Security
What protects the record
Your jobs, your clients’ addresses and your money are in here. This page tells you what we have built to protect them, what is running right now, and where it stops.
Separation
One business can never see another
Everything else rests on this one, so we do it twice and a computer checks it for us.
Two walls between businesses, not one
Every record is stamped with the business that owns it, and every request our server makes to the database is limited to the business that asked. Underneath that, the database keeps the same wall up itself, with its own rule on every table that holds business records. So a bug in the app alone is not enough to cross it.
A computer checks the wall, not a person’s memory
An automatic test reads the live database, finds every table that holds a business stamp, and fails by name on any one of them that is missing its rule. We count what is covered rather than assume it, and the list of exceptions is empty.
We test one business against another before we release
When we add a new address the app can call, it gets a test that signs in as one business and tries to read another business’s data. Syncing, pricing and stored-file names each have a separate test of their own.
Integrity
The record cannot be quietly rewritten
When a job goes wrong, the history is the evidence. It is built so that nobody, including us, can change it behind your back.
The history can only be added to, and each line locks the one before it
Each line in the history carries a fingerprint of the line before it, so a line cannot be quietly changed or removed without breaking the chain. The database itself blocks any change or deletion, and our server refuses to start if that protection is missing.
Payments are never edited
To fix a mistake we add a new line that cancels the old one. We never change the old one. What was recorded, and when, stays readable, which is the point of a payment history.
Signing links are made by our server
A link for signing a document works once, cannot be guessed, and stops working after a set time. Our server makes it. The app on the phone never builds one.
While it travels, and while it is stored
Where the data goes
Cloudflare sits between the internet and the server the app talks to. It carries our own blocking rules, and it slows down anyone sending too many requests too fast. Our own server applies the same limits again behind it.
Scrambled while it travels, everywhere
Everything that travels between a phone and us goes over HTTPS, which scrambles it so nobody in between can read it. The live site also sends an instruction that tells a browser that has visited us once never to drop back to an unscrambled connection. Requests reach us through Cloudflare rather than straight to our own server.
Files stay in one region
Photos, documents and signatures are kept in file storage set to one fixed region, Eastern North America, for every business no matter where it works. When the live server starts up it checks that setting, and it refuses to run if the region is missing or set to “auto”.
We never keep your password
We do not store your password, and we cannot recover it for you. What we keep is a scrambled version (Argon2) that cannot be turned back into your password: enough to check it when you sign in, never enough to read it. There is also a limit on how many times anyone can try to sign in, sign up or reset a password in a short time.
On the phone
The phone is part of what we protect
A phone gets left on a tailgate, lent to an apprentice and handed across a counter. What we built here is built for that, not for a desk in an office.
An optional lock on the app itself
Being already signed in should not hand a whole business to whoever picks the phone up. The app lock asks for the phone’s own screen lock or fingerprint before the app opens. It is off unless you turn it on, and we only offer it on a phone that already has a screen lock to use.
Sign-in keys stay in the phone’s own locked storage
The app has to keep a few private items on the phone, such as the pass that keeps you signed in. It puts them in the Android keystore, the locked storage the phone’s own hardware protects, rather than in ordinary app files.
Continuity
Backups, incidents and getting your data out
A locked copy of the database, kept off the server
Every hour we make a full copy of the live database. The copy is locked with encryption before it is stored, and the job will not keep an unlocked copy: it checks the locked file really is locked before it deletes the unlocked one. It then checks the copy’s own contents list, sends it to separate storage the app itself has no sign-in details for, and reads it back to confirm it arrived. The database also keeps a running record of every change as it happens, and that record is copied off the server too, so putting things back is not limited to the last whole copy. Photos, PDFs and signature images are copied into that same separate storage. Old copies are deleted on a set schedule in both places. To be straight with you: that separate storage is a second bucket at the same storage company, not a second company.
We put backups back to prove they work
A backup nobody has ever put back is a hope, not a plan. So we take a real copy of the live database, load it into a spare database, and check the records really are there before we throw the spare away, including opening a stored, locked copy rather than a freshly made one. We have done the same for file storage: every restored file was checked against the fingerprint recorded when it was copied. Each test is written down and dated. Here is what those tests do not prove, because it matters more than what they do: we have never rebuilt the service on new machines, never replayed the running change record forward to a chosen moment, never put a backup back into the live database, and never timed a full recovery from start to finish. That is why we publish no recovery target.
A written plan for when something goes wrong
If something goes wrong we follow a written plan instead of making it up as we go. The steps are: work out how bad it is, stop it spreading, sign everyone out and shut off payment links and staff access, change our secret keys, save the history and check it has not been altered. Then we work out the damage and tell the people affected. We promise to tell you without waiting longer than we have to. We do not publish a fixed deadline, because we have not proven we can hold one.
Your data leaves whenever you want it to
You can download a copy of your account from inside the app: clients, jobs, invoices, payments, receipts, photos, and your invoice and quote PDFs. You can delete your account in the app too. Access stops straight away, and we delete the data for good after a set number of days. We keep the history of who did what, on purpose, because that record can only be added to.
What we do not claim
The list below is what we do not have and what we do not promise. If something on it matters to you, that is a real answer. Think about it before you trust us with your work.
No certificates and no outside audits. We hold no SOC 2 report, no ISO 27001 certificate, and no PCI or HIPAA sign-off. Those are the security certificates larger buyers ask for. Nobody outside the company has been paid to try to break in. Anyone telling you otherwise about Zeus is wrong.
No promise about uptime or recovery. We publish no figure for how much of the time the app is running, no target for how fast we could bring it back, and no target for how much recent work could be lost, because we cannot stand behind any of them.
No promise of perfect security. No system is perfectly secure, and a page that tells you otherwise is advertising, not fact.
Work you do offline is not backed up until it reaches us. Changes made with no signal sit only on that phone until the app reaches the server. Open the app when you have a signal again, so it can send.
Reporting a vulnerability
If you have found something, we would rather hear it from you than from a business that runs on this app. There is no rewards program and no payment, but a real person will give you a straight answer.
Please follow these rules
- Give us time to fix it before you tell anyone else.
- While you are looking into it, do not open, change or keep any data but your own.
- Do not flood the live site with traffic to see how much it can take, do not point automatic scanning tools at it, and do not try to break in unless we have said yes in writing first.
- Tell us what you did, what you saw, and enough detail for us to make it happen again. A rough note is better than no note.
These are the same rules as in our acceptable use policy.
Status of this page
This page is written to be read. It is not a contract, and it does not promise anything you could hold us to in court. The papers that do that are the terms of service and the privacy policy in our legal pack. Security work never stops, so what is on this page changes. If this page and those papers ever disagree, those papers are the ones that count.
Questions about any of this go to [email protected], and everything else is on the contact page.
ZEUS