Transparency and accountability

By creating an account or using ZeroAuthority you agree to these terms, the Acceptable Use Policy and the Privacy Policy. If you do not agree, do not use the service.

You must be able to form a binding agreement where you live, and if you use ZeroAuthority for an organisation you confirm that you may act for it.

ZeroAuthority provides SYSTEMS (Domain Watch, FORGE, SIFT, VIGIL, CHAIN, CONTINUITY and Integrations), ZeroAuthority LAB tools, a CVE database and a workspace for investigations, evidence and verifiable reports.

The Transparency page describes how each part works, where data is processed and stored, and its limitations. Where this page and the Transparency page differ, tell us so it can be corrected.

We may change, add or remove features. Features marked as not yet available are not part of the service.

• Give accurate information and keep your credentials secure. You are responsible for activity under your account.
• Tell us promptly if you believe your account has been accessed without permission.
• You may delete your account and data yourself from the Account page.

ZeroAuthority has Free, Select and Reserve plans. Select and Reserve are monthly subscriptions at the prices shown on the Plans page, with no setup, per-tool or overage fees at present.

The integrated payment system is not live. Until it is, nothing is charged through the site, no payment details are collected, and plans are activated by the ZeroAuthority team after you send a plan request. You may request an upgrade, downgrade or cancellation at any time.

Prices may change as costs change. A change is announced on the Plans page and by email before it applies to your subscription.

You are responsible for:

• Your own activities on and through the service.
• The targets you choose, and for having authorisation to test or monitor them.
• The datasets, files and content you upload, and for having the right to use them.
• How you use technical findings, and any decision you make based on analytical results.
• Who you share generated reports with.
• Complying with the laws that apply to you.

A tool being available does not mean you are authorised to use it against a system. Only point tools that contact a host at systems you own or have written permission to test. Domain Watch scans only domains whose ownership you have proved.

Unauthorised testing may be a criminal offence, and you alone are responsible for what you scan.

You keep ownership of what you upload or save. You allow us to store, process and display it only as needed to provide the service to you, as described in the Privacy Policy and Transparency page.

Local tools and SIFT analysis run in your browser, and their input is not sent to us unless you choose to export.

Each PDF carries a code. A matching check shows that ZeroAuthority issued that file at that time and that it has not been changed. It does not show that the findings are correct or complete, and it is not a third-party notarisation or legal timestamp.

Results rely on public providers and automated checks that may be incomplete, outdated or wrong. A clean result is not proof that something is safe.

We do not promise uninterrupted or error-free service. Monitoring has stated intervals and coverage limits, set out on the Transparency page.

We may suspend or end an account that breaks these terms or the Acceptable Use Policy, or that is used to attack others or abuse the service. Where we can and it is safe to do so, we will tell you why.

You may stop using the service and delete your account at any time. Report verification codes are kept after deletion, on purpose, as described in the Transparency page.

To the extent the law allows, ZeroAuthority is provided as is and as available, without warranties of any kind, including accuracy, availability, merchantability and fitness for a particular purpose. Nothing on the service is legal, security or professional advice.

To the fullest extent the law allows, ZeroAuthority and the people who operate it are not liable for indirect, incidental or consequential loss, loss of data, profit or business, or for decisions made in reliance on results.

Nothing in these terms excludes liability that the law does not allow to be excluded. We do not claim immunity from legal responsibility.

You agree to cover reasonable losses and costs we incur because of a third-party claim arising from your breach of these terms, your use of a tool against a system you were not authorised to test, or content you uploaded without the right to do so.

We may update these terms. The date at the top shows the latest version, and material changes will be announced on the site or by email before they apply.

Raise any dispute with us first through the Support page so it can be resolved informally. Nothing in these terms limits mandatory consumer or data-protection rights that apply where you live.

ZeroAuthority.org operates independently and is not affiliated with, endorsed by, sponsored by, or associated with Zero Authority DAO LLC.

All other names, logos and trademarks mentioned on this site, including those of data providers and third-party services, are the property of their respective owners. ZeroAuthority.org does not claim ownership of them, and their use is for identification only and does not imply endorsement.

Questions about this document can be sent through the Support page, or to the legal contact published on the Transparency page.

ZeroAuthority helps people monitor and investigate systems they are responsible for. This policy keeps it from being used to harm others. It applies to every account and tool.

