Technology and SaaS

Yes, for Linux servers, PostgreSQL and MySQL. A Linux login uses a certificate in the engineer's name, valid for five minutes by default. A database session runs through the Zerostand gateway with a per-session credential; the database password stays in the vault. The access comes from a grant that expires, or from safe membership your recertification campaigns review.

Yes. Pods prove who they are with the service-account token their cluster gives them; one cluster issuer is set per deployment. Zerostand can also create a short-lived service account bound to a Role you write, removed when its lease expires. Zerostand does not sit in front of the Kubernetes API.

The job presents the OIDC token its CI service issues. Zerostand checks it against the issuer you configure (one per deployment) and, once the identity is enrolled, returns a credential valid for five minutes by default. Where policy allows, the job can also get a short-lived database login. Systems with no platform identity can use a pre-shared secret instead; the Command center flags them.

It supports several criteria in CC6 and CC7 (CC6.1, CC6.2, CC6.3, CC6.6 and CC7.2), and the evidence above helps you show them. A SOC 2 report is an auditor's examination of your organisation, not of a product; using Zerostand does not by itself make you compliant, and that stays your responsibility. Zerostand itself holds no certifications yet; see Trust and security.

As containers on infrastructure you control, on-premises or in your cloud. Data goes elsewhere only to destinations you configure, such as your SIEM, email server or ticketing system.