1. Where your data is stored
#Zerqano keeps your data with a small number of managed providers. Each one, with what it receives, is listed on the Subprocessors page.
- Workspace records
- Products, sales, stock, suppliers, purchase orders and user profiles are kept in managed PostgreSQL run by Supabase.
- Uploaded files
- Documents such as invoices, and files you import, are kept in Supabase file storage.
- Search indexes
- Searchable copies of your catalog text and documents are kept in Qdrant Cloud, each tagged with your organization’s ID.
- AI processing
- Questions, document reading and reviews are processed by Google Cloud Vertex AI.
- Application servers
- The web application and the API run in containers on a Hostinger virtual private server, behind a reverse proxy that handles HTTPS.
2. Encryption
#In transit
Every page and API call is served over HTTPS. The server accepts TLS 1.2 and TLS 1.3 and refuses older versions. It sends HTTP Strict Transport Security with a one-year duration (max-age=31536000; includeSubDomains; preload), so browsers never fall back to plain HTTP.
At rest
Data in our Supabase database is encrypted at rest with AES-256, as Supabase documents on its security page.
Credentials for your other systems
When you connect another system, the keys or passwords you give us are encrypted by Zerqano before they are stored. Outside development, Zerqano refuses to store a credential if no encryption key is set.
3. Workspace isolation
#Every record that holds business data carries the ID of the organization it belongs to.
In the database
Our database changes turn on row-level security for every table that holds organization data, and an automated test checks for it. The Zerqano API reads and writes with a server-side service key that row-level security does not restrict, so requests through the API rely on the API’s own organization checks, described next.
In the API
The API verifies the sign-in token on each request that needs a signed-in user, and looks up the user’s organization on the server from their active memberships. Keeping a request inside that organization is the job of each endpoint’s own query filters, which are written endpoint by endpoint rather than enforced in one central place.
In the search indexes
Entries in the search indexes carry the organization ID, and searches are designed to stay inside your organization.
4. Sign-in and access control
#Signing in
You sign in with your work email and a password of at least 10 characters, or with your Google or GitHub account. Sign-in is handled by Supabase Auth. The main session cookies cannot be read by scripts on the page; the Cookie policy lists each sign-in cookie and whether it can.
Roles
- Owner: full control of the organization, including deleting it.
- Admin: manages team members, integrations and workspace settings.
- Manager: reviews the team’s orders and planning decisions.
- Member: works with restock queues, product catalogs and analysis tools.
Limits on requests
The API limits how many requests one user or one address can make in a minute, and the sign-in, sign-up and demo request forms can ask for a Cloudflare Turnstile check to keep out automated submissions.
Browser protections
Pages are sent with headers that stop other sites from framing them, stop browsers from guessing file types, and limit what the address bar shares with other sites.
5. How AI uses your data
#When you ask a question, import a document or run a review, the part of your workspace data the task needs is sent to Google Cloud Vertex AI, and the result comes back to your workspace.
- No training across customers. Zerqano does not use your data to train general-purpose AI models or models that serve other customers. It fits forecasting models to your own sales data, for your workspace only. Google’s Vertex AI data governance terms say it does not train on customer data without permission.
- What Google may keep. Google may cache requests for up to 24 hours to speed up responses. If its automated systems flag a request for possible abuse, Google may keep it for up to 90 days and its staff may review it. Some models run on Google’s global network, so a request may be processed in any Google region.
- Text from documents is treated as data, not instructions. Text from your files and records is marked as untrusted before it reaches the model, and the model is told to treat it only as evidence.
- Metered per workspace. AI requests from a workspace are counted against it, with monthly allowances and daily limits.
- You control what reaches a supplier. Zerqano drafts purchase orders from stockout risk and supplier lead times. It does not send one to a supplier unless a person in your organization sends it. By default other actions wait for approval too; an admin can choose to let sales-order proposals confirm automatically.
6. Retention and deletion
#Files you upload for import. The working copy, and the preview made from it, are removed within 48 hours. A processed copy is kept for 30 days so a failed run can be retried.
