Security

Our approach

Development applications and pre-construction files are sensitive long before they are public. Zevo is built on the assumption that a city's files stay with the city, a developer's files stay with the developer's team, every finding must be traceable to the clause and document it came from, and access must be provable after the fact.

We design for least privilege, keep data in the customer's country, encrypt it in transit and at rest, and log access so an audit can reconstruct who saw what and when.

Data privacy

Customer content belongs to the customer: a city's applications and review record to the city, a developer's project content to the developer. Each customer's content is segregated in its own tenant, accessible only to users the customer authorises, and never sold or shared for advertising. What we collect and why is set out in the Privacy Policy.

Zevo personnel do not access a city's content except where the city requests support, an incident requires it, or the law compels it; such access is role-restricted, time-bound, and logged. Zevo's planners access a developer's project content only for the files they are engaged on.

Data encryption

In transit

TLS 1.2 or higher for all connections between browsers, APIs, and internal services. HTTP requests are redirected to HTTPS; HSTS is enabled.

At rest

AES-256 encryption for object storage, databases, and backups, with keys held in a managed key service and rotated on a defined schedule.

Backups

Encrypted with the same standard and stored in the same country as the primary data, with restore procedures tested periodically.

Secrets

Held in a managed secrets store, never in source control, and scoped to the service that needs them.

Data residency

Customer content and account data are stored and processed in cloud regions in the customer's country — Canada for Canadian customers, the United States for American customers — and backups are held in the same country. For cities, this keeps applications and the review record inside the jurisdiction's own country, as public-sector records and AI policies commonly expect.

A small number of service providers — for example error monitoring or email delivery — may process limited operational metadata outside the customer's country. Where that occurs we assess the transfer, put contractual safeguards in place, and minimise what is sent. A current list of sub-processors and their locations is available on request; see also Sharing and service providers in the Privacy Policy.

Authentication

Single sign-on

SAML 2.0 and OIDC SSO is available to city departments and developer organisations, so access follows your identity provider and deprovisioning is immediate.

Multi-factor authentication

supported for all accounts and enforced for Zevo personnel.

Credential handling

passwords, where used, are stored only as salted hashes using a modern key-derivation function; we check them against known-breach lists.

Sessions

short-lived tokens, idle timeout, and revocation on password change or SSO deprovisioning.

Authorization

Access is role-based and scoped. In the Software, city staff roles separate who may read findings, who may write comments, who may record a decision, and who may administer the department's account, and applicants see only their own pre-checks. For the Planning services, a developer's users and the Zevo planners engaged see only that developer's files.

• Least privilege is the default for both customer roles and internal service accounts.
• Administrative actions and access to project content are recorded in an audit log the customer can review.
• Findings never approve or refuse an application: every acceptance, comment, and decision is recorded against a named staff member, as described under Professional responsibility in the Terms of Service.

Cookies

The website uses as few cookies and local storage entries as possible. By using the Service, you accept the cookies described below. You can clear or block cookies in your browser settings; strictly necessary cookies are required for authenticated use. See also the Privacy Policy.

Strictly necessary

Session, security, and load-balancing cookies required for the site and platform to function. These cannot be disabled without breaking the Service.

Preferences

Local storage entries that remember your language, light or dark mode, and theme choice. Stored in your browser only.

Analytics

Aggregate, privacy-respecting usage measurement to understand which pages and features are used. No cross-site tracking.

Advertising

None. We do not set third-party advertising or retargeting cookies.

Infrastructure

The Service runs on a major cloud provider in regions in Canada and the United States, in isolated network segments with no public administrative access. Deployments are automated and reviewed, infrastructure is defined as code, and production changes are logged. We monitor availability, errors, and anomalous access continuously.

Vulnerability management

Dependencies are scanned continuously and patched on a risk-based schedule. Code changes require review before reaching production. Third-party penetration testing is performed periodically, and findings are tracked to closure. Access reviews are conducted for staff and service accounts.

Incident response

We maintain an incident response process covering detection, containment, eradication, recovery, and post-incident review. Where a breach of security safeguards creates a real risk of significant harm, we notify affected customers and the appropriate regulators as required by applicable Canadian and US law, with the facts we have and a clear account of what we are doing. See also Security in the Privacy Policy.

Responsible disclosure

If you believe you have found a vulnerability, write to hello@getzevo.ai with enough detail to reproduce it. Please give us reasonable time to remediate before public disclosure, and avoid accessing data that is not yours, degrading service, or running automated scans against production. We will acknowledge your report and keep you informed.

AI transparency

Every finding records the requirement checked, the clause and document version it came from, and its outcome, so a check can be traced and repeated on the same file. For a city's AI register or procurement review, Zevo states the vendor, the hosting provider and region, and the models used, and keeps that statement current.

Compliance

Zevo aligns its controls with recognised frameworks and is building toward third-party attestation. We are happy to complete security questionnaires, including public-sector procurement and AI-register reviews, and to discuss controls, sub-processors, and residency in detail under NDA.

Contact

Security questions, questionnaires, or vulnerability reports: hello@getzevo.ai. Zevo, Inc., Greater Vancouver Area, British Columbia, Canada.