Tool availability does not authorise you to target any third-party system. Use tools that contact a host only against systems you own or have clear written permission to test.

Keep evidence of that permission. If you cannot show it, do not run the tool.

You must not use ZeroAuthority to:

• Gain or attempt to gain unauthorised access to a system, account or data.
• Run disruptive network activity, including denial-of-service, flooding, or scanning at a rate that harms the target.
• Commit or support fraud, impersonation or scams.
• Steal, test or harvest credentials you are not authorised to handle.
• Violate anyone’s privacy, including tracking, profiling or exposing individuals without a lawful basis.
• Distribute malware or help others to do so.
• Upload data you have no right to hold or analyse.
• Bypass rate limits, plan limits, authentication or other controls, or probe ZeroAuthority outside the disclosure policy.
• Harass, threaten or defame others, or break any law that applies to you.

You are responsible for the datasets you analyse and the reports you create, including who you share them with. Do not upload data you are not allowed to process. Reports are your responsibility once you distribute them.

If you find a security problem in ZeroAuthority, follow the vulnerability disclosure policy on the Transparency page. Good-faith research within that policy is treated as authorised.

We may remove content, limit features, suspend or close accounts, and cooperate with authorities where the law requires or where there is a risk of serious harm. We handle legal demands as described on the Transparency page.

Questions about this document can be sent through the Support page, or to the legal contact published on the Transparency page.

ZeroAuthority is operated by its owner, who decides how the personal information described here is used. Contact details are in section 11.

• Account: email address, username, a hashed password (never the password itself), sign-in sessions and sign-up time.
• Plan: your plan, any expiry date, and plan requests with the note you choose to add. No card or bank details are collected.
• Usage: which tools you ran and how often, kept to apply fair-use and plan limits.
• Workspace: investigations, evidence, shared secrets, documents and reports you choose to save.
• Support: tickets, messages and attachments you send.
• Report codes: the code, document type, tool, time issued and issuing user ID.
• Monitoring: for domains you verify, scan results and the contact details you provide for alerts.
• Technical: normal web request data such as IP address and user agent, and aggregate page views through Vercel Analytics.

We do not sell personal information and we run no advertising trackers.

• To provide the tools, workspace and monitoring you ask for.
• To run accounts, plans, support and security, including limiting abuse.
• To send account, verification and alert emails.
• To keep issued report codes verifiable.

Local tools and SIFT analysis run in your browser and their input is not sent to us. Other tools send input to our servers, hosted on Vercel. Integrated tools pass a trimmed query on to the provider named for that tool.

Account and workspace data is stored in a Neon PostgreSQL database, with sensitive fields encrypted by the application. Files are encrypted by the application and stored in Microsoft SharePoint. The Transparency page describes these protections and their limits, including which data is end-to-end encrypted and which is not.

• Vercel: hosting, request logs and page analytics.
• Neon: database hosting.
• Microsoft: file storage through SharePoint.
• Resend: sending email, which receives the recipient address and the message.
• Cloudflare and other public data providers: only the specific input listed for a tool on the Transparency page.
• Authorities: only on valid legal process, handled as described on the Transparency page.

Most data is kept until you delete it or your account. Exceptions, such as PC Specs scans deleted after 24 hours, short-lived PDF copies, 30-day integration logs and permanently kept verification codes, are listed in the retention table on the Transparency page. We do not promise deletion beyond what that table states, and provider logs follow the provider’s own retention.

• Delete your account and data yourself from the Account page.
• Delete individual workspace items, evidence and scans at any time.
• Ask us through Support to correct information or to remove a verification record.

We use cookies needed to keep you signed in and secure. Vercel Analytics counts page views in aggregate. We do not use advertising cookies or cross-site tracking.

We use authentication with email verification, optional two-factor authentication, per-user data isolation and encryption, described on the Transparency page. No system is perfectly secure, and we cannot promise that a breach will never happen.

ZeroAuthority is not directed at children, and we do not knowingly collect their information.

We will announce material changes to this policy before they apply. Questions about this document can be sent through the Support page, or to the legal contact published on the Transparency page.

• Passwords are stored only as salted hashes. We never see or store the password itself.
• Email verification is required, and optional two-factor authentication is available from your account page.
• Sign-in, sign-up and sensitive actions are rate limited, and sessions can be ended from your account page.

