Security at Zentro

Our approach

Zentro processes operational order data for e-commerce operators across LATAM. We treat security as part of the product, not as an afterthought. This page summarizes the technical and organizational measures we apply. For legal details on personal data processing, see our Privacy Policy.

Data protection

• Encryption at rest: AES-256 for the database, file storage, and backups.
• Encryption in transit: TLS 1.2+ on all connections; HSTS enabled.
• Integration access tokens (Shopify, Meta, WhatsApp, TikTok, Google and most couriers): encrypted at the application layer with AES-256-GCM before being stored.
• Database: managed PostgreSQL hosted with a SOC 2 and ISO 27001 certified provider (US region).
• Backups: automated point-in-time recovery; 7-day retention.

Authentication and access control

• Password hashing: bcrypt with per-user salt.
• Sessions: httpOnly, SameSite, and Secure cookies in production.
• Role-based access control (RBAC): ADMIN, SUPERVISOR, SELLER, LOGISTICS and MOTORIZADO (delivery rider), each with the minimum required permission set.
• Multi-tenant isolation: every application query filters by organization; data is never shared across merchants.
• Audit logs: sensitive actions (status changes, payment edits, administrative access) are logged and retained for 90 days.
• Engineering production access: granted only to the technical staff who need it.
• Support access to a merchant account: authorized staff only, for a limited time (one hour by default), with a mandatory reason, and recorded in that account's audit history.
• Access log of buyer data: who viewed end customers' data, in which part of the system and in which hour, kept for 365 days.

Infrastructure

• Hosting: serverless infrastructure with auto-scaling.
• Edge network: CDN with DDoS protection and application-layer WAF.
• Observability: application error and performance monitoring.
• HTTP security headers: X-Content-Type-Options: nosniff, strict Referrer-Policy, and Permissions-Policy that disables camera and geolocation. Microphone access is limited to this site's own origin for voice notes, with user permission; it remains disabled in embeddable public forms. X-Frame-Options: DENY site-wide with one declared exception: public order form pages (/f/…) are served with Content-Security-Policy: frame-ancestors * so a merchant can embed them in their own store. Those pages read no cookies and expose no authenticated action.

Sub-processors

We work with the following providers. We keep this list up to date.

Compliance

• Compliant with Peru's Personal Data Protection Law (Ley N° 29733) and its regulations.
• Data handling aligned with GDPR for EU data subjects.
• Breach notification within 48 hours to the Peruvian Data Protection Authority (ANPDP) when applicable, and to Shopify within 24 hours when it affects data we receive from Shopify.
• Adherence to the Google API Services User Data Policy including Limited Use requirements.

Security contact

Zentro's security program is led by Christian Fernando Pellanne Vargas, founder and Security Lead at SPEUX E.I.R.L.. He is the company's security point of contact and is responsible for our security policy, incident response, and internal security testing —including controlled offensive assessments (red teaming)— of Zentro's own systems, performed in isolated environments and never against real customer data. Contact: security@zentro.one.

Reporting a vulnerability

We welcome reports from security researchers and respond promptly. To report a finding, email security@zentro.one with the subject “Security — Vulnerability Report”. We ask that you:

• Provide a clear description of the finding and reproduction steps.
• Avoid disrupting the service or accessing other users' data.
• Give us a reasonable window to remediate before public disclosure.

We acknowledge receipt within 3 business days and provide an estimated remediation timeline.

Official coordinates (RFC 9116)

The security.txt file is published at /.well-known/security.txt.