Your records and documents. Workspace records are kept until you delete them or your organization is deleted. Documents you upload, such as invoices, stay until your organization is deleted: archiving one hides it and keeps the file. To have one deleted sooner, email privacy@zerqano.com.
Deleting your organization. Email privacy@zerqano.com from an owner’s address, and we complete the deletion within 30 days. It removes the organization’s records from the database, its files from file storage and its entries from the search indexes, and deletes the sign-in accounts of people who belong to no other organization. If a step fails, it is logged so we can finish it. Copies in any backups are overwritten within the backup retention period.
7. Incidents
#If we confirm that your data has been accessed without authorization, we will tell your organization’s owner by email without undue delay, and within the time set in the data processing addendum, with what we know, what we are doing about it, and what you may need to do.
8. Report a vulnerability
#If you think you have found a security problem in Zerqano, email security@zerqano.com with the steps to reproduce it, the requests involved, and the pages or endpoints affected. We review reports and aim to reply within 5 business days. If you follow the rules below and act in good faith, we will not bring a legal claim against you for your research.
- Do not access, view or change data that is not yours.
- Do not run denial-of-service tests or automated scans that affect the service for others.
- Give us reasonable time to fix the problem before you publish details.
9. Security and privacy questions
#Where does my data live?
Your workspace records (products, sales, stock, suppliers and purchase orders) are kept in a managed PostgreSQL database run by Supabase, and files you upload are kept in Supabase file storage. Search indexes of your catalog and documents are kept in Qdrant Cloud. The application itself runs on a virtual private server at Hostinger. The full list of services, with what each one receives, is on the Subprocessors page.
Who at my company can see our data?
People you invite to your organization’s workspace. Each person has one of four roles: owner, admin, manager or member. Owners and admins manage who has access, and only an owner can delete the organization.
Can other Zerqano customers see our data?
Zerqano is built so they cannot. Every record that holds business data carries your organization’s ID. The API looks up your organization on each signed-in request and filters by it, and search entries carry the same ID. No software is free of bugs. If we find another customer could have reached your data, we will tell you as the Incidents section describes.
Can Zerqano staff see our data?
The people who run the service can reach the production database and servers to operate and support it. In the app, the platform administration pages are limited to platform administrators. We look at a customer’s data only to run the service, to fix a problem, or when the customer asks us to.
How does the AI use our data?
When you ask a question, import a document or run a review, the relevant part of your workspace data is sent to the AI model that produces the answer, and the answer comes back to your workspace. Zerqano drafts purchase orders. It does not send one to a supplier unless a person in your organization sends it. By default other actions wait for approval too; an admin can choose to let sales-order proposals confirm automatically.
Is our data used to train AI models?
Zerqano does not use your data to train general-purpose AI models or models that serve other customers. It fits forecasting models to your own sales data, for your workspace only. Our AI provider is Google Cloud Vertex AI, and Google’s Vertex AI terms say it does not train on customer data without permission.
Is our data encrypted?
In transit, yes: the site and the API are served over HTTPS only, with TLS 1.2 or 1.3, and HSTS tells browsers never to use plain HTTP. At rest, Supabase encrypts the database with AES-256, as its security page documents. The credentials you give Zerqano to connect another system are encrypted again by Zerqano before they are stored.
Can we export our data?
Your product catalog and your restock plan download as CSV files from the app. For an export of everything in your workspace, email privacy@zerqano.com.
How do we delete our data?
Email privacy@zerqano.com from an owner’s address and we delete the organization within 30 days. That removes its records from the database, its files from file storage, its entries from the search indexes, and the sign-in accounts of people who belong to no other organization. If a step fails, it is logged so we can finish it.
Will you tell us if there is a breach?
Yes. If we confirm that your data has been accessed without authorization, we will tell your organization’s owner by email without undue delay, and within the time set in the data processing addendum, with what we know and what we are doing about it.
Do you support single sign-on?
You can sign in with your work email and a password of at least 10 characters, or with your Google or GitHub account.
How do I report a security problem?
Email security@zerqano.com with the steps to reproduce it. Please do not access or change other people’s data, and do not run tests that degrade the service.