There are two different kinds of encryption here, and they protect different things.

• End-to-end encrypted: the vault. Items are encrypted in your browser with keys derived from your passphrase. ZeroAuthority stores only ciphertext and cannot read vault contents, even if compelled. If you lose your passphrase and recovery codes, the contents cannot be recovered by anyone.
• Encrypted at rest, keys held by ZeroAuthority: evidence, documents, exports and workspace files. The application encrypts each file before it is stored and uses per-user keys, so a stolen storage account or database copy does not expose readable content. Because we hold the keys, the service can technically read this content and could be legally compelled to produce it.
• Database content is protected by the database provider's own encryption at rest, in addition to the application-level encryption above.
• Traffic between your browser and ZeroAuthority uses HTTPS.

Every query that touches your data is scoped to your account, and file storage uses a separate per-user folder. Report verification records contain no report content.

Database backups are provided by the database provider under its own terms. ZeroAuthority has not yet carried out and documented a full restore test, so we make no promise about recovery time or the exact backup window. Vault contents cannot be recovered without your passphrase or recovery codes.

If we confirm that your personal data was exposed, we will tell affected users by email as soon as we reasonably can, describe what was affected, and say what you should do. We do not publish a fixed notification deadline.

Report security issues using the contact in our security.txt file at /.well-known/security.txt. Please give enough detail to reproduce the problem, do not access other people's data, and give us reasonable time to fix it before publishing. The disclosure policy is on the Transparency page.

No system is perfectly secure. ZeroAuthority is operated by a very small team, and this page describes controls that exist today, not guarantees.

• Neon (PostgreSQL): accounts, plans, workspace records, support tickets and encrypted vault items.
• Microsoft SharePoint, through Microsoft Graph: files, encrypted by the application before upload and stored under opaque names in a per-user folder.
• Vercel: runs the application and provides aggregate page-view analytics.
• Resend: delivers email such as verification, alerts and support replies.
• Integrated tools: when you run one, our servers query the public provider named on its card, so the provider sees our server rather than your browser. See the Transparency page for each tool.

• Account and workspace data: until you delete it or your account.
• PDF exports and specification scans: they expire automatically and are purged by a scheduled job.
• Older support tickets: archived outside the live database on a schedule, then removed after the retention period set out in the Privacy Policy.
• Report verification codes: permanent, so a document already used in the real world stays verifiable. They contain no report content.

From your account page you can export your data and delete your account. Deletion is permanent. This is the complete inventory of what happens to each store.

• Deleted: Account, sessions, two-factor secrets, pending recovery-code replacement markers and sign-in tokens. Removed from the database.
• Deleted: Account activity history (sign-ins, security changes, profile and plan events). Removed from the database with the account.
• Deleted: Vault items, vault key wraps and share links. Removed from the database. Share links stop resolving and return 404 immediately.
• Deleted: Legacy data from the retired GUARDIAN system: organizations, assets, connections (including stored tokens), policies, proposals, jobs and audit records. Removed from the database, including the sealed integration credentials.
• Deleted: Investigations, evidence items and chunks, PDF exports, spec scans and tool usage. Removed from the database.
• Deleted: SYSTEMS data: the shared asset inventory, VIGIL software components, CHAIN provider dependencies, CONTINUITY plans, backups and exercises, and FORGE runs. Removed from the database.
• Deleted: Support tickets, ticket events and attachments. Removed from the database.
• Deleted: CONNECT routes and delivery history, notification preferences, plan access and upgrade requests. Removed from the database.
• Deleted: Files in object storage (evidence, exports, WATCH state, scan history, retired GUARDIAN and CONNECT files). The whole per-user folder is removed before the database changes are committed.
• Deleted: WATCH global domain registry entries. Released so the scheduler stops scanning the domains of the deleted account. Other accounts monitoring the same domain are unaffected.
• Retained: Document verification codes. Codes are permanent so a document already used in the real world stays verifiable. Database triggers forbid deleting or rewriting them. They contain no content, only the document type, issue time and a file fingerprint.
• Retained: Administrator audit log entries that reference the account. Security record of administrative actions, kept so abuse and unauthorized access can be investigated. Contains identifiers and action names, not content.
• Retained: Rate-limit counters. Short-lived counters keyed by IP address or account id that expire on their own.

You can download a copy of your account data from your account page before deleting it.