Security answers
Last updated October 13, 2026
The questions a security questionnaire usually asks, answered in plain words. Print this page or save it as a PDF to attach it. Something missing? Email neeraj@zallant.com.
Company and service
- Who runs Zallant?
- NSU Systems LLC, a Virginia company. Zallant is a web app used in the browser; there is no app to install.
- Where is the service hosted?
- On Cloudflare's network (Cloudflare Workers and the D1 database). Zallant is offered in the United States only.
- Which outside companies handle customer data?
- Cloudflare (hosting, database, email sending, bot check) and Stripe (subscriptions; card numbers go straight to Stripe). The full list is on the Security page.
Access and sign-in
- How do people sign in?
- With a one-time link or code sent by email. There are no passwords to steal or reuse. Sign-in attempts are rate-limited.
- Is multi-factor sign-in available?
- Yes. Anyone can add a passkey (Face ID, a fingerprint or a screen lock) as a second step after the email link. On the Team plan a team lead can require it for everyone.
- Is single sign-on (SSO) available?
- No, not today.
- Can people see and end their sessions?
- Yes. Settings lists every signed-in browser, and one tap signs out all the others. Changing the sign-in email signs out every browser.
- Is there a record of account activity?
- Yes. Owners and team leads see the last 90 days of sign-ins and account changes (who, what and when).
- Who at Zallant can reach customer data?
- Only Zallant's founder can reach the live database. Customer data is never copied to laptops or test copies.
Data protection
- Is data encrypted in transit?
- Yes. Every page, link and API call uses HTTPS (HSTS on).
- Is data encrypted at rest?
- Yes. The database is encrypted where it is stored by Cloudflare. Sign-in links, codes and sessions are stored only as one-way hashes.
- How is one customer kept apart from another?
- Every request and database query is limited to the signed-in person's own account; on a team, members see their own leads and team leads see the team's.
- Do logs contain personal data?
- No. Logs hold status codes, counts and short error reasons, never names, emails, phone numbers, message text or tokens.
- Is customer data sold, shared or used for advertising?
- No, never. There are no advertising trackers or session recording.
Backups, retention and deletion
- Is data backed up?
- Yes. The database can be restored to any minute in the last 30 days.
- Can customers export their data?
- Yes. "Download all my data" gives one file with everything, any time, and for 30 days after a plan ends.
- What happens to data when someone leaves?
- An account's data is deleted 30 days after its plan ends, or after the account is deleted. Unsubscribes are kept so nobody is emailed again.
Building and running it
- How are changes checked before release?
- Every change runs automated tests, an accessibility check, a secret scan and a dependency check, and goes to a private test copy before it goes live.
- Has the service been tested for security?
- We test it ourselves (including bot and sign-in abuse tests) and fix what we find. There has been no outside penetration test yet.
- Do you have a SOC 2 report or ISO 27001 certificate?
- No, not today.
- How are problems noticed?
- Zallant's owner is emailed at once when a page, a background job or a payment update fails. Problems customers could notice are listed on the status page.
- What happens if there is a breach?
- We email affected account holders as soon as we know, with what happened and what to do.
- How do I report a security problem?
- Email us (address below). We reply to every report.
More: Security and your data · Privacy Policy · Terms