Securing the product that guards yours.
Where it runs, how secrets are encrypted, how the audit log stays honest, and what we have not done yet.
What we built, and what we have not
Plain statements, including the ones that are still on the roadmap.
Deployment
Containers on infrastructure you control, on-premises or in your cloud. Zerostand is self-hosted: secrets are stored and used there and are never sent to us. Data goes elsewhere only to destinations you configure, such as your SIEM, email server or ticketing system.
Encryption and key custody
TLS by default on Zerostand's listeners and database gateways; internal hops can sit behind your TLS-terminating proxy. Envelope encryption once you configure a key-encryption key from a passphrase or HashiCorp Vault Transit. Cloud KMS and HSM: on the roadmap.
Audit integrity
A hash-chained log you can verify, also forwarded to your SIEM by webhook or syslog.
Availability
Active and standby control-plane nodes on PostgreSQL with leader election and failover. A sealed offline break-glass export covers the worst case.
Access to the product itself
Single sign-on through your identity provider, MFA, role-based administration. Administrative changes are audited.
Security reviews
Status as at 14 October 2026. Independent penetration test: planned. Certifications: not yet. Our security questionnaire answers are available on request, under NDA.
Production controls ship in the product
The requirements that stop a security product going live are built in: switch on the PostgreSQL store, high availability and a key-encryption key at install.
TLS by default
Zerostand's own endpoints use TLS by default. Connections to targets can require a verified certificate; internal hops can sit behind your TLS proxy.
Highly available
Active and standby control-plane nodes on PostgreSQL, with leader election and failover.
Keys you hold
Envelope encryption with a key-encryption key in your custody, never in the database, once you configure a passphrase or HashiCorp Vault Transit.
Sealed break-glass export
A sealed offline export of the break-glass accounts, encrypted to offline keys your security team holds.
Everything audited
Grants, approvals, rotations, sessions, admin changes: who and when, and the reason wherever one is given.
Credentials in the vault
Credentials for your servers and databases live only in the encrypted vault. The few secrets Zerostand needs to start can come from mounted secret files.
Observable
Metrics, health endpoints and a rotation-health view operators use.
Provisioned
SCIM for people and groups; trust rules for fleets of workloads.
Self-hosted, on your infrastructure
Zerostand runs as containers on infrastructure you control, on-premises or in your cloud, with PostgreSQL as its store. We operate no hosted version of the product.
Your product data, meaning vaulted credentials, policies, grants, session recordings and the audit log, stays on your infrastructure. It goes elsewhere only to destinations you configure, such as your SIEM, your email server or your ticketing system. We have no access to your deployment unless you grant it, for example during a support session.
The architecture overview shows the control plane, the enforcement points and the targets; key custody lists where the key-encryption key can come from.
Report a vulnerability
If you believe you have found a security vulnerability in Zerostand or in this website, email security@zerostand.com. Our security.txt carries the same address.
What to include
- The product version, or the page address for an issue on this website.
- Steps to reproduce, and any proof-of-concept you used.
- The impact as you understand it.
- Your name or handle, if you would like to be credited when we publish a fix.
What we do with a report
We acknowledge every report, tell you what we found, and let you know when a fix ships. Fixed vulnerabilities that affect customers are published as security advisories on this page.
Scope and good faith
In scope: the Zerostand product and this website. Out of scope: denial of service, social engineering of our people, physical attacks, and the third-party services we use for forms, hosting and email, which run their own programmes.
We will not take legal action against research done in good faith that stays within this scope, avoids harm to other people's data and gives us reasonable time to fix an issue before it is made public. Please do not access, change or delete data that is not your own.
Advisories published
No security advisories have been published for Zerostand. When we publish one, it will appear here with its severity, affected versions and fix. As at 15 October 2026.
Who processes data for this website
- Web3Forms: form delivery. Demo and contact requests submitted on this site reach us through it.
- Cloudflare: hosting of this website, and the Turnstile bot check on the demo form.
- Our email provider: storing and transmitting our email, including the requests above.
The product is self-hosted, so we process none of your product data and there are no product sub-processors to list. The Privacy Notice describes what the website collects and why.
Data processing agreement
A data processing agreement is available on request for customers. Ask at privacy@zerostand.com. Because the product runs on your infrastructure, the agreement covers the limited personal data we handle in support and in the business relationship, not the data inside your deployment.
Ask us the hard questions
Our security questionnaire answers are available on request, from an engineer who can explain them.