of the Governing body, in which the issue occurred, to resolve connectivity issues.

Yes. We employ top security experts to conduct experiments and research to find flaws in our code repository. Rackspace IT professionals that manage our server cluster maintain their RHCA (Red Hat Certified Architect) and required Cisco certifications.

Yes to both, it is documented with signed and dated documentation.

Access to this information should not have any affect on the company as information stored in Zesty.io website accounts should be publicly accessible. Sensitive user credential data is hashed while at rest and encrypted during transit.

Audits which may include, without limitation, penetration tests against Zesty.io's infrastructure and code base, audits of our security processes as they relate to Zesty.io, audits of our software development process, and audits of our technical and organization processes as they relate to Zesty.io may be scheduled and conducted after authorization by our staff.

Two-factor authentication is an optional feature for all website accounts. This feature may be enabled by the website account's managing agency.

Website accounts with the SSL/TLS options will be protected by encryption.

Each website account accesses an isolated database created specifically for that account.

Yes, for a $500 fee per queried result.

We create polices based on best practices of the principle of least privilege, and we create software rules to enforce policies. We ensure this by only allowing employees access data through the software.

Zesty.io is compliant to United States data protection laws and regulations.

Yes. As of March 1st, 2014, each employee is required to study data protection laws as part of their training.

Servers, storage of backups, and disaster recovery are located in the United States. Media hosted with Akamai, our content delivery network provider is located statically across all nations that have requested access to specific media files.

Zesty.io's Privacy policy outlines our practices towards handling any personal information that may be provided to us.

For more information please contact hello@zesty.io.